Up to Date with the HIPAA Privacy Rule

one photo; Nata-Lia / shutterstock.com

Throughout a patient’s lifetime, providers are entrusted with their most intimate and personal information, which they expect to be kept private and confidential. Unfortunately, the healthcare system can face serious implications if any part of a patient’s privacy or information is breached.

Under the Health Information Portability & Accountability Act (HIPAA) and state laws healthcare providers are required to comply with very specific rules relating to patient rights and release of medical information. Under HIPAA, the Department of Health and Human Services (HHS) created national criteria for all health plans, providers and clearinghouses (also known as covered entities) as they relate to the use and disclosure of personally identifiable information that pertains to a patient’s privacy and personal health information.¹ The Privacy Rule also gives patients rights over their health information and the right to access their own medical records. Giving patients more accessibility allows consumers to have more control over their medical information, including how it is used by and distributed among healthcare providers and organizations.

Patient health information and any identifying information, in any medium or format, whether in files, email, audio, video or verbal communication, is protected under the Privacy Rule. The rule considers any of the following as private health information:

• Name;
• Date of birth or death;
• Treatment dates or any other dates relating to patient’s illness or care;
• Telephone number(s);
• Address;
• Email;
• Social Security number;
• Medical record numbers;
• Photographs;
• License/certification numbers;
• Fingerprints; and
• Any other unique identifying number or account number.

The HIPAA rules apply to all covered entities that electronically transmit any health information, particularly such transactions as billing, reimbursement for services or verification of insurance coverage. Practices should keep in mind that if vendors or outside organizations, known as business associates (BA), have access to protected health information (PHI), it is imperative to have a written BA agreement on file. The agreement must state how the patient health information will be used, disclosed and protected. The HIPAA Security Rule requires covered entities and business associates to implement policies and procedures regarding the disposal and reuse of hardware and electronic media containing PHI in electronic form (ePHI).² Improper disposal of electronic devices and media puts the information stored on such devices as computer equipment, desktops, laptops, tablets, copiers, servers, smartphones, hard drives, USB drives or any electronic storage device at risk for a potential breach.

Compliance is not an option; it is required. Employees are obligated to comply with their practice’s or organization’s privacy and security policies and procedures, because patients place their trust in medical practices to preserve the privacy of their sensitive and personal information. If practices or individuals choose not to follow the rules: