Privacy Rule provisions

Privacy Rule Basics - The HIPAA Handshake

• Protected Health Information (PHI): Individually identifiable health information held by a Covered Entity. It links a patient to their health data and includes 18 specific identifiers (e.g., name, address, dates, SSN).

• Key Players:

  • Covered Entities (CEs): Health plans, clearinghouses, and providers (hospitals, clinics).
  • Business Associates (BAs): Entities performing functions for a CE involving PHI (billing services, legal counsel).

• Core Principle: Minimum Necessary Rule

  • Limit use and disclosure of PHI to the minimum required for the intended purpose.

• De-identification: Removes identifiers, rendering data non-PHI.

  • Safe Harbor: Remove all 18 identifiers.
  • Expert Determination: Statistical certification of low re-identification risk.

⭐ A rare diagnosis combined with a zip code can be enough to identify a patient, making it PHI even without a name.

Patient Privileges - Your Health Info Rights

• Right of Access: Patients can inspect & get copies of their PHI.
  • Covered entities have 30 days to provide the information.
• Right to Amend: Patients can request corrections to inaccurate or incomplete PHI.
  • The entity can deny the request if the information is deemed accurate.
• Right to an Accounting of Disclosures: Request a list of who has accessed their PHI.
• Right to Request Restrictions: Patients can request limits on the use or sharing of their PHI.
  • Providers are not required to agree, with one major exception.

⭐ A provider must agree to a restriction request if the disclosure is to a health plan for payment purposes and the patient has paid for the service out-of-pocket in full.

• Right to Confidential Communications: Patients can request communication via alternative means or locations (e.g., cell phone vs. home phone).

Disclosure Rules - When Silence Isn't Golden

• Treatment, Payment, & Healthcare Operations (TPO): PHI can be used and disclosed without specific authorization for these core activities. 📌 TPO: Think 'The Privacy Office' lets these slide.
• Required Disclosures: Must be provided to:
  • The individual upon request (their own PHI).
  • The Dept. of Health & Human Services (HHS) for compliance reviews.
• Permitted Disclosures (Public Interest): Allowed for 12 priority purposes like public health activities, legal orders, or to avert serious threats to safety.
• Valid Authorization: For all other disclosures (e.g., marketing, research), a signed, specific, and dated patient authorization is mandatory.

⭐ The "minimum necessary" rule does not apply to disclosures to another healthcare provider for treatment purposes.

High‑Yield Points - ⚡ Biggest Takeaways

• The Privacy Rule protects all forms of Protected Health Information (PHI)-oral, written, or electronic.
• Patients have a right to access, amend, and receive an accounting of disclosures of their PHI.
• PHI can be used for Treatment, Payment, and Operations (TPO) without explicit authorization.
• The "minimum necessary" standard applies to most disclosures of PHI.
• Incidental disclosures are permissible if reasonable safeguards are implemented.
• Psychotherapy notes receive heightened protection and require specific authorization for release.