Health Insurance Portability and Accountability Act of 1996 (HIPAA)

Confidentiality means discussing patient information with staff person or individual on a “need-to-know” basis. Here are some simple steps you can use to protect the privacy and security of patient health information:

• Post Notice of Privacy Practices in waiting area.
• Make sure every patient reads and signs Notice of Privacy Practices statement. Keep medical records in a restricted area and locked file cabinet.
• Make sure PHI is safely filed away at the end of each workday.
  Make sure computers are logged off or shut down according to company policy.
• Use a fax coversheet and confirm fax numbers when faxing patient health information.
• Put fax machine in secure location away from public viewing. Turn computer screen inward away from public viewing.
• Conduct staff training on HIPAA policies and procedures.
• Designate a staff member to handle compliance and/or HIPAA concerns for your office.
  Establish role-based access to computer systems that store sensitive and confidential information.
  Establish a policy and procedures for accessing, sharing and securing protected health information.
  Do not email protected health information over the internet unless encrypted and password protected.
  Establish a policy and procedure for computer and internet usage.
  Establish a policy and procedure for release of medical records.
  Establish a policy to ensure all visitors check at the front desk.
  Make sure computers are backed-up periodically.
  Encourage staff to shred documents that are not part of patient record that contains protected health information.
• Make sure computer anti-virus software is updated on a regular basis as required. Make sure passwords to computers that house PHI are changed every 90 days. Terminate employee access to facility and computers when an employee has left the company.

Protected Health Information is all individually identifiable health information (18 identifiers) in any form or media, electronic or non-electronic that is held or transmitted by a group health plan or provider, including oral communication. Individually identifiable health information is information, including demographic data that relates to the past, present, or future physical or mental condition of an individual, the provision of health care to an individual, and that identifies an individual (or could reasonably be used to identify an individual). Some specific identifiers include the following: 

• Names of individuals
• Dates – including birth date, admission date, and date of death
• Telephone numbers
• Fax numbers
• Social Security numbers
• Medical record number
• Health plan enrollee number
• Account numbers
• Certificate/license numbers
• Geographic units – all geographic subdivisions smaller than a state, including street address, city, county precinct, zip code

The privacy rules under HIPAA allow a health plan (or other covered entity) to disclose to a family member, relative, or close friend of an individual, the PHI that is directly relevant to that person’s involvement with the individual’s care or payment of care. A covered entity also may disclose PHI to persons who are not family members, relatives, or close friends of the individual, if the covered entity has obtained assurance that the person has been identified by the individual as being involved in his or her care or payment. In these instances the patient (member) must provide authorization for the individual to receive PHI. The Department of Health and Human Services provides these two examples of the circumstances under which a plan may disclose PHI: 

• A health plan may disclose relevant PHI to an enrollee’s daughter who has called to assist her hospitalized, elderly mother in resolving a claim or other payment issue.
• A health plan may disclose relevant PHI to a human resources representative who has called the plan with the enrollee also on the line, or who could turn the phone over to the enrollee who could then confirm for the plan that the representative calling is assisting the enrollee.

Covered entities are not required to obtain member’s approval to use or disclose protected health information for Treatment, Payment and Healthcare Operations (TPO). Treatment – provision, coordination, or management of health care & related services. Payment – reimbursement including billing and claim management. Healthcare Operations – business activities of the organization such as quality assessments & improvement activities, training programs, accreditation, licensing, credentialing, premium rating, legal services, business management and general administrative activities. Authorization is required for any use or disclosure other than TPO. Authorization is required for psychotherapy notes. 

Yes. Under the HIPAA privacy rules, a health plan must remind enrollees at least every 3 years of the availability of its Notice of Privacy Practices, as well as how to obtain a copy.

The HIPAA Privacy Rule creates national standards to protect individual’s medical records and other personal health information.

No. All states have laws that require providers to report cases of specific diseases to public health officials.

No. Nothing in the Privacy Rule changes the way in which an individual grants another person power of attorney.

Yes; however, when the provider believes that treating a person as an individual’s personal representative may endanger the individual, the provider may choose not to consider that person as the individual’s personal representative.

No. A power of attorney that does not specify decisions related to health care would not authorize the holder to exercise the individual’s rights under the HIPAA Privacy Rule.

Yes, the Privacy Rule generally allows a parent to have access to the medical records about his or her child, as his or her minor child’s personal representative when such access is not inconsistent with state law.

No. The Privacy Rule does not address consent to treatment. The rule addresses access to and disclosure of health information not parental consent.