Privacy and Security of Health Information

1 Guide to Privacy and Security of Health Information1 Guide to Privacy and Securityof Health Information Version 022112 The Information contained in this guide is not intended to serve as legal advice nor should it substitute for legal counsel. The guide is not exhaustive, and readers are encouraged to seek additional detailed technical guidance to supplement the Information contained to Privacy and Security of Health Information25 Integrating Privacy and Security into Your Practice Understanding Patients Individual Rights and Provider Responsibilities Ensuring Privacy and Security of electronic Health Information is a key component to building the trust required to disclose necessary Health Information and could have life-threatening consequences. The Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy and Security Rules protect the paper, or other media, you have responsibilities for saf eguarding Health Information .

2 The HIPAA Privacy Rule covers protected Health Information (PHI) in any medium, while the HIPAA Security Rule covers electronic protected Health Information (e-PHI). HIPAA Rules have detailed requirements regarding both Privacy and practice, not your electronic Health record (EHR) vendor, is responsible fo r taking the steps needed to comply with HIPAA Privacy , Security standards, and the Centers for Medicare & Medicaid Services (CMS ) Meaningful Use up on laws governing the Privacy and Security of Health Information . You must comply with all applicable federal, state, and local laws. The HIPAA Privacy RuleThe HIPAA Privacy Rule27health Information often referred to as protected Health Information by covered entities, as well as standards for providing individuals with Privacy rights and helping individuals understand and control how their Health Information is used.

3 HIPAA Privacy Rule requirements : ApplyChapter 4: to most Health care providers, including those who do not have EHRs or do not participate in a CMS EHR incentive program; Set a federal floor for protecting individually identifiable Health Information across all mediums (electronic, paper, and oral); Limits how covered entities may use and disclose individually identifiable Health Information they receive or create; Gives individuals rights with respect to their protected Health Information , including a right to examine and obtain a copy of Information in their medical records, and the right to ask covered entities to amend their medical record if Information is inaccurate or incompleted; Imposes administrative requirements for covered entities, such as training of employees with regard to the Privacy Rule; and Establishes civil penalties.

4 Violations of the Privacy Rule may be enforced through imposition of civil and criminal penalties. Learn more about HIPAA enforcement. 27 to Privacy and Security of Health Information26 Several central tenets of the Privacy Rule are: In general, you may use or disclose protected Health Information for treatment, payment, and Health care operations without obtaining a patient s written permission. For other purposes, such as marketing, you may need to obtain an individual s authorization to use or disclose the patient s protected Health Information . Your agreements with business associates must explicitly require them to comply with HIPAA, including breach notification requirements . Generally, you and your business associates must limit your access to, use of, and disclosure of protected Health Information to the minimum necessary to carry out an action.

5 This is called the minimum necessary rule. There are several exceptions to this rule. For example, generally, you do not have to limit the disclosure of protected Health Information to the minimum amount necessary when you are disclosing the Information for treatment of the Rights and Your Responsibilities Under HIPAA, patients have legal, individual rights to access their Health Information and learn about disclosures of their Health Information . As their Health care provider, you are responsible for respecting these rights. The Department of Health and Human Services Office for Civil Rights (OCR) explains these rights and other requirements in its Summary of the HIPAA Privacy Rule28. As a covered entity, you have responsibilities to patients under the HIPAA Privacy Rule, including: Notice of Privacy practices: Under the HIPAA Privacy Rule, covered entities must provide patients with full Information on how their protected Health Information is used and disclosed.

6 This is accomplished by giving patients a Notice of Privacy Practices that describes how an individual s Information may be used or shared, specifies an individual s legal rights with respect to their protected Health Information held by the covered entity (many of which are described below), and the covered entity s legal duties. Patient access to their Information : Patients have the right to inspect, review, and receive a copy of Health Information about themselves held by covered entities or business associates in a designated record set, which includes a Health care provider s medical and billing records. Generally, these Health plans and 28 Topics Complying with Privacy & Security RequirementsResources HIPAA requirements in detail (OCR) The Privacy Rule, in detail (OCR) The Security Rule, in detail (OCR) Customized, on-the-ground assistance to providers Privacy and Security ResourcesGuide to Privacy and Security of Health Information27providers have to comply with requests for access within 30 days.

7 Amending patient Information : Patients have the right to request that covered entities amend their protected Health Information in a designated record set when that Information is inaccurate or incomplete. If a covered entity accepts an amendment request, it must make reasonable efforts to provide the amendment to persons that the individual has identified as needing it, and to persons that the covered entity knows might rely on the Information . If the request is denied, covered entities must provide the individual with a written denial and allow the individual to submit a statement of disagreement for inclusion in the record. Accounting of disclosures: Individuals have a right to receive an accounting of disclosures, which is a listing of when a HIPAA covered entity has shared the individual s PHI with a person or organization outside of the entity.

8 Accounting is only required for certain disclosure purposes. A covered entity must provide an accounting of disclosures made during the accounting period, which is six years immediately preceding the accounting request, but a covered entity is not obligated to account for any disclosure made before its Privacy Rule compliance date. Rights to restrict Information : Individuals have the right to request that a covered entity restrict use or disclosure of protected Health Information for treatment, payment or Health care operations, disclosure to persons involved in the individual s Health care or payment for Health care, or disclosure to notify family members or others about the individual s general condition, location, or death. A covered entity is under no obligation to agree to requests for restrictions; however, a covered entity must have a procedure to evaluate all requests.

9 A covered entity that does agree must comply with the agreed restrictions, except for purposes of treating the individual in a medical Record SetA designated record set is basically a group of records which a covered entity uses to make decisions about individuals, and includes a Health care provider s medical records and billing records, and a Health plan s enrollment, payment, claims adjudication, and case or medical management record systems. For more Information about what a designated record set, please see OCR s website29 .HIPAA Limits on Using & Disclosing Patient InformationWhat types of Information does HIPAA protect?29 to Privacy and Security of Health Information28 The Privacy Rule applies to all PHI30 , which includes, when held or transmitted by a covered entity, Information that: Relates to the individual s past, present, or future physical or mental Health or condition; to the provision of Health care to an individual; or to past, present, or future payment for the provision of Health care to the individual; and Identifies the individual, or for which there is a reasonable basis to believe it can be used to identify the Health Information can be in any form electronic, paper, or oral and includes financial and demographic Information collected from patients.

10 Is there any Information that is not restricted by HIPAA?HIPAA Rules do not govern the use or disclosure of Health Information that does not identify an individual (known as de-identified PHI). Once PHI is de-identified in accordance with the HIPAA Privacy Rule, it is no longer PHI and, thus, may be used and disclosed by the covered entity or Health Information organization for any purpose (subject to any other applicable laws). You can share de-identified PHI, but just removing name, address, and social Security number may NOT make Information de-identified31 . The Privacy Rule designates two processes through which a covered entity can determine that protected Health Information is de-identified. Also, the HIPAA Rules do not apply to a covered entity s own employment records, or to education-related and certain other records covered by the Family Educational Rights and Privacy Act (FERPA)32.