**Introduction**

An ad-hoc subgroup of members from the American Health Information
Community's (AHIC) Consumer Empowerment (CE) and Confidentiality,
Privacy, and Security (CPS) Workgroups was convened to evaluate privacy
protections governing personal health records (PHRs) for the purpose of
initiating and framing the development of certification criteria for
PHRs related to privacy policies.

A "PHR Service Provider" may be an employer, health care provider,
health insurance plan, or an independent third-party vendor. Information
used to populate PHRs may come from existing electronic health records,
health insurance plan claim systems, or entered directly by the
consumer. Some PHR Service Providers, such as health care providers and
health insurance plans, are subject to the privacy provisions of the
Health Insurance Portability and Accountability Act of 1996 (HIPAA).

The subgroup believes that personal health information included in a
PHR, regardless of the type of PHR Service Provider or the source of the
information, should be governed by a minimum set of privacy protections.
Therefore, to ensure that an individual's information is appropriately
protected the subgroup proposes that each PHR Service Provider establish
a privacy policy based on the "Essential PHR Privacy Policy Components"
listed in the table below.

***Control of Personal Health Information***

In developing the Essential PHR Privacy Policy Components, the subgroup
decided that specificity would lead to clearer privacy policies.  As a
result, when greater specificity would allow an individual to clearly
understand the requirements in a privacy policy, but that requirement
created an obligation for the PHR Service Provider, that tradeoff was
made for the benefit of the individual.  One such tradeoff occurred
within the attribute "how data are used and/or disclosed." The subgroup
believes that consumers should be afforded sole control over the use of
and accesses to data in his or her PHR. However, in cases where a PHR is
provided in an integrated fashion, (i.e., as part of an electronic
health record (EHR)) the individual would not have the same right of
control over the health information maintained in that EHR.

***HIPAA Crosswalk***

For discussion purposes the table below contains a third column that,
where possible, crosswalks the privacy policy components below to their
HIPAA Privacy Rule counterparts. In general, sections 164.520 and
164.530 (notice of privacy practices and administrative requirements) of
the HIPAA Privacy Rule were used for this crosswalk because of their
relation to the document's scope. It is important to note however, that
a direct (one-to-one) comparison of the privacy policy components to the
HIPAA Privacy Rule was complicated by the mixture of privacy policy
requirements and notice requirements in the description of certain
components. Therefore, for each topic as relevant, both the overarching
privacy policy or need for written privacy policies and the more
exacting requirements for individual notice have been articulated. We
believe that this column will serve as a useful way to judge the PHR
Service Provider privacy policy component with that of current HIPAA
Privacy Rule standards and what privacy policy component may mean if
offered by a HIPAA covered entity.

Essential PHR Privacy Policy Components

+---------+-----------+-----------------------+-----------------------+
| **Cat   | **At      | **Privacy Policy      | **Crosswalk to HIPAA  |
| egory** | tribute** | Components**          | Privacy Rule          |
|         |           |                       | Requirements**        |
+=========+===========+=======================+=======================+
| Commun  | Privacy   | -   A specific        | -   **§**             |
| ication | contact   |     contact and       |                       |
| between | in        |     contact           |    164.520(b)(1)(vii) |
| PHR     | formation |     information shall |     requires that a   |
| Service | available |     be easily and     |     covered entity's  |
| P       |           |     promptly          |     (CE) NPP contain  |
| rovider |           |     accessible to     |     the name or       |
| and     |           |     users seeking     |     title, and        |
| user    |           |     information       |     telephone number  |
| about   |           |     concerning the    |     of a person or    |
| privacy |           |     privacy policy.   |     office to contact |
| policy  |           |                       |     for further       |
|         |           | -   The timeframes    |     information about |
|         |           |     for responding    |     matters covered   |
|         |           |     shall be made     |     by the NPP.       |
|         |           |     clear in the      |                       |
|         |           |     policy.           | -   **§**             |
|         |           |                       |     164.530 (a) (1)   |
|         |           | -   Responses to      |     requires a CE to  |
|         |           |     requests shall be |     designate a       |
|         |           |     made as soon as   |     privacy official  |
|         |           |     reasonably        |     who is            |
|         |           |     possible.         |     responsible for   |
|         |           |                       |     the development   |
|         |           |                       |     and               |
|         |           |                       |     implementation of |
|         |           |                       |     the policies and  |
|         |           |                       |     procedures of the |
|         |           |                       |     entity and a      |
|         |           |                       |     contact person or |
|         |           |                       |     office who is     |
|         |           |                       |     responsible for   |
|         |           |                       |     receiving         |
|         |           |                       |     complaints and    |
|         |           |                       |     able to provide   |
|         |           |                       |     further           |
|         |           |                       |     information about |
|         |           |                       |     matters covered   |
|         |           |                       |     by the NPP.       |
|         |           |                       |                       |
|         |           |                       | -   There is no       |
|         |           |                       |     requirement       |
|         |           |                       |     imposing a        |
|         |           |                       |     timeframe for     |
|         |           |                       |     response or an    |
|         |           |                       |     obligation on the |
|         |           |                       |     CE to respond.    |
+---------+-----------+-----------------------+-----------------------+
|         | Version   | -   The policy shall  | -   **§**             |
|         | ma        |     visibly display   |                       |
|         | nagement: |     its effective     |   164.520(b)(1)(viii) |
|         | effective |     date              |     requires that the |
|         | date and  |                       |     NPP contain the   |
|         | a         | -   Historical        |     date on which the |
|         | mendments |     policies and the  |     NPP is first in   |
|         |           |     effective dates   |     effect, which may |
|         |           |     of any amendments |     not be earlier    |
|         |           |     shall be made     |     than the date on  |
|         |           |     available to the  |     which the notice  |
|         |           |     consumer upon     |     is printed or     |
|         |           |     request.          |     otherwise         |
|         |           |                       |     published.        |
|         |           |                       |                       |
|         |           |                       | -   The               |
|         |           |                       |     administrative    |
|         |           |                       |     requirements for  |
|         |           |                       |     policies and      |
|         |           |                       |     procedures assume |
|         |           |                       |     but, unlike those |
|         |           |                       |     above for the     |
|         |           |                       |     NPP, do not       |
|         |           |                       |     expressly call    |
|         |           |                       |     for an effective  |
|         |           |                       |     date. In some     |
|         |           |                       |     cases the         |
|         |           |                       |     effective date of |
|         |           |                       |     the NPP serves as |
|         |           |                       |     the effective     |
|         |           |                       |     date for the      |
|         |           |                       |     policy.           |
|         |           |                       |                       |
|         |           |                       | -   **§** 164.520(e)  |
|         |           |                       |     requires a CE to  |
|         |           |                       |     document          |
|         |           |                       |     compliance with   |
|         |           |                       |     the NPP           |
|         |           |                       |     requirements by   |
|         |           |                       |     retaining copies  |
|         |           |                       |     of the NPPs       |
|         |           |                       |     issued for six    |
|         |           |                       |     years from date   |
|         |           |                       |     of creation or    |
|         |           |                       |     when last in use  |
|         |           |                       |     whichever is      |
|         |           |                       |     later.            |
|         |           |                       |                       |
|         |           |                       | -   **§** 164.520(c)  |
|         |           |                       |     requires a CE to  |
|         |           |                       |     make the NPP      |
|         |           |                       |     available upon    |
|         |           |                       |     request to any    |
|         |           |                       |     person and        |
|         |           |                       |     distribute the    |
|         |           |                       |     NPP to            |
|         |           |                       |     individuals as    |
|         |           |                       |     required by the   |
|         |           |                       |     Rule, but there   |
|         |           |                       |     is no express     |
|         |           |                       |     provision         |
|         |           |                       |     requiring the CE  |
|         |           |                       |     to provide access |
|         |           |                       |     to historical     |
|         |           |                       |     copies of the NPP |
|         |           |                       |     or to its         |
|         |           |                       |     policies and      |
|         |           |                       |     procedures.       |
+---------+-----------+-----------------------+-----------------------+
|         | Not       | -   The policy        | -   § 164.530(i)      |
|         | ification |     requires that     |     requires a CE to  |
|         | of policy |     users shall be    |     change its        |
|         | change    |     notified,         |     policies and      |
|         |           |     pursuant to the   |     procedures as     |
|         |           |     sentence below,   |     necessary to      |
|         |           |     when the privacy  |     comply with       |
|         |           |     policy is changed |     changes in law,   |
|         |           |     or amended with a |     and any delay in  |
|         |           |     clear indication  |     revisions to the  |
|         |           |     of the            |     policies and/or   |
|         |           |     differences       |     the NPP is no     |
|         |           |     between the new   |     excuse not comply |
|         |           |     policy and the    |     with the law.     |
|         |           |     previously        |                       |
|         |           |     effective policy. | -   § 164.520(b)(3)   |
|         |           |                       |     requires a CE to  |
|         |           | -   The policy shall  |     promptly revise   |
|         |           |     include a         |     and distribute    |
|         |           |     reasonable        |     its NPP whenever  |
|         |           |     timeframe (e.g.,  |     there is a        |
|         |           |     30 days) within   |     material change   |
|         |           |     which a consumer  |     to the privacy    |
|         |           |     must be notified  |     practices stated  |
|         |           |     of changes or     |     in the NPP.       |
|         |           |     amendments before |                       |
|         |           |     the changes or    | -   **§**             |
|         |           |     amendments become |     164.520(b)(1)(v)  |
|         |           |     effective.        |     requires the CE   |
|         |           |                       |     to expressly      |
|         |           |                       |     reserve in the    |
|         |           |                       |     NPP the right to  |
|         |           |                       |     make changes in   |
|         |           |                       |     its policies and  |
|         |           |                       |     procedures        |
|         |           |                       |     effective for PHI |
|         |           |                       |     collected or      |
|         |           |                       |     created prior to  |
|         |           |                       |     the effective     |
|         |           |                       |     date of the       |
|         |           |                       |     revised NPP.      |
|         |           |                       |     Otherwise, the    |
|         |           |                       |     revised policy    |
|         |           |                       |     can only be       |
|         |           |                       |     applied to PHI    |
|         |           |                       |     collected or      |
|         |           |                       |     created on or     |
|         |           |                       |     after the         |
|         |           |                       |     effective date.   |
|         |           |                       |                       |
|         |           |                       | -   **§**             |
|         |           |                       |     164.530(i)(5)     |
|         |           |                       |     allows changes to |
|         |           |                       |     policies and      |
|         |           |                       |     procedures that   |
|         |           |                       |     do not materially |
|         |           |                       |     alter the NPP to  |
|         |           |                       |     be made at any    |
|         |           |                       |     time and          |
|         |           |                       |     implemented after |
|         |           |                       |     the date on which |
|         |           |                       |     the change has    |
|         |           |                       |     been documented.  |
|         |           |                       |                       |
|         |           |                       | -   **§**             |
|         |           |                       |     164.520(c)(1)     |
|         |           |                       |     requires that     |
|         |           |                       |     health plans      |
|         |           |                       |     provide notice at |
|         |           |                       |     time of           |
|         |           |                       |     enrollment,       |
|         |           |                       |     within 60 days of |
|         |           |                       |     a material        |
|         |           |                       |     revision to the   |
|         |           |                       |     NPP, and once     |
|         |           |                       |     every three       |
|         |           |                       |     years; (2)        |
|         |           |                       |     providers to      |
|         |           |                       |     provide notice at |
|         |           |                       |     first service     |
|         |           |                       |     delivery, and if  |
|         |           |                       |     a facility is     |
|         |           |                       |     maintained, have  |
|         |           |                       |     it available for  |
|         |           |                       |     hand out and      |
|         |           |                       |     posted at the     |
|         |           |                       |     site, and to      |
|         |           |                       |     provide and/or    |
|         |           |                       |     post revised      |
|         |           |                       |     notices promptly  |
|         |           |                       |     on or after       |
|         |           |                       |     effective date.   |
|         |           |                       |                       |
|         |           |                       | -   **§**             |
|         |           |                       |     164.520(c)(3)     |
|         |           |                       |     requires a CE     |
|         |           |                       |     that maintains a  |
|         |           |                       |     website providing |
|         |           |                       |     information about |
|         |           |                       |     the CE's services |
|         |           |                       |     or benefits to    |
|         |           |                       |     post its NPP on   |
|         |           |                       |     the website.      |
|         |           |                       |     Provision of      |
|         |           |                       |     notice            |
|         |           |                       |     requirements may  |
|         |           |                       |     be met via email  |
|         |           |                       |     if individual     |
|         |           |                       |     agrees to         |
|         |           |                       |     electronic        |
|         |           |                       |     notice.           |
|         |           |                       |                       |
|         |           |                       | -   No prior notice   |
|         |           |                       |     to the individual |
|         |           |                       |     or identification |
|         |           |                       |     of changes is     |
|         |           |                       |     required by the   |
|         |           |                       |     Rule.             |
+---------+-----------+-----------------------+-----------------------+
|         | User      | -   Users shall be    | -   No comparable     |
|         | option(s) |     provided with the |     provision.        |
|         | after a   |     opportunity to    |     Individuals often |
|         | change in |     either:           |     have the choice   |
|         | Policy    |                       |     of health plans   |
|         |           |     -   affirmatively |     and providers,    |
|         |           |         accept the    |     and are free to   |
|         |           |         policy change |     take their        |
|         |           |         (and such     |     business          |
|         |           |         opportunity   |     elsewhere for     |
|         |           |         must be       |     whatever reason.  |
|         |           |         provided      |     However, the      |
|         |           |         before any    |     nature of the     |
|         |           |         new use or    |     relationship and  |
|         |           |         disclosure of |     legal or economic |
|         |           |         that          |     restrictions      |
|         |           |         individual's  |     beyond the scope  |
|         |           |         health data), |     of the Privacy    |
|         |           |                       |     Rule makes this   |
|         |           |     -   or be allowed |     policy difficult  |
|         |           |         to terminate  |     if not impossible |
|         |           |         their         |     in contexts other |
|         |           |         contract or   |     than a PHR.       |
|         |           |         user          |                       |
|         |           |         agreement     |                       |
|         |           |         with the PHR  |                       |
|         |           |         Service       |                       |
|         |           |         Provider,     |                       |
|         |           |         without       |                       |
|         |           |         penalty, if   |                       |
|         |           |         they have     |                       |
|         |           |         concerns      |                       |
|         |           |         about the     |                       |
|         |           |         change in     |                       |
|         |           |         privacy       |                       |
|         |           |         policy.       |                       |
+---------+-----------+-----------------------+-----------------------+
| Access  | Acce      | -   The policy shall  | -   **§**             |
| ibility | ssibility |     be posted on the  |     164.520(c)(3)     |
| and     | and       |     website and shall |     requires a CE     |
| read    | re        |     be easily         |     that maintains a  |
| ability | adability |     accessible.       |     website providing |
| of      | of policy |                       |     information about |
| policy  |           |     -   The policy    |     the CE's services |
|         |           |         can be        |     or benefits to    |
|         |           |         provided to a |     post its NPP on   |
|         |           |         consumer in   |     the website.      |
|         |           |         electronic or |     Provision of      |
|         |           |         written       |     notice            |
|         |           |         format.       |     requirements may  |
|         |           |                       |     be met via email  |
|         |           | -   The policy shall  |     if individual     |
|         |           |     be written in     |     agrees to         |
|         |           |     plain language    |     electronic        |
|         |           |     and shall be      |     notice. An        |
|         |           |     available to      |     individual        |
|         |           |     consumers in the  |     receiving         |
|         |           |     language(s) that  |     electronic notice |
|         |           |     the PHR is        |     retains the       |
|         |           |     designed to       |     rights to a paper |
|         |           |     support.[^1]      |     copy upon         |
|         |           |                       |     request.          |
|         |           |                       |                       |
|         |           |                       | -   **§**             |
|         |           |                       |     164.520(b)(1)     |
|         |           |                       |     requires the NPP  |
|         |           |                       |     to be written in  |
|         |           |                       |     plain language.   |
|         |           |                       |     The availability  |
|         |           |                       |     of the NPP in     |
|         |           |                       |     other languages   |
|         |           |                       |     is not a          |
|         |           |                       |     requirement of    |
|         |           |                       |     the Privacy Rule  |
|         |           |                       |     but may be        |
|         |           |                       |     required by other |
|         |           |                       |     law, such as LEP. |
|         |           |                       |                       |
|         |           |                       | -   These             |
|         |           |                       |     requirements do   |
|         |           |                       |     not directly      |
|         |           |                       |     apply to all      |
|         |           |                       |     policies and      |
|         |           |                       |     procedures, but   |
|         |           |                       |     just to the NPP.  |
+---------+-----------+-----------------------+-----------------------+
| Ter     | Treatment | -   The policy shall  | -   The Privacy Rule  |
| minated | of        |     address how the   |     does not impose   |
| ac      | personal  |     PHR Service       |     special rules for |
| counts, | health    |     Provider handles  |     the use or        |
| change  | in        |     personal health   |     disclosure of PHI |
| in      | formation |     information upon  |     based on the      |
| company | contained |     termination of    |     individual's      |
| status, | within    |     the user's        |     contractual       |
| or      | t         |     contract or user  |     relationship with |
| d       | erminated |     agreement with    |     the entity. All   |
| isconti | accounts  |     the PHR Service   |     PHI is protected  |
| nuation |           |     Provider.         |     in the same       |
| of      |           |                       |     manner for so     |
| service |           | -   Upon termination  |     long as the       |
|         |           |     of the user's     |     entity maintains  |
|         |           |     contract or user  |     the records. The  |
|         |           |     agreement with a  |     Rule does not     |
|         |           |     PHR Service       |     impose record     |
|         |           |     Provider, the PHR |     retention         |
|         |           |     Service Provider  |     requirements.     |
|         |           |     shall cease any   |     These             |
|         |           |     further use or    |     requirements      |
|         |           |     disclosure of the |     would be onerous  |
|         |           |     consumer data     |     and impracticable |
|         |           |     (identifiable or  |     if applied in     |
|         |           |     as part of        |     other than a PHR  |
|         |           |     aggregate data).  |     setting.          |
|         |           |                       |                       |
|         |           | -   The policy shall  | -   The Privacy Rule  |
|         |           |     address how long  |     does not limit or |
|         |           |     the PHR Service   |     control uses or   |
|         |           |     Provider          |     disclosures once  |
|         |           |     maintains         |     PHI has been      |
|         |           |     personal health   |     de-identified.    |
|         |           |     information after |                       |
|         |           |     the user's        |                       |
|         |           |     account has been  |                       |
|         |           |     terminated,       |                       |
|         |           |     providing a       |                       |
|         |           |     reasonable amount |                       |
|         |           |     of time to ensure |                       |
|         |           |     that the user has |                       |
|         |           |     the opportunity   |                       |
|         |           |     to download or    |                       |
|         |           |     move their data   |                       |
|         |           |     to another        |                       |
|         |           |     service.          |                       |
+---------+-----------+-----------------------+-----------------------+
|         | Treatment | -   The policy shall  | -   §                 |
|         | of        |     address how       |     164.502(a)(1)(ii) |
|         | personal  |     personal          |     allows a covered  |
|         | health    |     information is    |     entity to         |
|         | in        |     treated if the    |     disclose use and  |
|         | formation |     PHR Service       |     disclose PHI for  |
|         | upon      |     Provider          |     "health care      |
|         | dis       |     discontinues      |     operations"       |
|         | continued |     operations of its |     purposes, one of  |
|         | o         |     service,          |     which is the      |
|         | perations |     transfers         |     sale, transfer,   |
|         | or change |     ownership of the  |     merger, or        |
|         | in        |     service, is       |     consolidation of  |
|         | company   |     acquired, or goes |     all or part of    |
|         | status    |     out of business.  |     the CE with       |
|         |           |                       |     another CE (or    |
|         |           |                       |     another entity    |
|         |           |                       |     that would become |
|         |           |                       |     a CE upon         |
|         |           |                       |     completion of the |
|         |           |                       |     transaction) and  |
|         |           |                       |     due diligence in  |
|         |           |                       |     connection with   |
|         |           |                       |     such transaction. |
|         |           |                       |     See also          |
|         |           |                       |     definition of     |
|         |           |                       |     "health care      |
|         |           |                       |     operations" at    |
|         |           |                       |     §164.501.         |
|         |           |                       |                       |
|         |           |                       | -                     |
|         |           |                       | §164.520(b)(1)(ii)(A) |
|         |           |                       |     requires that     |
|         |           |                       |     uses and          |
|         |           |                       |     disclosures for   |
|         |           |                       |     treatment payment |
|         |           |                       |     and health care   |
|         |           |                       |     operations be     |
|         |           |                       |     described in the  |
|         |           |                       |     NPP and that at   |
|         |           |                       |     least one example |
|         |           |                       |     of each be        |
|         |           |                       |     included.         |
|         |           |                       |                       |
|         |           |                       | -   §164.530(c)       |
|         |           |                       |     requires that a   |
|         |           |                       |     CE appropriately  |
|         |           |                       |     safeguard PHI,    |
|         |           |                       |     which includes    |
|         |           |                       |     when disposing of |
|         |           |                       |     PHI.              |
+---------+-----------+-----------------------+-----------------------+
| User    | Tracking  | -   The policy shall  | -   Does not appear   |
| data    | of user   |     address the use   |     to be a direct    |
| col     | behavior  |     and purposes of   |     Privacy Rule      |
| lection | and       |     data points       |     counterpart (one  |
|         | a         |     collected by the  |     may analyze as    |
|         | ttributes |     PHR Service       |     similar to an ID, |
|         |           |     Provider about    |     but there is no   |
|         |           |     the consumer      |     counterpart on    |
|         |           |     (e.g. cookies -   |     "cookies" that    |
|         |           |     small pieces of   |     may track         |
|         |           |     code placed on    |     unrelated         |
|         |           |     the user's        |     computer uses by  |
|         |           |     computer).        |     an individual);   |
|         |           |                       |     however, any      |
|         |           |                       |     demographic       |
|         |           |                       |     information       |
|         |           |                       |     collected on the  |
|         |           |                       |     individual is PHI |
|         |           |                       |     and               |
|         |           |                       |     uses/disclosures  |
|         |           |                       |     are thus          |
|         |           |                       |     controlled by the |
|         |           |                       |     Rule.             |
+---------+-----------+-----------------------+-----------------------+
| The use | How data  | -   The policy shall  | -                     |
| and     | are used  |     state that the    |    §164.520(b)(1)(ii) |
| dis     | and/or    |     personal          |     requires the NPP  |
| closure | disclosed |     information       |     to describe the   |
| of user |           |     contained within  |     uses and          |
| data    |           |     the PHR,          |     disclosures of    |
|         |           |     regardless of its |     PHI the CE is     |
|         |           |     source, is under  |     permitted and     |
|         |           |     the sole control  |     required to make  |
|         |           |     of the consumer.  |     by the Privacy    |
|         |           |     The policy shall  |     Rule without the  |
|         |           |     state that all    |     individual's      |
|         |           |     other uses or any |     authorization;    |
|         |           |     disclosures of    |     any legal         |
|         |           |     consumer data     |     limitation on     |
|         |           |     from the PHR,     |     such permitted    |
|         |           |     whether the       |     uses/disclosures; |
|         |           |     consumer is       |     and the fact that |
|         |           |     identifiable or   |     all other uses or |
|         |           |     not, shall        |     disclosures will  |
|         |           |     require consumer  |     be made with the  |
|         |           |     authorization.    |     individual's      |
|         |           |                       |     authorization.    |
|         |           | -   The PHR Service   |     The description   |
|         |           |     Provider shall    |     must be detailed  |
|         |           |     notify users if   |     enough to give    |
|         |           |     and how they use  |     fair notice.      |
|         |           |     and/or disclose   |                       |
|         |           |     consumer data.    | -   NPP               |
|         |           |                       |     §164.520(b)(2)(i) |
|         |           |                       |     permits the CE to |
|         |           |                       |     add any           |
|         |           |                       |     self-limitations  |
|         |           |                       |     to permitted      |
|         |           |                       |     uses/disclosures  |
|         |           |                       |     that it decides   |
|         |           |                       |     to adopt. Thus, a |
|         |           |                       |     CE may elect a    |
|         |           |                       |     PHR               |
|         |           |                       |     use/disclosure    |
|         |           |                       |     policy that       |
|         |           |                       |     grants total      |
|         |           |                       |     control to the    |
|         |           |                       |     individual and    |
|         |           |                       |     may state that in |
|         |           |                       |     the NPP. This     |
|         |           |                       |     would not be a    |
|         |           |                       |     policy it would   |
|         |           |                       |     likely adopt with |
|         |           |                       |     respect to the    |
|         |           |                       |     EHR, resulting in |
|         |           |                       |     either separate   |
|         |           |                       |     notices or a more |
|         |           |                       |     complex notice to |
|         |           |                       |     cover the points  |
|         |           |                       |     unique to the     |
|         |           |                       |     PHR.              |
|         |           |                       |                       |
|         |           |                       | -                     |
|         |           |                       |  §164.520(b)(1)(v)(C) |
|         |           |                       |     also requires a   |
|         |           |                       |     CE to state in    |
|         |           |                       |     the NPP that it   |
|         |           |                       |     must abide by the |
|         |           |                       |     terms of the      |
|         |           |                       |     notice currently  |
|         |           |                       |     in effect.        |
|         |           |                       |                       |
|         |           |                       | -   §164.502 provides |
|         |           |                       |     the roadmap of    |
|         |           |                       |     permitted and     |
|         |           |                       |     required uses and |
|         |           |                       |     disclosures in    |
|         |           |                       |     the Rule, with    |
|         |           |                       |     pointers to more  |
|         |           |                       |     specific          |
|         |           |                       |     regulatory        |
|         |           |                       |     standards, such   |
|         |           |                       |     as §164.506;      |
|         |           |                       |     §164.510, and     |
|         |           |                       |     §164.512. The     |
|         |           |                       |     authorization     |
|         |           |                       |     requirements are  |
|         |           |                       |     contained in      |
|         |           |                       |     §164.508.         |
|         |           |                       |                       |
|         |           |                       | -   The policy        |
|         |           |                       |     applies equally   |
|         |           |                       |     to identifiable   |
|         |           |                       |     and , presumably, |
|         |           |                       |     de-identified     |
|         |           |                       |     information. As   |
|         |           |                       |     noted above, once |
|         |           |                       |     PHI has been      |
|         |           |                       |     de-identified,    |
|         |           |                       |     the Rule no       |
|         |           |                       |     longer controls   |
|         |           |                       |     the uses or       |
|         |           |                       |     disclosures of    |
|         |           |                       |     such information. |
|         |           |                       |     The standards for |
|         |           |                       |     de-identification |
|         |           |                       |     are at            |
|         |           |                       |     §164.514(a)-(c).  |
+---------+-----------+-----------------------+-----------------------+
|         | Ava       | -   The policy shall  | -   § 164.528 gives   |
|         | ilability |     state that the    |     the individual    |
|         | of audit  |     user shall have   |     the right to have |
|         | trails    |     access to         |     an accounting of  |
|         |           |     information on    |     certain           |
|         |           |     when and by whom  |     disclosures upon  |
|         |           |     their data was    |     request. The CE   |
|         |           |     accessed.         |     has 60 days to    |
|         |           |                       |     provide the       |
|         |           |                       |     accounting and it |
|         |           |                       |     must contain the  |
|         |           |                       |     date, description |
|         |           |                       |     of the PHI        |
|         |           |                       |     disclosed, to     |
|         |           |                       |     whom it was       |
|         |           |                       |     disclosed and the |
|         |           |                       |     purpose for       |
|         |           |                       |     disclosures made  |
|         |           |                       |     up to 6 years     |
|         |           |                       |     prior to the      |
|         |           |                       |     request. A CE     |
|         |           |                       |     does not need to  |
|         |           |                       |     account for       |
|         |           |                       |     "uses" or for TPO |
|         |           |                       |     disclosures,      |
|         |           |                       |     disclosures       |
|         |           |                       |     authorized by the |
|         |           |                       |     individual,       |
|         |           |                       |     limited data      |
|         |           |                       |     sets, and certain |
|         |           |                       |     other             |
|         |           |                       |     disclosures. The  |
|         |           |                       |     accounting may be |
|         |           |                       |     suspended or      |
|         |           |                       |     delayed with      |
|         |           |                       |     respect to        |
|         |           |                       |     certain law       |
|         |           |                       |     enforcement and   |
|         |           |                       |     health oversight  |
|         |           |                       |     disclosures. Note |
|         |           |                       |     that this policy  |
|         |           |                       |     thus provides     |
|         |           |                       |     individual access |
|         |           |                       |     to information    |
|         |           |                       |     over and above    |
|         |           |                       |     the accounting    |
|         |           |                       |     for disclosure    |
|         |           |                       |     rights in HIPAA   |
|         |           |                       |     by incorporating  |
|         |           |                       |     uses and          |
|         |           |                       |     providing for no  |
|         |           |                       |     disclosure        |
|         |           |                       |     exceptions,       |
|         |           |                       |     including those   |
|         |           |                       |     "authorized" by   |
|         |           |                       |     the individual.   |
|         |           |                       |                       |
|         |           |                       | -   §164.530 requires |
|         |           |                       |     adequate          |
|         |           |                       |     safeguards to     |
|         |           |                       |     prevent           |
|         |           |                       |     impermissible     |
|         |           |                       |     uses or           |
|         |           |                       |     disclosures but   |
|         |           |                       |     does not          |
|         |           |                       |     specifically      |
|         |           |                       |     require audit     |
|         |           |                       |     trails. However,  |
|         |           |                       |     note that the     |
|         |           |                       |     Security Rule at  |
|         |           |                       |                       |
|         |           |                       | §164.308(a)(1)(ii)(D) |
|         |           |                       |     requires          |
|         |           |                       |     monitoring of     |
|         |           |                       |     system access     |
|         |           |                       |     through audit     |
|         |           |                       |     logs, access      |
|         |           |                       |     reports, and      |
|         |           |                       |     security incident |
|         |           |                       |     tracking reports. |
|         |           |                       |     Neither Rule      |
|         |           |                       |     gives the         |
|         |           |                       |     individual access |
|         |           |                       |     rights to audit   |
|         |           |                       |     trails run by the |
|         |           |                       |     entity.           |
|         |           |                       |                       |
|         |           |                       | -   §164.520(b)       |
|         |           |                       |     requires that the |
|         |           |                       |     NPP include       |
|         |           |                       |     notification of   |
|         |           |                       |     individual        |
|         |           |                       |     rights, including |
|         |           |                       |     the right to an   |
|         |           |                       |     accounting for    |
|         |           |                       |     disclosures.      |
+---------+-----------+-----------------------+-----------------------+
| Def     | Key terms | -   The policy shall  | -   §160.103 defines  |
| inition |           |     define key terms  |     the following:    |
| of      |           |     used in the       |                       |
| term    |           |     policy such as:   | ```{=html}            |
| inology |           |                       | <!-- -->              |
|         |           |     -   "personal     | ```                   |
|         |           |         health        | -   Business          |
|         |           |         information"  |     Associate (but    |
|         |           |                       |     not affiliate)    |
|         |           |                       |                       |
|         |           |    -   "de-identified | -   Disclosure        |
|         |           |         personal      |                       |
|         |           |         health        | -   Protected (not    |
|         |           |         information"  |     personal) health  |
|         |           |                       |     information       |
|         |           |     -   "use" of      |                       |
|         |           |         health data   | -   Use               |
|         |           |                       |                       |
|         |           |     -   "disclosure"  | Note that the Privacy |
|         |           |         of health     | Rule does not require |
|         |           |         data          | the NPP to include    |
|         |           |                       | definitions of terms, |
|         |           |     -   "affiliate"   | but the plain         |
|         |           |         and "business | language requirement  |
|         |           |         associate"    | might result in some  |
|         |           |                       | use of definitions or |
|         |           |                       | simplified, common    |
|         |           |                       | usage terms.          |
|         |           |                       |                       |
|         |           |                       | -   §164.514(a)-(c)   |
|         |           |                       |     provides the      |
|         |           |                       |     standard and      |
|         |           |                       |     requirements (not |
|         |           |                       |     a definition) for |
|         |           |                       |     de-identification |
|         |           |                       |     of PHI.           |
+---------+-----------+-----------------------+-----------------------+
| Ad      | En        | -   The policy shall  | -   §164.520 requires |
| herence | forcement |     contain a         |     that the NPP      |
| to      | policies  |     representation    |     contain           |
| pu      |           |     and warranty by   |     information about |
| blished |           |     the PHR Service   |     how a CE will     |
| gui     |           |     Provider that it  |     comply with the   |
| delines |           |     complies with all |     HIPAA Privacy     |
| or      |           |     applicable        |     Rule              |
| codes   |           |     federal and state |     requirements,     |
|         |           |     laws.             |     including uses    |
|         |           |                       |     and disclosures,  |
|         |           |     -   If the PHR is |     individual        |
|         |           |         offered by a  |     rights, entity    |
|         |           |         covered       |     obligations,      |
|         |           |         entity, HIPAA |     where and how to  |
|         |           |         shall be      |     complain and/or   |
|         |           |         specifically  |     contact the       |
|         |           |         addressed.    |     entity.           |
|         |           |                       |                       |
|         |           | -   Some method of    | -   §164.530(d), (e), |
|         |           |     recourse shall be |     and (f),          |
|         |           |     available for     |     respectively,     |
|         |           |     users who feel    |     require that CEs  |
|         |           |     their privacy has |     have their own    |
|         |           |     been violated or  |     complaint system, |
|         |           |     the PHR Service   |     and to have       |
|         |           |     Provider's        |     sanction and      |
|         |           |     privacy policies  |     mitigation        |
|         |           |     have been         |     policies for      |
|         |           |     violated and that |     cases of          |
|         |           |     method shall be   |     violations.       |
|         |           |     clearly           |                       |
|         |           |     communicated in   | -   OCR handles       |
|         |           |     the policy.       |     privacy           |
|         |           |                       |     complaints and    |
|         |           |                       |     OESS handles      |
|         |           |                       |     security          |
|         |           |                       |     complaints. Civil |
|         |           |                       |     money penalties   |
|         |           |                       |     are available and |
|         |           |                       |     criminal          |
|         |           |                       |     violations are    |
|         |           |                       |     handled by DOJ.   |
+---------+-----------+-----------------------+-----------------------+

[^1]: According to the
    [www.plainlanguage.gov](http://www.plainlanguage.gov/) website,
    plain language is described as language a reader can understand the
    first time. The way to get to that point often consists of extensive
    testing with members of the anticipated user group.