# Presentation: 063658

## December 2001

**December 2001**

- Susan McAndrew
- Sr. Health Information Privacy Policy Specialist
- U.S. Department of Health and Human Services

**Privacy in Health Care**

- Standards for Privacy of Individually
-  Identifiable Health Information

## Privacy Rule Modifications

- The Final Privacy Rule had an additional Notice of Public Rule Making published on March 27, 2002.  As a result of public comments to this NPRM, the information in this overhead presentation is subject to change.  You can link to the NPRM at
- _[http://www.hhs.gov/ocr/hipaa/whatsnew.html](http://www.hhs.gov/ocr/hipaa/whatsnew.html)_

## Legislative History

- Health Insurance Portability and Accountability Act of 1996 (HIPAA)
- Subtitle F--Administrative Simplification
- Encourage development of (electronic) health information technologies (transactions)
- Easier information sharing—security and privacy

## HIPAA and Privacy

- Called on the Secretary of HHS for recommendations on:
- Rights of individuals
- Procedures for exercising those rights
- Uses & disclosures of individually identifiable health information (IIHI) that should be authorized or required

**Section 264 of HIPAA:**

## HIPAA and Privacy (cont.)

- Required the Secretary to promulgate a regulation protecting the privacy of IIHI if Congress did not enact legislation by August 1999
- Provided that privacy requirements not preempt contrary state laws that are more stringent
- Required consultation with National Committee on Vital and Health Statistics & Attorney General

**Section 264 of HIPAA:**

## HIPAA and Privacy (cont.)

- Congress did not act by deadline
- The Secretary proposed a health information privacy rule on November 3, 1999

## Privacy Rule Process

- NPRM published 11/3/99
- >52,000 comments
- Final Rule: Published 12/28/00
- 2nd Comment period 2/28/01
- >11,000 comments
- Effective Date: 4/14/01
- Compliance by 4/14/03
- (4/14/04 for small health plans)

## Scope:  Who is Covered? 

- Limited by HIPAA to:
- Health care providers who transmit health information in electronic transactions
- Health plans
- Health care clearinghouses
- Business associate relationships

## Scope:  What is Covered? 

- Protected health information (PHI) is:
- Individually identifiable health information
- Transmitted or maintained in any form or medium
- Held by covered entities or their business associates
- De-identified information is not covered

## Individual’s Rights

- Individuals have the right to:
- A written notice of information practices from health plans and providers
- Inspect and copy their PHI
- Obtain a record of disclosures
- Amend their medical record
- Have reasonable requests for confidential communications accommodated
- Request restrictions on uses and disclosures
- Complain about violations to the covered entity and to HHS

## Key Points

- Covered entities can provide greater protections
- _Required_ disclosures are limited to:
- Disclosures to the individual who is the subject of information
- Disclosures to OCR to determine compliance
- All other uses and disclosures in the Rule are _permissive_

## Uses and Disclosures

- Must limit to what is permitted in the Rule
- Treatment, payment, and health care operations
- Requiring an opportunity to agree or object
- For specific public purposes
- All others as authorized by individual
- Requirements vary based on type

## Consents for TPO

- Direct health care providers must obtain consent from an individual before using or disclosing PHI for treatment, payment, or health care operations (TPO)
- Other covered entities may, but are not required to, obtain consents from individuals for these purposes
- Generally, the covered entity may condition treatment or enrollment on the provision of an individual’s consent
- Exceptions for emergency treatment and certain other circumstances

## Authorizations (not TPO)

- Covered entities must obtain an individual’s authorization before using or disclosing PHI for purposes other than TPO & certain specified purposes
- As a general rule, covered entities may not condition treatment, payment, or enrollment on the provision of an authorization
- Most uses or disclosures of psychotherapy notes require authorization

## Permissive Uses/Disclosures

- Covered entities may use or disclose PHI without a consent or authorization, subject to conditions, for certain purposes, such as:
- For uses and disclosures required by law
- For uses and disclosures involving the individual’s care or directory assistance
- For health care oversight
- For research
- For law enforcement or judicial proceedings
- For public health
- For other specialized government functions
- To facilitate organ transplants

## Minimum Necessary

- Covered entities must make reasonable efforts to limit the use or disclosure of PHI to minimum amount necessary to accomplish their purpose
- The rule applies minimum necessary requirements to uses, disclosures, and requests
- Does not apply to disclosures to providers for treatment
- Does not apply to uses or disclosures required by law

## Business Associates 

- Agents, contractors, others hired to do work of or for covered entity that involves PHI
- Satisfactory assurance – usually a contract --that a business associate will safeguard PHI
- No business associate relationship is required for disclosures to a health care provider for treatment

## Administrative Requirements

- Flexible &  scalable
- Covered entities required by §164.530 to:
- (a) Designate a privacy official
- (b) Provide privacy training to its workforce
- (c) Implement administrative, technical, & physical          safeguards & reasonably safeguard PHI
- (d) Establish process for receiving complaints
- (e) Develop a system of sanctions for employees who violate the entity’s policies
- (f) Mitigate any harmful effects of violations

##   Administrative Requirements

- Covered entities required by §164.530 to:
- (g) Not intimidate, discriminate or retaliate against complainants & others
- (h) Not require waiver of rights
- (i) Develop policies and procedures (including receiving complaints)
- (j) Meet documentation requirements
- Verify identity & authority of requestors
- Some requirements do not apply to certain group health plans

## Preemption

- Statute creates federal privacy floor by preemption of state law
- State law preempted if it is contrary to the rule, except for certain state law that
- Is necessary to prevent fraud & abuse, ensure State regulation of insurance, for State reporting of health care delivery/costs, or to serve a compelling need relating to public health, safety, or welfare
- Regulates a controlled substance
- Provides other public health or health plan reporting requirements
- Is more stringent than the privacy rule

## Office for Civil Rights (OCR)

- Delegation of Authority to enforce privacy rule
- Technical Assistance:  helping covered entities achieve voluntary compliance
- Compliance & Enforcement:
- Any person or organization can file complaints with OCR (generally within 180 days)
- OCR may investigate complaints & may conduct compliance reviews
- Preemption exception determinations

## Compliance Responsibilities of CEs (§160.310)

- Cooperate with investigations & compliance reviews
- Permit OCR access to facilities, books, records
- Keep records & submit compliance reports needed to determine compliance

## Limitations on OCR Disclosure

- 	Protected health information obtained by OCR in an investigation or review will not be disclosed by OCR, except if necessary for ascertaining or enforcing compliance or if otherwise required by law.

## OCR Compliance Action

- If investigation or review indicates a failure to comply, OCR will inform covered entity & complainant in writing & seek informal resolution whenever possible
- If matter cannot be resolved by informal means, OCR may issue written findings documenting non-compliance
- If, after an investigation or review, OCR determines that further action is not warranted, OCR will so inform covered entity & complainant in writing

## Civil Monetary Penalties

- $100 per violation
- Capped at $25,000 for each calendar year for each requirement or prohibition that is violated

## Criminal Penalties

- Up to $50,000 & 1 year in jail for knowingly obtaining or disclosing IIHI
- Up to $100,000 & 5 years if done under false pretenses
- Up to  $250,000 &10 years if intent to sell, transfer, or use for commercial advantage, personal gain, or malicious harm
- Enforced by DOJ

## Recently/Next Steps 

- April 12, 2001:  Secretary announces President’s decision of no delay in Rule
- July 6, 2001:  Department issued first general guidance to clarify misconceptions
- Department will consider modifications to ensure quality of care and to correct unintended effects of the Rule

## For More Information

- OCR Privacy Web site:
- http://www.hhs.gov/ocr/hipaa/