# Presentation: 007667

## HIPAA PRIVACY RULE

**HIPAA PRIVACY RULE**

**Department of Health and Human Services **
**Office of the General Counsel / Civil Rights Division**
**Louis Altarescu**
**August 19, 2004**

##  HIPAA

**Health Insurance Portability and Accountability Act of 1996; Subtitle F--Administrative Simplification**
**Encourage development of electronic health information transactions**
**Easier information sharing creates need for security and privacy protections**
**Privacy Rule – first comprehensive federal health privacy protections**
**“****Federal floor” – covered entities can provide greater protection; “more stringent” State privacy protections remain in force**

## Outline of Presentation

**Who and what is covered**
**Uses and disclosures of PHI**
**Individual rights**
**Personal representatives**
**Administrative requirements**
**Organizational issues**
**OCR enforcement**

## 	Scope:  Who is Covered? 

**Limited to “covered entities”:                               **
**Health care providers who transmit health information in electronic transactions for which the Secretary has adopted standards**
**Health plans**
**Health care clearinghouses**
**Sponsors of prescription drug discount cards**
**Business associate relationships**

## Business Associates 

**Agents, contractors, others hired to do work on behalf of covered entity that requires individually identifiable health information**
**Covered entity must obtain satisfactory assurance – usually through a contract --that a business associate will safeguard protected health information, limit use and disclosure**

## Scope:  What is Covered? 

**Protected health information (PHI) is:**
**-Individually identifiable health information**
**-Transmitted or maintained in any form or medium by covered entities or their business associates**
**Not PHI:**
**De-identified information **
**Employment records **
**FERPA records**

## Uses and Disclosures of PHI

**Covered entities may not use or disclose PHI except as permitted or required by Privacy Rule**
_**Required**_** disclosures are limited to:**
**Disclosures to the individual who is the subject of information (right to access and accounting).**
**Disclosures to OCR to determine compliance**
**All other uses and disclosures in the Rule are **_**permissive**_

## Permissive Uses and Disclosures

**To individual**
**Treatment, payment and health care operations (TPO)**
**Incidental uses and disclosures**
**Opportunity to agree or object**
**Public policy**
**With an “authorization” (psychotherapy notes)**
**Other – limited data set, fundraising, by workforce members as whistleblowers or to report crime**

## Minimum Necessary

**Covered entities must make reasonable efforts to limit the use or disclosure of PHI to minimum amount necessary to accomplish their purpose**
**“****Role-based” access limits**
** ****Exceptions include disclosures to or requests by a health care provider for PHI for treatment purposes**

## Verification

**Must, in most cases, verify identity and authority of person requesting PHI**
**   ****Special provisions for disclosures to    public officials**
**Obtain required document, statement or representation**
**   ****May reasonably rely if the document, statement or representation “on its face” meets requirements**

## Treatment, Payment, Health Care Operations (TPO)

**What is “treatment”?**
**What is “payment”?**
**What is “health care operations”?**
**Using /disclosing for TPO**
**No consent required for uses or disclosures for TPO activities of the entity that holds the PHI, and in some cases for the TPO activities of another entity**

##           Treatment and Payment                   	                                  

**Treatment:  Provision, coordination, or management of health care and related services by one or more providers**
**Payment: Activities undertaken by a health plan to obtain premiums, or determine or fulfill coverage or benefits obligations, or by a provider or plan to obtain or provide payment of claims (Includes, among other things, coordination of benefits and utilization review)**

##            Health Care Operations

**	****	**
**Quality assessment and improvement activities **
**Training, accreditation and licensing**
**Activities relating to the creation, renewal or replacement of a contract of health insurance**
**Conducting or arranging for medical review, legal services, and auditing functions, including fraud and abuse detection and compliance programs**
**Business planning and development**
**Business management and general administrative activities**

##      Incidental Uses and 	Disclosures 

**Uses/disclosures permitted if incidental to an otherwise permitted use or disclosure, provided minimum necessary and reasonable safeguard standards are met **
**Examples: talking to patient in semi-private room; talking to other providers if passers-by are present; waiting room sign in sheets; patient chart at bedside**

##       Uses and Disclosures: Must  	Provide 	Opportunity to Agree or 	Object

**May disclose facility directory information**
**Individual’s name location or general condition**
**PHI relevant to person’s involvement in care  or payment **
**Family, friends, others identified by individual**
**Notification Purposes.**
**E.g., to disaster relief agencies to help notify family and others.**
**Individual not present or incapacitated**
**     ****-  Professional judgment / best interest test**

## Public Policy Disclosures

**Covered entities may use or disclose PHI without authorization only if the use or disclosure comes within one of the listed exceptions & follows its conditions:**
**As required by law**
**For health care oversight**
**For public health **
**For research**

## Public Policy Disclosures  (2)

**For law enforcement  **
**For judicial & administrative proceedings**
**For  specialized government functions**
**To facilitate cadaveric organ transplants**
**About decedents to funeral directors**
**For workers’ compensation**
**To report abuse, domestic violence**
**To avert serious & imminent threat to health or safety**

## Authorizations

**Required for uses and disclosures not otherwise required or permitted by Rule**
**Generally, cannot condition treatment, payment, eligibility or enrollment on an authorization**
**Examples: Pre-employment physicals, life insurance, marketing, psychotherapy notes**

## Psychotherapy Notes:Defined

**Notes of a mental health provider documenting or analyzing the conversation during a counseling session**
**Maintained separately from the rest of the medical record**
**Excludes:  **
**Medication prescription and monitoring**
**Counseling session start and stop times **
**Modalities and frequencies of treatment**
**Results of clinical test**
**Summary of: diagnosis, functional status, treatment plan, symptoms, prognosis, progress to date**

## 	Psychotherapy Notes

_**Only**_** type of PHI with heightened protection**
**Generally, cannot use or disclose psych notes without individual authorization**
**Authorizations for psych notes may **_**not**_** be combined with authorizations for use or disclosure of other PHI**
**No right of access by individuals**
**No right of amendment by individuals**

**Notes:**
Rationale:  
Sensitive information 
Not typically needed for TPO 
Personal notes of the therapist, intended to help him or her recall the therapy discussion

## Psychotherapy Notes: Authorization

**Authorization required unless:**
**Use by originator (consent required)****	**
**Use/disclosure for supervised training programs (consent)**
**Use/disclosure to defend legal action (consent)**
**Use/disclosure for oversight of the originator**
**Use/disclosure for enforcement of Rule or as required by law**
**Disclosure to coroner or medical examiner**
**Disclosure to avert a serious and imminent threat to health safety**

## Individual’s Rights

**Individuals have the right to:**
**A written notice of information practices from health plans and providers **
**Inspect and obtain a copy of their PHI**
**Obtain an accounting of disclosures**
**Amend their records**
**Request restrictions on uses and disclosures**
**Accommodation of reasonable communication  requests**
**Complain to the covered entity and to HHS**

## Personal Representatives (PR)

**Covered entity must treat as PR person authorized to make health care decisions on behalf of individual who is an adult or emancipated minor **
**Applies to PHI relevant to authority**
**Need not treat person as PR if reasonable belief of domestic violence, abuse, neglect or endangerment / best interest test**

## General Rule: Parents have access to their child’s PHI

**Exceptions to general rule:**
**   ****-  Minor is the one who consents to care and the consent of the parent is not required under State or other applicable law**
**   ****-  Minor obtains care at the direction of a court or a person appointed by the court; and **
**   ****-  When, and to the extent that, the parent agrees that minor and health care provider may have a confidential relationship**
**BUT SEE NEXT SLIDE**

## Parents & Minors	

-  **State law generally governs disclosures to parents**
**Disclosure to parent permitted when permitted or required by state law**
**Disclosure to parent not allowed when state law prohibits**
**Provider acts within discretion under state law to give or deny parent access when state law is silent or unclear**
**Abuse/neglect/endangerment exception applies**

## Administrative Requirements

**Flexible &  scalable**
**Covered entities required to:**
**Designate a privacy official and contact person/office**
**Develop policies and procedures (including for receiving complaints)**
**Provide privacy training to its workforce**
**Implement administrative, technical, and physical safeguards to protect the privacy of PHI**

## Administrative Requirements (2)

**Develop and apply a system of sanctions for employees who violate the entity’s policies **
**Meet documentation requirements**
**Mitigate any harmful effect of a use or disclosure of protected health information that is known to the covered entity**
**Refrain from intimidating or retaliatory acts**
**Not require individuals to waive their rights to file a complaint with the Secretary or their other rights under the Privacy Rule**

## 	Organizational Issues

**Hybrid Entities (designate health care component(s))**
**Organized Health Care Arrangements (OHCAs) - multiple covered entities can share PHI; e.g., clinically integrated care settings**
**Affiliated Covered Entities - legally separate CEs that are under common ownership and control may choose to be treated as a single CE**

## Office for Civil Rights (OCR)

- -  **Administers, interprets and enforces Privacy Rule**
**Promotes voluntary compliance; provides technical assistance**
**May impose civil monetary penalties**
**-  May make “exception determinations” that a State law, contrary to Privacy Rule is not preempted by Privacy Rule**

## Complaints

**Any person or organization may file complaint with OCR by mail or electronically**
**Complaints should be filed within 180 days**
**OCR may investigate complaints**
**OCR may also conduct compliance reviews to determine whether covered entities are in compliance**
**No private cause of action under the Privacy Rule**

## Responsibilities of Covered Entities

**Keep records & submit compliance reports as necessary for OCR to determine compliance**
**Cooperate with OCR investigations & compliance reviews**
**Permit OCR access to its facilities, books, records pertinent to ascertaining compliance**
**Permit access at any time & without notice if exigent circumstances exist (e.g., documents may be hidden or destroyed)**
**If information is held by third party and is not provided, so certify & explain efforts to obtain information**

## Limitations on OCR Disclosure

- 	**Protected health information obtained by OCR in an investigation or review will not be disclosed by OCR, except if necessary for ascertaining or enforcing compliance or if otherwise required by law**

## Civil Monetary Penalties (CMPs)

**Civil monetary penalties can be imposed by OCR**
** ****$100 per violation**
**Capped at $25,000 for each calendar year for each requirement or prohibition that is violated**

## 	Criminal Penalties 

**Criminal penalties can be imposed by DOJ**
**Up to $50,000 & 1 year imprisonment for knowingly obtaining or disclosing IIHI **
**Up to $100,000 & 5 years if done under false pretenses **
**Up to  $250,000 & 10 years if intent to sell, transfer, or use for commercial advantage, personal gain or malicious harm**
**Enforced by DOJ**

## For More Information

**OCR Privacy Website:  **_[http://www.hhs.gov/ocr/hipaa](http://www.hhs.gov/ocr/hipaa)_
**Administrative Simplification Website:**
**	**_[http://aspe.hhs.gov/admnsimp/Index.htm](http://aspe.hhs.gov/admnsimp/Index.htm)_

## Print This Presentation

- For Live Meeting 5.0 Version
- Click on the File menu
- Select Print to PDF from the File menu
- For Live Meeting 4.3 Version
- Click on the blue Print to PDF button located in the lower left corner of the meeting window