HIPAA Privacy Rule

The HIPAA Privacy Rule governs how covered entities may use and disclose protected health information. It establishes patient rights over their health information and sets limits on who can access PHI and under what circumstances.

Permitted Uses and Disclosures

PHI can be used and disclosed without patient authorization for three core purposes: treatment (providing and coordinating healthcare), payment (billing and reimbursement activities), and healthcare operations (quality assessment, training, and business management).

Beyond these, certain disclosures are permitted without authorization, including disclosures required by law, for public health activities, to report abuse or neglect, for health oversight activities, for judicial proceedings, for law enforcement purposes, and to avert serious threats to health or safety.

The Minimum Necessary Standard

When using or disclosing PHI, covered entities must make reasonable efforts to limit access to the minimum necessary information to accomplish the intended purpose. This means not providing an entire medical record when only a specific data element is needed. The minimum necessary standard does not apply to disclosures for treatment purposes.

Patient Rights

The Privacy Rule grants patients several rights: the right to access their PHI, the right to request amendments, the right to receive an accounting of disclosures, the right to request restrictions on uses and disclosures, and the right to request confidential communications. Covered entities must have processes to honor these rights.

Notice of Privacy Practices

Covered entities must provide patients with a Notice of Privacy Practices (NPP) describing how PHI may be used and disclosed, the entity's legal duties, and the patient's rights. The NPP must be provided at the first point of service and posted prominently.

De-Identification

The Privacy Rule allows use of de-identified health information without restriction. Information is de-identified when 18 specified identifiers are removed (Safe Harbor method) or when a statistical expert confirms the risk of identification is very small (Expert Determination method).

In the next lesson, we will cover breach notification requirements.