HIPAA Privacy Rule

HIPAA Privacy Rule Overview

374
0

Please support Telehealth.org’s ability to deliver helpful news, opinions, and analyses by turning off your ad blocker.

Although the Health Insurance Portability and Accountability Act (HIPAA) was enacted in 1996, the HIPAA Privacy Rule wasn’t added to the regulation until 2002. The HIPAA Privacy Rule was created to ensure the confidentiality of protected health information (PHI). The HIPAA Privacy Rule provides industry standards for the proper use and disclosure of PHI, including who should have access to PHI.

What is Protected Health Information?

To understand the HIPAA Privacy Rule, it is important to know what is considered protected health information (PHI) under the HIPAA regulation. The Department of Health and Human Services (HHS) considers the following 18 identifiers to be PHI:

  1. Patient names
  2. Geographical elements (such as a street address, city, county, or zip code)
  3. Dates related to the health or identity of individuals (including birthdates, date of admission, date of discharge, date of death, or exact age of a patient older than 89)
  4. Telephone numbers
  5. Fax numbers
  6. Email addresses
  7. Social Security numbers
  8. Medical record numbers
  9. Health insurance beneficiary numbers
  10. Account numbers
  11. Certificate/license numbers
  12. Vehicle identifiers
  13. Device attributes or serial numbers
  14. Digital identifiers, such as website URLs
  15. IP addresses
  16. Biometric elements, including finger, retinal, and voiceprints
  17. Full face photographic images
  18. Other identifying numbers or codes

It may be surprising that some of these items are PHI, such as IP addresses, however, the above-listed items are considered “individually identifiable health information.” This means that the information can be directly tied back to a specific patient.

What Did the HIPAA Privacy Rule Establish?

The HIPAA Privacy Rule established several standards including:

  • Permitted Use and Disclosure of PHI: A covered entity must obtain the individual’s written authorization for any use or disclosure of protected health information that is not for treatment, payment or health care operations or otherwise permitted or required by the HIPAA Privacy Rule.
  • The Minimum Necessary Rule: A covered entity must make reasonable efforts to use, disclose, and request only the minimum amount of protected health information needed to accomplish the intended purpose of the use, disclosure, or request.
  • Notice of Privacy Practices: The notice must describe the ways in which the covered entity may use and disclose protected health information. The notice must state the covered entity’s duties to protect privacy, provide a notice of privacy practices, and abide by the terms of the current notice. The notice must describe individuals’ rights, including the right to complain to HHS and to the covered entity if they believe their privacy rights have been violated. The notice must include a point of contact for further information and for making complaints to the covered entity.
  • Privacy Policies and Procedures: A covered entity must develop and implement written privacy policies and procedures that are consistent with the HIPAA Privacy Rule.
  • Privacy Personnel: A covered entity must designate a privacy official responsible for developing and implementing its privacy policies and procedures, and a contact person or contact office responsible for receiving complaints and providing individuals with information on the covered entity’s privacy practices.
  • Workforce Training and Management: All workforce members must be trained on an organization’s privacy policies and procedures.
  • Data Safeguards: A covered entity must maintain reasonable and appropriate administrative, technical, and physical safeguards to prevent intentional or unintentional use or disclosure of protected health information.
  • Documentation and Record Retention: A covered entity is required to retain records for six years for privacy policies and procedures, privacy practices notices, and disposition of complaints.
Basic Telehealth Legal & Ethical Rules: HIPAA, Privacy, Working Across State Lines, Malpractice Insurance

Bring your telehealth practice into legal compliance. Get up to date on inter-jurisdictional practice, privacy, HIPAA, referrals, risk management, duty to warn, the duty to report, termination, and much more!

Disclaimer: Telehealth.org offers information as educational material designed to inform you of issues, products, or services potentially of interest. We cannot and do not accept liability for your decisions regarding any information offered. Please conduct your due diligence before taking action. Also, the views and opinions expressed are not intended to malign any organization, company, or individual. Product names, logos, brands, and other trademarks or images are the property of their respective trademark holders. There is no affiliation, sponsorship, or partnership suggested by using these brands unless contained in an ad. We do not and cannot offer legal, ethical, billing technical, medical, or therapeutic advice. Use of this site constitutes your agreement to Telehealth.org Privacy Policy and Terms and Conditions.

Subscribe
Notify of
guest
0 Comments
Inline Feedbacks
View all comments
0
Would love your thoughts, please comment.x