This post is a summary of key elements of the HIPAA Privacy Rule including who is covered, what information is protected, and how protected health information can be used and disclosed.
For more info please refer to hhs.gov
Anyway, our article is presenting in three posts.
What’s Privacy Rule?
The Standards for Privacy of Individually Identifiable Health Information (“Privacy Rule”) establishes, for the first time, a set of national standards for the protection of certain health information. The U.S. Department of Health and Human Services (“HHS”) issued the Privacy Rule to implement the requirement of the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”). A major goal of the Privacy Rule is to assure that individuals’ health information is properly protected while allowing the flow of health information needed to provide and promote high quality health care and to protect the public’s health and well being.
Who is covered by the Privacy Rule?
Covered entities include:
Individual and group plans that provide or pay the cost of medical care are covered entities.
These plans include:
- Vision and prescription drug insurers
- Health maintenance organizations (HMOs)
- Medicare+Choice and Medicare supplement insurers
- Long-term care insurers (excluding nursing home fixed-indemnity policies).
- Employer-sponsored group health plans
- Government and church-sponsored health plans
Two types of government-funded programs are not health plans:
- Those whose principal purpose is not providing or paying the cost of health care, such as the food stamps program those programs whose principal activity is directly providing health care, such as a community health center, or the making of grants to fund the direct provision of health care.
- Certain types of insurance entities are also not health plans, including entities providing only workers’ compensation, automobile insurance, and property and casualty insurance. If an insurance entity has separable lines of business, one of which is a health plan, the HIPAA regulations apply to the entity with respect to the health plan line of business.
Health Care Providers
Every health care provider, regardless of size, who electronically transmits health information in connection with certain transactions, is a covered entity. These transactions include claims, benefit eligibility inquiries, referral authorization requests, or other transactions for which HHS has established standards under the HIPAA Transactions Rule Using electronic technology, such as email, does not mean a health care provider is a covered entity; the transmission must be in connection with a standard transaction.
Health Care Clearinghouses
Health care clearinghouses are entities that process nonstandard information they receive from another entity into a standard (i.e., standard format or data content), or vice versa.
In most instances, health care clearinghouses will receive individually identifiable health information only when they are providing these processing services to a health plan or health care provider as a business associate. In such instances, only certain provisions of the Privacy Rule are applicable to the health care clearinghouse’s uses and disclosures of protected health information.
Business Associate Defined
A business associate is a person or organization, other than a member of a covered entity’s workforce, that performs certain functions or activities on behalf of, or provides certain services to, a covered entity that involve the use or disclosure of individually identifiable health information.
Business associate services to a covered entity are limited to legal, actuarial, accounting, and consulting, data aggregation, management, administrative, accreditation, or financial services. However, persons or organizations are not considered business associates if their functions or services do not involve the use or disclosure of protected health information, and where any access to protected health information by such persons would be incidental, if at all.
Business Associate Contract
When a covered entity uses a contractor or other non-workforce member to perform “business associate” services or activities, the Rule requires that the covered entity include certain protections for the information in a business associate agreement.
In the business associate contract, a covered entity must impose specified written safeguards on the individually identifiable health information used or disclosed by its business associates. A covered entity may not contractually authorize its business associate to make any use or disclosure of protected health information that would violate the Rule.
For more info please refer to hhs.gov
What Information is Protected ?
Protected Health Information
The Privacy Rule protects all “individually identifiable health information” held or transmitted by a covered entity or its business associate, in any form or media, whether electronic, paper, or oral. The Privacy Rule calls this information “protected health information (PHI).”
“Individually identifiable health information” is information, including demographic data, that relates to:
- The individual’s past, present or future physical or mental health or condition
- The provision of health care to the individual
- The past, present, or future payment for the provision of health care to the individual
Individually identifiable health information includes many common identifiers (e.g., name, address, birth date, Social Security Number).
De-Identified Health Information
There are no restrictions on the use or disclosure of de-identified health information.
De-identified health information neither identifies nor provides a reasonable basis to identify an individual. There are two ways to de-identify information; either:
- A formal determination by a qualified statistician
- The removal of specified identifiers of the individual and of the individual’s relatives, household members, and employers is required, and is adequate.
General Principle for Uses and Disclosures
A covered entity may not use or disclose protected health information, except either:
- As the Privacy Rule permits or requires
- As the individual who is the subject of the information (or the individual’s personal representative) authorizes in writing
A covered entity must disclose protected health information in only two situations:
- To individuals (or their personal representatives) specifically when they request access to, or an accounting of disclosures of, their protected health information
- To HHS when it is undertaking a compliance investigation or review or enforcement action
Permitted Uses and Disclosures
A covered entity is permitted, but not required, to use and disclose protected health information, without an individual’s authorization, for the following purposes or situations:
To the Individual
A covered entity may disclose protected health information to the individual who is the subject of the information.
Treatment, Payment, Health Care Operations
A covered entity may use and disclose protected health information for its own treatment, payment, and health care operations activities. A covered entity also may disclose protected health information for the treatment activities of any health care provider and the payment activities of another covered entity.
It is the provision, coordination, or management of health care and related services for an individual by one or more health care providers, including consultation between providers regarding a patient and referral of a patient by one provider to another.
Payment is include:
- Activities of a health plan to obtain premiums
- Determining or fulfill responsibilities for coverage
- Provisioning of benefits
- Furnishing or obtaining reimbursement for health care delivered to an individual
- Activities of a health care provider to obtain payment be reimbursed for the provision of health care to an individual
Health care operations
These operation are any of the following activities:
- Quality assessment and improvement activities, including case management and care coordination
- Competency assurance activities, including provider or health plan performance evaluation, credentialing, and accreditation
- Conducting or arranging for medical reviews, audits, or legal services, including fraud and abuse detection and compliance programs
- Specified insurance functions, such as underwriting, risk rating, and re-insuring risk
- Business planning, development, management, and administration
- Business management and general administrative activities of the entity
Also Health care operations including but not limited to:
- De-identifying protected health information
- Creating a limited data set
- Certain fundraising for the benefit of the covered entity
Opportunity to Agree or Object
Informal permission may be obtained by asking the individual outright, or by circumstances that clearly give the individual the opportunity to agree, acquiesce, or object. Where the individual is incapacitated, in an emergency situation, or not available, covered entities generally may make such uses and disclosures, if in the exercise of their professional judgment, the use or disclosure is determined to be in the best interests of the individual.
- Facility Directories: It is a common practice in many health care facilities, such as hospitals, to maintain a directory of patient contact information. A covered health care provider may rely on an individual’s informal permission to list in its facility directory the individual’s name, general condition, religious affiliation, and location in the provider’s facility.
- For Notification and Other Purposes: A covered entity also may rely on an individual’s informal permission to disclose to the individual’s family, relatives, or friends, or to other persons whom the individual identifies, protected health information directly relevant to that person’s involvement in the individual’s care or payment for care. Also, a covered entity may rely on an individual’s informal permission to use or disclose protected health information for the purpose of notifying (including identifying or locating) family members, personal representatives, or others responsible for the individual’s care of the individual’s location, general condition, or death.
Incidental Use and Disclosure
The Privacy Rule does not require that every risk of an incidental use or disclosure of protected health information be eliminated. A use or disclosure of this information that occurs as a result of, or as “incident to,” an otherwise permitted use or disclosure is permitted.
Public Interest and Benefit Activities
The Privacy Rule permits use and disclosure of protected health information, without an individual’s authorization or permission, for 12 national priority purposes. These purposes are:
Required by Law
Covered entities may use and disclose protected health information without individual authorization as required by law.
Public Health Activities
Covered entities may disclose protected health information to:
- Public health authorities authorized.
Entities subject to FDA regulation regarding FDA regulated products or activities.
- Individuals who may have contracted or been exposed to a communicable disease when notification is authorized by law.
- Employers, regarding employees.
Victims of Abuse, Neglect or Domestic Violence
In certain circumstances, covered entities may disclose protected health information to appropriate government authorities regarding victims of abuse, neglect, or domestic violence.
Health Oversight Activities
Covered entities may disclose protected health information to health oversight agencies (as defined in the Rule).
Judicial and Administrative Proceedings
Covered entities may disclose protected health information in a judicial or administrative proceeding if the request for the information is through an order from a court or administrative tribunal.
Law Enforcement Purposes
Covered entities may disclose protected health information to law enforcement officials for law enforcement purposes under the following six circumstances, and subject to specified conditions:
- As required by law (including court orders, court-ordered warrants, subpoenas) and administrative requests
- To identify or locate a suspect, fugitive, material witness, or missing person
- In response to a law enforcement official’s request for information about a victim or suspected victim of a crime
- To alert law enforcement of a person’s death, if the covered entity suspects that criminal activity caused the death
- When a covered entity believes that protected health information is evidence of a crime that occurred on its premises
- By a covered health care provider in a medical emergency not occurring on its premises
Covered entities may disclose protected health information to funeral directors as needed, and to coroners or medical examiners to identify a deceased person, determine the cause of death, and perform other functions authorized by law.
Cadaveric Organ, Eye, or Tissue Donation
Covered entities may use or disclose protected health information to facilitate the donation and transplantation of cadaveric organs, eyes, and tissue.
The Privacy Rule permits a covered entity to use and disclose protected health information for research purposes, without an individual’s authorization, provided the covered entity obtains either:
- Documentation that an alteration or waiver of individuals’ authorization for the use or disclosure of protected health information about them for research purposes has been approved by an Institutional Review Board or Privacy Board.
- Representations from the researcher that the use or disclosure of the protected health information is solely to prepare a research protocol or for similar purpose preparatory to research.
- Representations from the researcher that the use or disclosure sought is solely for research on the protected health information of decedents, that the protected health information sought is necessary for the research, and, at the request of the covered entity, documentation of the death of the individuals about whom information is sought.
Serious Threat to Health or Safety
Covered entities may disclose protected health information that they believe is necessary to prevent or lessen a serious and imminent threat to a person or the public.
Essential Government Functions
These functions are:
- Assuring proper execution of a military mission
- Conducting intelligence and national security activities that are authorized by law
- Providing protective services to the President
- Making medical suitability determinations for U.S. State Department employees
- Protecting the health and safety of inmates or employees in a correctional institution
- Determining eligibility for or conducting enrollment in certain government benefit programs
Covered entities may disclose protected health information as authorized by, and to comply with, workers’ compensation laws and other similar programs providing benefits for work-related injuries or illnesses.
Limited Data Set
A limited data set is protected health information from which certain specified direct identifiers of individuals and their relatives, household members, and employers have been removed. This set may be used and disclosed for research, health care operations, and public health purposes, provided the recipient enters into a data use agreement promising specified safeguards for the protected health information within the limited data set.
For more info please refer to hhs.gov