INTRODUCTION TO THE PRIVACY RULE

The HIPAA Privacy Rule, which took effect in 2003, is the foundation of patient privacy protection in the United States. It’s the first comprehensive federal protection for the privacy of health information.

The Privacy Rule governs:

 

• • How PHI can be used and disclosed
  • Patient rights regarding their health information
  • Requirements for covered entities to protect privacy
  • When authorization is needed vs. when it’s not
  • Penalties for privacy violations

Why It Matters:

 

Every single day, you’ll make decisions about patient privacy. Can you discuss a case with a colleague? Can you email test results? Can you leave a voicemail? The Privacy Rule provides the framework for these decisions.

 

 

PROTECTED HEALTH INFORMATION (PHI) – DEEP DIVE

 

Definition:

 

PHI is individually identifiable health information that is:

 

1. Created or received by a covered entity

 

2. Relates to past, present, or future physical/mental health, healthcare provision, or payment for healthcare
3. Identifies the individual OR could reasonably be used to identify the individual

 

The Three-Part Test:

 

For information to be PHI, it must meet ALL three criteria above.

 

Examples of PHI:

 

MEDICAL INFORMATION + IDENTIFIERS = PHI

 

• Patient name + diagnosis
• Medical record number + treatment plan
• Address + lab results
• Photo + health condition
• Email address + appointment information
• Phone number + prescription details

Tricky Situations:

 

Situation 1: De-identified Information

 

“A 62-year-old female with diabetes…” (NO identifiers) = NOT PHI “Mrs. Johnson with diabetes…” (Name included) = PHI

Situation 2: Indirect Identifiers

 

“The patient in Room 405…” = PHI (room number can identify someone) “The mayor who was admitted yesterday…” = PHI (title + date can identify)

“The woman with the unique tattoo…” = COULD BE PHI (unique characteristic might identify)

 

Situation 3: Information Overheard by Patients

 

You’re discussing Patient A with a colleague, and Patient B overhears in the waiting room. Even though you didn’t directly disclose to Patient B, this is still a privacy violation because PHI should not be discussed where others can hear.

The 18 Identifiers (Review):

 

1. Names

 

2. Geographic data smaller than state

 

3. Dates (except year)

 

4. Phone numbers

 

5. Fax numbers

 

6. Email addresses

 

7. Social Security numbers

 

8. Medical record numbers

 

9. Health plan numbers

 

10. Account numbers

 

11. Certificate/license numbers

 

12. Vehicle identifiers

 

13. Device identifiers

 

14. Web URLs

 

15. IP addresses

 

16. Biometric identifiers

 

17. Full-face photos

 

18. Any other unique identifier

 

PERMITTED USES AND DISCLOSURES (Without Authorization)

 

The Privacy Rule allows certain uses and disclosures of PHI WITHOUT patient authorization:

 

**1. TREATMENT**

 

• Sharing information between providers caring for the patient
• Consulting with specialists
• Referring patients to other providers

 

• Coordinating care

Examples:

 

• A nurse can share a patient’s vital signs with the attending physician
• A primary care doctor can send records to a specialist
• An ER doctor can call the patient’s cardiologist for medical history
• A pharmacist can contact a doctor about a prescription question

 

**2. PAYMENT**

 

• Billing and claims processing
• Determining coverage and eligibility
• Utilization review
• Collections activities

Examples:

 

• Submitting insurance claims with diagnosis codes
• Verifying insurance coverage before a procedure
• Sending bills to patients or insurance companies
• Responding to payment audits

 

**3. HEALTHCARE OPERATIONS**

 

• Quality improvement activities
• Training healthcare professionals
• Accreditation and licensing
• Business planning and management
• Customer service

Examples:

 

• Reviewing charts for quality assurance
• Training new employees using case studies (if properly de-identified or with minimal PHI)
• Conducting internal audits
• Credentialing medical staff

 

**Remember TPO:** Treatment, Payment, and Healthcare Operations are the “big three” that allow PHI use without authorization!

4.  OTHER PERMITTED DISCLOSURES (Without Authorization): Public Health Activities:

• Reporting communicable diseases
• Reporting vaccine adverse events
• FDA surveillance
• Workplace medical surveillance

Abuse, Neglect, or Domestic Violence:

 

• Reporting suspected child abuse
• Reporting elder abuse
• Reporting domestic violence (with some conditions)

Health Oversight Activities:

 

• Government audits and investigations
• Licensing boards
• Medicare/Medicaid reviews

Judicial and Administrative Proceedings:

 

• Court orders and subpoenas (with proper legal process)
• Workers’ compensation cases

Law Enforcement:

 

• Identifying suspects, fugitives, witnesses
• Reporting gunshot wounds or other injuries
• Responding to valid warrants or court orders

Decedents:

 

• Coroners and medical examiners
• Funeral directors
• Organ donation organizations

Research (with conditions):

 

• IRB-approved research protocols
• De-identified data
• Limited data sets with data use agreements

Serious Threats:

 

• Preventing or lessening serious and imminent threat to health/safety
• Averting a serious threat to public safety

**Important Note:** Even when disclosure is permitted, the “minimum necessary” standard usually applies!

 

WHEN AUTHORIZATION IS REQUIRED

 

Patient authorization (written permission) is REQUIRED for:

 

**1. MARKETING**

 

• Promotional communications about products or services
• Selling patient contact information to third parties

**Exception:** Communications about your own health-related products/services or treatment alternatives generally don’t require authorization.

 

**2. SALE OF PHI**

 

• Any exchange of PHI for remuneration (payment)

 

**3. PSYCHOTHERAPY NOTES**

 

• Detailed notes from mental health counseling sessions
• These have extra protections beyond regular medical records

 

**4. USES NOT COVERED BY TPO OR OTHER PERMITTED CATEGORIES**

 

• Sharing information with family members (if not involved in care)
• Employer requests for employee health information
• Providing records to attorneys for lawsuits
• Any disclosure not specifically permitted by the Privacy Rule

 

What Makes a Valid Authorization?

 

A valid HIPAA authorization must include:

 

• Description of the information to be disclosed
• Who is authorized to make the disclosure
• Who will receive the information
• Purpose of the disclosure
• Expiration date or event
• Patient’s signature and date
• Right to revoke the authorization
• Statement about redisclosure risks

Invalid Authorizations:

 

? Blanket authorizations (“all information”)

? Coerced authorizations

? Expired authorizations

? Incomplete authorizations

 

THE MINIMUM NECESSARY STANDARD

 

The Principle:

 

When using or disclosing PHI, you must limit the information to the MINIMUM NECESSARY to accomplish the intended purpose.

When It Applies:

 

• Routine uses and disclosures
• Requests for information from other covered entities
• Internal uses within your organization

When It Does NOT Apply:

 

• Disclosures to the patient themselves
• Disclosures pursuant to patient authorization
• Treatment purposes (provider to provider)
• Required by law disclosures

 

• HHS compliance reviews

Practical Application:

 

Scenario 1: Scheduling an Appointment

 

MINIMUM NECESSARY: Patient name, phone number, reason for visit NOT NECESSARY: Full medical history, lab results, medications Scenario 2: Billing Department Processing Claim

MINIMUM NECESSARY: Diagnosis code, procedure code, dates of service, patient demographics NOT NECESSARY: Detailed clinical notes, family history

Scenario 3: IT Department Troubleshooting EHR Issue

 

MINIMUM NECESSARY: Test patient data or specific fields being problematic NOT NECESSARY: Access to all patient records in the system

Scenario 4: Nurse Asking About Patient Care

 

MINIMUM NECESSARY: Current medications, allergies, vital signs, relevant history for current treatment

NOT NECESSARY: Psychiatric history unrelated to current admission

 

How to Implement Minimum Necessary:

 

For Routine Disclosures:

 

• Create standard protocols (only share specific fields for specific purposes)
• Use role-based access in EHR systems
• Train staff on what they need vs. what they’re curious about

For Non-Routine Disclosures:

 

• Review each request individually
• Ask: “What is the purpose?” and “What is actually needed?”
• Provide only what’s essential

The “Need to Know” Test:

 

Before accessing or sharing PHI, ask yourself:

 

1. Do I need this information to do my job right now?

 

2. Is this the least amount of information that will work?

 

3. Am I accessing only what I’m supposed to access?

 

If you answer “no” to any question, STOP!

 

**1. RIGHT TO NOTICE OF PRIVACY PRACTICES**

 

Patients must receive a Notice of Privacy Practices (NPP) that explains:

 

• How their information may be used and disclosed
• Their privacy rights
• The covered entity’s legal duties
• How to file complaints

When to Provide:

 

• First service delivery date
• Upon request
• When there are material changes to the NPP

Acknowledgment:

 

You must make a good faith effort to get written acknowledgment that the patient received the NPP (though you can still treat them if they refuse to sign).

—

 

**2. RIGHT TO ACCESS MEDICAL RECORDS**

 

Patients have the right to:

 

• Inspect their medical records
• Obtain copies of their medical records
• Request records in electronic format if maintained electronically

Timeline:

 

• You have 30 days to respond (can extend once for 30 more days with written notice)

Fees:

 

• You CAN charge reasonable, cost-based fees for:
• Labor for copying
• Supplies for creating the copy
• Postage if mailed
• You CANNOT charge for:
• Searching for or retrieving records
• Preparing an explanation or summary

When You Can Deny Access:

 

• Psychotherapy notes
• Information compiled for legal proceedings
• Certain lab results prohibited by law
• If access would endanger the patient or another person (rare)

**Important:** Most denials must be reviewable by another licensed healthcare professional not involved in the original denial.

—

 

**3. RIGHT TO REQUEST AMENDMENTS**

 

Patients can request corrections to their medical records if they believe information is incorrect or incomplete.

Your Response Options:

 

1. **Accept the amendment** – make the change and inform others who received the incorrect information
2. **Deny the amendment** – if you believe the record is accurate and complete

 

Reasons to Deny:

 

• The information is accurate and complete
• The information was not created by your organization
• The information is not part of the designated record set
• The information is not available for patient inspection

If Denied:

 

 

 

 

 

 

 

 

—

• Provide written denial with reason
• Patient can submit a statement of disagreement
• You can submit a rebuttal
• All must be included with the record going forward

 

 

**4. RIGHT TO AN ACCOUNTING OF DISCLOSURES**

 

Patients can request a list of disclosures of their PHI made in the past 6 years.

 

What Must Be Included:

 

• Date of disclosure
• Name and address of recipient
• Brief description of information disclosed
• Purpose of disclosure

What Is EXCLUDED from Accounting:

 

• Disclosures for treatment, payment, or operations
• Disclosures to the patient themselves
• Disclosures pursuant to patient authorization
• Disclosures for facility directory or to persons involved in care
• Disclosures for national security or law enforcement
• Incidental disclosures

Timeline:

 

 

 

 

 

 

 

—

• First accounting in 12-month period: FREE
• Additional accountings: reasonable, cost-based fee
• Must provide within 60 days (can extend 30 days with written notice)

 

 

**5. RIGHT TO REQUEST RESTRICTIONS**

 

Patients can request restrictions on:

 

• Uses and disclosures for treatment, payment, or operations

 

• Disclosures to family members or others involved in care

Important Details:

 

• You are NOT required to agree to most requested restrictions
• If you agree, you must comply (document the agreement!)
• Patient can revoke the restriction at any time

MANDATORY Restriction:

 

If a patient pays out-of-pocket in full and requests that you NOT disclose information to their health plan, you MUST comply (with limited exceptions).

**Example:** Patient pays cash for STD testing and doesn’t want insurance company notified – you must honor this request.

—

 

**6. RIGHT TO REQUEST CONFIDENTIAL COMMUNICATIONS**

 

Patients can request to receive communications by alternative means or at alternative locations.

 

Examples:

 

• “Send my bills to my work address, not home”
• “Call my cell phone, not my home phone”
• “Email me instead of calling”

Your Obligation:

 

• You must accommodate reasonable requests
• You cannot require an explanation for the request
• You must act on the request promptly

 

INCIDENTAL USES AND DISCLOSURES

 

What Are Incidental Disclosures?

 

Secondary uses or disclosures that cannot reasonably be prevented, are limited in nature, and occur as a result of an otherwise permitted use or disclosure.

Examples of PERMITTED Incidental Disclosures:

 

• A hospital visitor overhears a nearby patient’s name being called

 

• Another patient sees a name on a sign-in sheet
• Someone overhears a phone conversation despite reasonable precautions
• Information on a computer screen momentarily visible to someone walking by

**Key Point:** Incidental disclosures are only permitted if you’ve implemented REASONABLE SAFEGUARDS!

Reasonable Safeguards Include:

 

• Speaking quietly when discussing patient information
• Not using patient names in waiting rooms (use numbers or other systems)
• Positioning computer screens away from public view
• Using privacy screens on monitors
• Having conversations in private areas
• Training staff on privacy practices

Examples of VIOLATIONS (Not Incidental):

 

? Discussing patient details loudly in a hallway

? Leaving patient records on unattended desks

? Displaying a whiteboard with patient names and diagnoses in a public area

? Having detailed conversations in elevators with others present

 

SPECIAL SITUATIONS AND SCENARIOS

 

Situation 1: Facility Directories

 

Hospitals and other facilities can maintain patient directories with:

 

• Patient name
• Location in facility
• General condition (good, fair, critical)
• Religious affiliation

Rules:

 

• Must inform patient of directory and give opportunity to opt out
• Can share directory information with visitors who ask for patient by name
• Can share religious affiliation with clergy even if they don’t ask by name

 

• If patient is incapacitated, use professional judgment about what’s in their best interest

—

 

Situation 2: Family Members and Friends Involved in Care

 

You MAY disclose PHI to family, friends, or others involved in patient’s care or payment without authorization IF:

• Patient is present and doesn’t object
• Patient is not present but you determine disclosure is in patient’s best interest based on professional judgment

Examples:

 

• Telling a spouse about medication instructions
• Discussing discharge plans with an adult child
• Speaking with someone who drove the patient to the appointment

When to Stop:

 

 

 

 

 

 

 

—

? Patient explicitly objects or asks you not to share

? Patient is capable of making decisions but is not given opportunity to agree/object

? You have reason to believe sharing would endanger the patient

 

 

Situation 3: Minors

 

Generally, parents are the personal representatives of minors and can access their PHI.

 

EXCEPTIONS (When parents may NOT have access):

 

• State law grants minor the right to consent to care (e.g., STD treatment, substance abuse, mental health)
• Court grants authority to minor or someone else
• Parent agrees that minor and provider can have confidential relationship
• Disclosure would endanger the minor

**Example:** In many states, a 16-year-old can consent to STD testing without parental involvement. The results cannot be shared with parents without the teen’s permission.

—

 

Situation 4: Deceased Individuals

 

HIPAA protections continue for 50 years after death!

 

Who Can Access:

 

• Personal representative of the estate
• Family members and others involved in care or payment UNLESS the decedent expressly prohibited disclosure when alive

Permitted Disclosures:

 

 

 

 

 

 

 

—

• To coroners, medical examiners, funeral directors
• For organ donation purposes
• For research (with proper approvals)

 

 

Situation 5: Emergencies

 

In emergency situations where the patient is incapacitated:

 

• You may use professional judgment to determine what’s in the patient’s best interest
• You may share information with family if you believe it’s in patient’s best interest
• You may disclose to public health authorities or others as necessary

**Example:** Unconscious patient brought to ER – you can call the emergency contact in their wallet to inform family.

 

VIOLATIONS AND CONSEQUENCES

 

Common Privacy Rule Violations:

 

1. **Unauthorized Access (“Snooping”)**

 

• Accessing records without a work-related reason
• Looking up celebrities, neighbors, family members, coworkers
• Browsing patient records out of curiosity

2. **Improper Disposal**

 

• Throwing PHI in regular trash
• Not shredding documents with PHI
• Discarding CDs, hard drives, or devices without proper destruction

 

3. **Unauthorized Disclosures**

 

• Discussing patients in public areas
• Gossiping about patients
• Posting about patients on social media
• Sharing information with unauthorized individuals

4. **Failure to Provide Access**

 

• Denying patients access to their records without valid reason
• Delaying provision of records beyond 30 days
• Charging excessive fees

5. **Lack of Safeguards**

 

• Leaving records in public areas
• Not logging out of computer systems
• Sending unencrypted emails with PHI
• Not implementing minimum necessary standard

Red Flags That You’re About to Violate Privacy:

 

• “I’m just going to take a quick ..”
• “They’re my friend, so it’s okay to ..”
• “I won’t tell anyone what I ..”
• “Everyone talks about patients in the break ..”
• “It’s faster to email this than use the secure ..”

If You Witness a Violation:

 

• Report it immediately to your privacy officer or supervisor
• Document what you witnessed
• Do not participate or remain silent
• Remember: failure to report can make you complicit

 

BEST PRACTICES FOR PRIVACY COMPLIANCE

 

1.  Before Accessing PHI, Ask:

 

• Do I need this for my current work task?

 

• Is this the minimum information I need?
• Am I authorized to access this?

2.  Before Disclosing PHI, Ask:

 

• Is this disclosure permitted under HIPAA?
• Do I need authorization?
• Am I sharing the minimum necessary?
• Am I using appropriate safeguards?

3.  Daily Habits:

 

• Log out of computer systems when stepping away
• Position screens away from public view
• Shred all documents with PHI
• Have patient conversations in private areas
• Use confidential fax cover sheets
• Double-check email recipients before sending PHI
• Never photograph patient information with personal devices

4.  When in Doubt:

 

• Ask your privacy officer
• Consult your organization’s policies
• Err on the side of protecting privacy
• Remember: It’s easier to get authorization than to deal with a violation!

 

KEY TAKEAWAYS

 

• The Privacy Rule protects ALL individually identifiable health information (PHI)
• PHI can be used/disclosed without authorization for Treatment, Payment, and Healthcare Operations (TPO)
• The “minimum necessary” standard applies to most uses and disclosures
• Patients have six major rights: notice, access, amendment, accounting, restrictions, and confidential communications
• Patient authorization is required for marketing, sale of PHI, psychotherapy notes, and uses not covered by permitted categories
• Incidental disclosures are allowed only if reasonable safeguards are in place

 

• HIPAA protections apply to deceased individuals for 50 years after death
• Unauthorized access, even without disclosure, is a violation
• Privacy violations can result in termination, fines, and criminal prosecution