Skip to main content


U.S. flag
      An official website of the United States government
              Here’s how you know
        Here’s how you knowDot gov**Official websites use .gov**
                 A **.gov** website belongs to an official government organization in the United States.
                  HTTPS**Secure .gov websites use HTTPS**
                 A **lock** (A locked padlock) or **https://** means you’ve safely connected to the .gov website. Share sensitive information only on official, secure websites. 
  Menu Close
          Enter the terms you wish to search for.
    Search
        








  
  
    

  
      

                                      About HHS
    
                        
                              
      
      
      Programs & Services
    
                        
                              
      
      
      Grants & Contracts
    
                        
                              
      
      
      Laws & Regulations                  
Health Information Privacy
  HIPAA for Individuals
    
                        
                                            
      
      
      Filing a Complaint
    
                        
                                            
      
      
      HIPAA for Professionals
    
                        
                                            
      
      
      Newsroom

              

    



Breadcrumb
    HHS
                              HIPAA Home
                              For Professionals
                              FAQ
                              Smaller Providers and Businesses


    

    

    Navigate to:
  Authorizations (30)
          Business Associates (41)
          Compliance Dates (2)
          Covered Entities (14)
          Decedents (9)
          Disclosures for Law Enforcement Purposes (5)
          Disclosures for Rule Enforcement (1)
          Disclosures in Emergency Situations (2)
          Disclosures Required by Law (6)
          Disclosures to Family and Friends (28)
          Disposal of Protected Health Information (6)
          Facility Directories (7)
          Family Medical History Information (3)
          FERPA and HIPAA (10)
          Group Health Plans (3)
          Incidental Uses and Disclosures (10)
          Judicial and Administrative Proceedings (8)
          Minimum Necessary (14)
          Notice of Privacy Practice (20)
          Preemption of State Law (10)
          Privacy Rule: General Topics (12)
          Protected Health Information (2)
          Public Health Uses and Disclosures (13)
          Research Uses and Disclosures (20)
          Right to an Accounting of Disclosures (8)
          Right to File a Complaint (1)
          Right to Request a Restriction (4)
          Safeguards (13)
          Security Rule (24)
          Smaller Providers and Businesses (145)
          Student Immunizations (8)
          Transition Provisions (3)
          Treatment, Payment, and Health Care Operations Disclosures (30)
          Workers Compensation Disclosures (5)
          Limited Data Set (6)
          Marketing (17)
          Marketing - Refill Reminders (16)
          Personal Representatives and Minors (12)
          Right to Access and Research (58)
          Mental Health (35)
          Health Information Technology (41)
          Telehealth (11)Text resize icon

                    




Smaller Providers and Businesses
  
  
  
      187-What does the HIPAA Privacy Rule do
    Most health plans and health care providers that are covered by the new Rule must comply with the new requirements by April 14, 2003.
Read the full answer
      189-What does the HIPAA Privacy Rule require the average provider or health plan to do
    For the average health care provider or health plan, the Privacy Rule requires activities
Read the full answer
      190-Who must comply with HIPAA privacy standards
    As required by Congress in HIPAA, the Privacy Rule covers health plans, health care providers and health care clearinghouses.
Read the full answer
      191-When did covered entities have to meet these HIPAA privacy standards
    As Congress required in HIPAA, most covered entities had until April 14, 2003 to come into compliance with these standards, as modified by the August, 2002 final Rule. Small health plans had an additional year – until April 14, 2004 – to come into compliance.
Read the full answer
      195-Will HHS make future changes to HIPAA and how will these changes be made
    Under HIPAA, HHS has the authority to modify the privacy standards as the Secretary may deem appropriate. However, a standard can be modified only once in a 12-month period.
Read the full answer
      196-Can health care providers engage in confidential conversations with other providers or with patients
    Yes. The HIPAA Privacy Rule is not intended to prohibit providers from talking to each other and to their patients. Provisions of this Rule requiring covered entities to implement reasonable safeguards that reflect their particular circumstances and exempting treatment disclosures from certain requirements are intended to ensure that providers’ primary consideration is the appropriate treatment of their patients.
Read the full answer
      197-Does HIPAA require providers to soundproof walls to avoid conversations being overheard
    The Privacy Rule does not require these types of structural changes be made to facilities.
Read the full answer
      198-May providers leave messages for patients at their homes to remind them of appointments
    Yes. The HIPAA Privacy Rule permits health care providers to communicate with patients regarding their health care.
Read the full answer
      199-May providers use patient sign-in sheets or call out the names in their waiting rooms
    Yes. Covered entities, such as physician’s offices, may use patient sign-in sheets or call out patient names in waiting rooms, so long as the information disclosed is appropriately limited.
Read the full answer
      200-Can providers prohibited maintain patient medical charts at bedside or outside of exam rooms
    No. The HIPAA Privacy Rule does not prohibit covered entities from engaging in common and important health care practices; nor does it specify the specific measures that must be applied to protect an individual’s privacy while engaging in these practices.
Read the full answer
      201-Will HIPAA Privacy Rule allow clinics to place patient charts outside an exam room
    Yes, the Privacy Rule permits this practice as long as the clinic takes reasonable and appropriate measures to protect the patient’s privacy.
Read the full answer
      203-May specialists provide therapy to patients in a group setting
    Disclosures of protected health information in a group therapy setting are treatment disclosures and, thus, may be made without an individual’s authorization.
Read the full answer
      204-Are covered entities required to document incidental disclosures in an accounting of disclosures
    The Privacy Rule includes a specific exception from the accounting standard for incidental disclosures permitted by the Rule. See 45 CFR 164.528(a)(1).
Read the full answer
      205-Does HIPAA permit certain incidental uses and disclosures only in treatment situations or discussions among health care providers
    The provisions apply universally to incidental uses and disclosures that result from any use or disclosure permitted under the Privacy Rule, and not just to incidental uses and disclosures resulting from treatment communications, or only to communications among health care providers or other medical staff.
Read the full answer
      206-Is a covered entity required to prevent any incidental use or disclosure of protected health information?
    The HIPAA Privacy Rule does not require that all risk of incidental use or disclosure be eliminated to satisfy its standards.
Read the full answer
      207-How are covered entities expected to determine what is the minimum necessary information
    The HIPAA Privacy Rule requires a covered entity to make reasonable efforts to limit use, disclosure of, and requests for protected health information to the minimum necessary to accomplish the intended purpose.
Read the full answer
      208-Won't HIPAA's minimum necessary restrictions impede the delivery of quality health care
    Disclosures for treatment purposes (including requests for disclosures) between health care providers are explicitly exempted from the minimum necessary requirements.
Read the full answer
      209-Does HIPAA prohibit medical trainees from accessing patient medical information in their training
    The definition of “health care operations” in the Privacy Rule provides for “conducting training programs in which students, trainees, or practitioners in areas of health care learn under supervision to practice or improve their skills as health care providers.”
Read the full answer
      210-Must the minimum necessary standard be applied to disclosure authorized by an individual
    No. Uses and disclosures that are authorized by the individual are exempt from the minimum necessary requirements.
Read the full answer
      211-Are providers required to make a minimum necessary determination to disclose to federal or state agencies
    No. These disclosures must be authorized by an individual and, therefore, are exempt from the HIPAA Privacy Rule’s minimum necessary requirements.
Read the full answer
      212-Doesn't the HIPAA minimum necessary standard conflict with the HIPAA transaction standards
    Because the Privacy Rule exempts from the minimum necessary standard any uses or disclosures that are required for compliance with the applicable requirements of the transactions standards, including disclosures of all data elements that are required or situationally required in those transactions.
Read the full answer
      213-Does HIPAA prohibit the use, disclosure, or request of an entire medical record
    No. The Privacy Rule does not prohibit the use, disclosure, or request of an entire medical record; and a covered entity may use, disclose, or request an entire medical record without a case-by-case justification, if the covered entity has documented in its policies and procedures that the entire medical record is the amount reasonably necessary for certain identified purposes.
Read the full answer
      214-Will HIPAA permit a covered entity to disclose a complete medical record when other providers created parts of the record
    Yes, the Privacy Rule permits a provider who is a covered entity to disclose a complete medical record including portions that were created by another provider, assuming that the disclosure is for a purpose permitted by the Privacy Rule, such as treatment.
Read the full answer
      215-Are covered entities required to completely restructure existing workflow systems to comply with minimum necessary requirements
    No. The basic standard for minimum necessary uses requires that covered entities make reasonable efforts to limit access to protected health information to those in the workforce that need access based on their roles in the covered entity.
Read the full answer
      216-Is a covered entity required to apply the minimum necessary standard to a disclosure to another covered entity
    Covered entities are required to apply the minimum necessary standard to their own requests for protected health information.
Read the full answer
      219-Does HIPAA change the way a person can grant another person health care power of attorney
    No. Nothing in the Privacy Rule changes the way in which an individual grants another person power of attorney for health care decisions.
Read the full answer
      220-Can  a health care power of attorney obtain access to the individual's medical record
    Yes, an individual that has been given a health care power of attorney will have the right to access the medical records of the individual related to such representation to the extent permitted by the HIPAA Privacy Rule at 45 CFR 164.524. However, when a physician or other covered entity reasonably believes that an individual, including an unemancipated minor, has been or may be subjected to domestic violence, abuse or neglect by the personal representative, or that treating a person as an individual’s personal representative could endanger the individual, the covered entity may choose not to treat that person as the individual’s personal representative, if in the exercise of professional judgment, doing so would not be in the best interests of the individual.
Read the full answer
      221-Can a personal representative access to the individual's medical record
    The HIPAA Privacy Rule treats an adult or emancipated minor’s personal representative as the individual for purposes of the Rule regarding the health care matters that relate to the representation, including the right of access under 45 CFR 164.524.
Read the full answer
      222-How a deceased individual's family obtain the deceased's information relevant to their own health care
    The HIPAA Privacy Rule recognizes that a deceased individual’s protected health information may be relevant to a family member’s health care.
Read the full answer
      223-Does HIPAA address when it may not be appropriate for a person to control an individual's information
    Generally, no. The Rule defers to State and other laws that address the fitness of a person to act on an individual’s behalf.
Read the full answer
      224-May personal representatives access health information based on a non-health care power of attorney
    No. Except with respect to decedents, a covered entity must treat a personal representative as the individual only when that person has authority under other law to act on the individual’s behalf on matters related to health care.
Read the full answer
      226-How does a covered entity identify an individual’s personal representative
    State or other law determines who is authorized to act on an individual’s behalf, thus the Privacy Rule does not address how personal representatives should be identified.
Read the full answer
      227-Does the HIPAA Privacy Rule allow parents the right to see their children’s medical records
    Yes, the Privacy Rule generally allows a parent to have access to the medical records about his or her child, as his or her minor child’s personal representative when such access is not inconsistent with State or other law.
Read the full answer
      228-If a child receives emergency medical care without a parent's consent, can the parent get all information about the child's treatment and condition
    Generally, yes. Even though the parent did not consent to the treatment in this situation, the parent would be the child’s personal representative under the HIPAA Privacy Rule.
Read the full answer
      229-Does the HIPAA Privacy Rule provide rights for children to be treated without parental consent
    No. The Privacy Rule does not address consent to treatment, nor does it preempt or change State or other laws that address consent to treatment.
Read the full answer
      231-May a psychologist notify a parent before treating his or her minor child even though the child is able to consent
    The HIPAA Privacy Rule would defer to State or other applicable law that addresses the disclosure of health information to a parent about a minor child.
Read the full answer
      236-Is a covered entity liable for the actions of its business associates
    The HIPAA Privacy Rule requires covered entities to enter into written contracts or other arrangements with business associates which protect the privacy of protected health information; but covered entities are not required to monitor or oversee the means by which their business associates carry out privacy safeguards or the extent to which the business associate abides by the privacy requirements of the contract.
Read the full answer
      237-Can business associates self-certify or be certified by a third party as compliant with HIPAA
    No. A covered entity is required to enter into a contract or other written arrangement with a business associate that meets the requirements at 45 CFR 164.504(e).
Read the full answer
      239-Is a business associate contract required for a covered entity to disclose information to a researcher
    No. Disclosures from a covered entity to a researcher for research purposes do not require a business associate contract, even in those instances where the covered entity has hired the researcher to perform research on the covered entity’s own behalf.
Read the full answer
      240-When is a health care provider a business associate of another health care provider?
    The HIPAA Privacy Rule explicitly excludes from the business associate requirements disclosures by a covered entity to a health care provider for treatment purposes. See 45 CFR 164.502(e)(1).
Read the full answer
      241-May a covered entity share protected health information directly with another covered entity's business associate
    Yes. If the HIPAA Privacy Rule permits a covered entity to share protected health information with another covered entity, the covered entity is permitted to make the disclosure directly to a business associate acting on behalf of that other covered entity.
Read the full answer
      242-Are covered entities that engage in joint activities under an OHCA required to have contracts
    No. Covered entities that participate in an OHCA are permitted to share protected health information for the joint health care activities of the OHCA without entering into business associate contracts with each other. Of course, each such entity is independently required to observe its obligations under the HIPAA Privacy Rule with respect to protected health information.
Read the full answer
      243-Is a business associate contract required for inadvertent contact with protected health information
    A business associate contract is not required with persons or organizations whose functions, activities, or services do not involve the use or disclosure of protected health information, and where any access to protected health information by such persons would be incidental, if at all.
Read the full answer
      245-Are USPS, UPS, and delivery employees considered business associates
    No, the Privacy Rule does not require a covered entity to enter into business associate contracts with organizations, such as the US Postal Service, certain private couriers and their electronic equivalents that act merely as conduits for protected health information.
Read the full answer
      246-Does HIPAA require business associates to provide individuals with access to their information
    The Privacy Rule regulates covered entities, not business associates. he Rule requires covered entities to include specific provisions in agreements with business associates to safeguard protected health information, and addresses how covered entities may share this information with business associates.
Read the full answer
      248-Do physicians with hospital privileges have to enter into business associate contracts with the hospital
    No. The hospital and such physicians participate in what the HIPAA Privacy Rule defines as an organized health care arrangement (OHCA).
Read the full answer
      250-Can I combine the data and use agreement and business associate contract
    Yes. A data use agreement can be combined with a business associate agreement into a single agreement that meets the requirements of both provisions of the HIPAA Privacy Rule.
Read the full answer
      251-If a business associate receives a limited data set must they enter into both a business associate agreement and data use agreement
    No. Where a covered entity discloses only a limited data set to a business associate for the business associate to carry out a health care operations function, the covered entity satisfies the Rule’s requirements that it obtain satisfactory assurances from its business associate with the data use agreement.
Read the full answer
      252-Are business associates required to restrict their uses and disclosures to the minimum necessary
    A covered entity’s contract with a business associate may not authorize the business associate to use or further disclose the information in a manner that would violate the HIPAA Privacy Rule if done by the covered entity.
Read the full answer
      253-Is a physician or other provider considered to be a business associate of a health plan or other payer
    Generally, providers are not business associates of payers. For example, if a provider is a member of a health plan network and the only relationship between the health plan (payer) and the provider is one where the provider submits claims for payment to the plan, then the provider is not a business associate of the health plan.
Read the full answer
      255-Is a reinsurer a business associate of a health plan
    Generally, no. A reinsurer does not become a business associate of a health plan simply by selling a reinsurance policy to a health plan and paying claims under the reinsurance policy.
Read the full answer
      256-Is a software vendor a business associate of a covered entity
    The mere selling or providing of software to a covered entity does not give rise to a business associate relationship if the vendor does not have access to the protected health information of the covered entity.
Read the full answer
      258-How does the HIPAA Privacy Rule change the laws concerning consent for treatment?
    The Privacy Rule relates to uses and disclosures of protected health information, not to whether a patient consents to the health care itself. As such, the Privacy Rule does not affect informed consent for treatment, which is addressed by State law.
Read the full answer
      259-Can a pharmacist use information to fill a prescription that was telephoned in by a patient's physician
    The pharmacist is using the protected health information for treatment purposes, and the HIPAA Privacy Rule does not require covered entities to obtain an individual’s consent prior to using or disclosing protected health information about him or her for treatment, payment, or health care operations.
Read the full answer
      260-Can health care providers to whom a patient is referred for the first time use protected health information
    Yes. The HIPAA Privacy Rule does not require covered entities to obtain an individual’s consent prior to using or disclosing protected health information about him or her for treatment, payment, or health care operations.
Read the full answer
      261-Are health care providers restricted from consulting with other providers about a patient’s condition without the patient’s written authorization
    Consulting with another health care provider about a patient is within the HIPAA Privacy Rule’s definition of “treatment” and, therefore, is permissible.
Read the full answer
      262-Does the HIPAA Privacy Rule restrict pharmacists from giving advice about over-the-counter medicines to customers
    A pharmacist may provide advice to customers about over-the-counter medicines.
Read the full answer
      263-Can a patient have a friend or family member pick up a prescription for her
    A pharmacist may use professional judgment and experience with common practice to make reasonable inferences of the patient’s best interest in allowing a person, other that the patient, to pick up a prescription.
Read the full answer
      264-What is the difference between consent and authorization under the HIPAA Privacy Rule
    The Privacy Rule permits, but does not require, a covered entity voluntarily to obtain patient consent for uses and disclosures of protected health information for treatment, payment, and health care operations.
Read the full answer
      265-May a health care provider disclose information to a health plan for the plan's HEDIS
    The HIPAA Privacy Rule permits a provider to disclose protected health information to a health plan for the quality-related health care operations of the health plan, provided that the health plan has or had a relationship with the individual who is the subject of the information, and the protected health information requested pertains to the relationship.
Read the full answer
      266-Does HIPAA permit a covered entity or its collection agency to communicate with parties other than the patient
    Yes. The Privacy Rule permits a covered entity, or a business associate acting on behalf of a covered entity (e.g., a collection agency), to disclose protected health information as necessary to obtain payment for health care, and does not limit to whom such a disclosure may be made.
Read the full answer
      267-Does HIPAA prevent reporting to consumer credit reporting agencies or otherwise create any conflict with the FCRA
    No. The Privacy Rule’s definition of “payment” includes disclosures to consumer reporting agencies.
Read the full answer
      268-Does HIPAA prevent health plans and providers from using debt collection agencies
    The Privacy Rule permits covered entities to continue to use the services of debt collection agencies.
Read the full answer
      270-Does HIPAA permit an eye doctor to confirm a contact prescription received by a mail-order contact company
    The disclosure of protected health information by an eye doctor to a distributor of contact lenses for the purpose of confirming a contact lens prescription is a treatment disclosure, and is permitted under the Privacy Rule at 45 CFR 164.506.
Read the full answer
      271-Does a physician need a patient's written authorization to send a copy of the patient's medical record
    The HIPAA Privacy Rule permits a health care provider to disclose protected health information about an individual, without the individual’s authorization, to another health care provider for that provider’s treatment of the individual. See 45 CFR 164.506 and the definition of “treatment” at 45 CFR 164.501.
Read the full answer
      272-Is a hospital permitted to contact another hospital or health care facility without the patient's authorization
    The HIPAA Privacy Rule permits a health care provider to disclose protected health information about an individual, without the individual’s authorization, to another health care provider for that provider’s treatment or payment purposes, as well as to another covered entity for certain health care operations of that entity.
Read the full answer
      273-Is an ambulance service permitted to report its treatment to the hospital
    Yes. The HIPAA Privacy Rule permits an ambulance service or other health care provider to disclose protected health information about an individual, without the individual’s authorization, to another health care provider, such as a hospital, for that provider’s treatment of the individual. See 45 CFR 164.506 and the definition of “treatment” at 45 CFR 164.501.
Read the full answer
      278-When is an authorization required from the patient before a provider or health plan engages in marketing to that individual
    The HIPAA Privacy Rule expressly requires an authorization for uses or disclosures of protected health information for ALL marketing communications, except in two circumstances:
Read the full answer
      279-How can I distinguish between activities for treatment or health care operations versus marketing activities
    The overlap among common usages of the terms “treatment,” “healthcare operations,” and “marketing” is unavoidable.
Read the full answer
      280-Do disease management, health promotion, preventive care, and wellness programs fall under the HIPAA definition of marketing
    Generally, no. To the extent the disease management or wellness program is operated by the covered entity directly or by a business associate, communications about such programs are not marketing because they are about the covered entity’s own health-related services.
Read the full answer
      281-Is it marketing for a covered entity to describe products or services that are provided by the covered entity to its patients
    No. The HIPAA Privacy Rule excludes from the definition of “marketing” communications made to describe a covered entity’s health-related product or service (or payment for such product or service) that is provided by, or included in a plan of benefits of, the covered entity making the communication.
Read the full answer
      282-Is it marketing for a covered entity to describe the entities participating in a health care provider network or a health plan network
    The HIPAA Privacy Rule excludes from the definition of “marketing,” communications by a covered entity to describe the entities participating in a health care provider network or a health plan network.
Read the full answer
      283-Is it marketing for an insurance plan or health plan to send enrollees notices about changes to existing plans
    No. The HIPAA Privacy Rule excludes from the definition of “marketing,” communications about replacements of, or enhancements to, a health plan.
Read the full answer
      284-Can health plans communicate about health-related products or services to enrollees that are not part of a plan of benefits
    The provision of value-added items or services (VAIS) is a common practice, particularly for managed care organizations.
Read the full answer
      285-Can a doctor or pharmacy be paid to make a prescription refill reminder without a prior authorization under the HIPAA Privacy Rule
    Yes. It is not marketing for a doctor to make a prescription refill reminder even if a third party pays for the communication.
Read the full answer
      286-Are appointment reminders allowed under the HIPAA Privacy Rule without authorizations
    Yes, appointment reminders are considered part of treatment of an individual and, therefore, can be made without an authorization.
Read the full answer
      287-What are examples of alternative treatments excepted from the HIPAA definition of marketing
    Alternative treatments are treatments that are within the range of treatment options available to an individual.
Read the full answer
      288-Are prior authorizations required when a doctor or health plan distributes promotional gifts of nominal value?
    No. In a specific exception, the HIPAA Privacy Rule allows covered entities to distribute items commonly known as promotional gifts of nominal value without prior authorization, even if such items are distributed with the intent of encouraging the receiver to buy the products or services.
Read the full answer
      289-Are health care providers required to seek a prior authorization before discussing a product or service with a patient
    In face-to-face encounters, the HIPAA Privacy Rule allows covered entities to give or discuss products or services, even when not health-related, to patients without a prior authorization. This exception prevents unnecessary intrusion into the doctor-patient relationship.
Read the full answer
      290-Must insurance agents that are business associates of a health plan seek a prior authorization before talking to a customer
    No. In the specific case of face-to-face encounters, the HIPAA Privacy Rule allows health plans and their business associates to market both health and non-health insurance products to individuals.
Read the full answer
      291-What effect do the marketing provisions of the HIPAA Privacy Rule have on Federal or State fraud and abuse statutes
    The Privacy Rule makes it clear that nothing in the marketing provisions of the Privacy Rule are to be construed as amending, modifying, or changing any rule or requirement related to any other Federal or State statutes or regulations, including specifically anti-kickback, fraud and abuse, or self-referral statutes or regulations, or to authorize or permit any activity or transaction currently proscribed by such statutes and regulations.
Read the full answer
      292-May covered entities use information regarding specific clinical conditions of individuals
    Yes, if the communication is for the individual’s treatment or for case management, care coordination, or the recommendation of alternative therapies.
Read the full answer
      293-Are communications to beneficiaries about government programs marketing under HIPAA
    No. Communications about government and government-sponsored programs do not fall within the definition of “marketing.”
Read the full answer
      294-Must a health care provider obtain permission from a patient prior to notifying public health authorities of a reportable disease
    No. All States have laws that require providers to report cases of specific diseases to public health officials. The HIPAA Privacy Rule permits disclosures that are required by law.
Read the full answer
      295-Does the public health provision of the HIPAA Privacy Rule require covered entities to make public health disclosures
    No. The Privacy Rule’s public health provision permits, but does not require, covered entities to make such disclosures. This provision is intended to allow covered entities to continue current voluntary reporting practices that are critically important to public health and safety. The Rule also permits covered entities to disclose protected health information when State or other law requires covered entities to make disclosures for public health purposes.
Read the full answer
      296-May covered entities disclose facially identifiable protected health information, such as name, address, and social security number, for public health purposes?
    Yes. The HIPAA Privacy Rule permits covered entities to disclose the amount and type of protected health information that is needed for public health purposes.
Read the full answer
      297-Does HIPAA public health provision permit covered entities to disclose  information to authorities
    The definition of a “public health authority” requires that an agency’s official mandate include the responsibility for public health matters.
Read the full answer
      298-To whom may covered entities make public health disclosures regarding a product regulated by the FDA
    Covered entities may identify persons responsible for an FDA-regulated product by using the product label, the literature that accompanies the product, or other sources of labeling, such as the Physician’s Desk Reference.
Read the full answer
      299-Is a covered entity permitted to disclose information under HIPAA's public health provision when a link is only suspected
    Yes. In most instances when a covered entity makes an adverse event report to a person responsible for an FDA-regulated product, the covered entity will suspect, but not know, the product is the cause of the event.
Read the full answer
      300-Does HIPAA's public health provision permit covered entities to disclose information without authorization
    No. The public health provision is intended to facilitate the flow of information that is essential to the FDA’s public health mission.
Read the full answer
      301-Does the public health provision permit covered health care providers to disclose information to an individuals employer
    The public health provision permits covered health care providers to disclose an individual's protected health information to the individual’s employer without authorization in very limited circumstances.
Read the full answer
      306-Can researchers access existing databanks or repositories created prior to the compliance date without permission
    Under the HIPAA Privacy Rule, covered entities may use or disclose protected health information from existing databases or repositories for research purposes either with individual authorization as required at 45 CFR 164.508, or with a waiver of individual authorization as permitted at 45 CFR 164.512(i).
Read the full answer
      323-Does an individual have a right to restrict the information health care provider discloses for workers' compensation
    Individuals do not have a right under the Privacy Rule at 45 CFR 164.522(a) to request that a covered entity restrict a disclosure of protected health information about them for workers’ compensation purposes when that disclosure is required by law or authorized by, and necessary to comply with, a workers’ compensation or similar law.
Read the full answer
      324-Does HIPAA permit a health care provider to disclose an injured or ill worker's protected health information
    Privacy of Health Information/HIPAA Workers' Compensation Disclosures
Read the full answer
      325-Am I permitted to disclose the information required by my state law
    The HIPAA Privacy Rule permits a covered entity to disclose protected health information as necessary to comply with State law.
Read the full answer
      326-My state law says I may disclose records am I allowed to share this information under HIPAA
    A covered entity is permitted to disclose an individual’s protected health information as necessary to comply with and to the full extent authorized by workers’ compensation law.
Read the full answer
      327-My state law says I may provide information regarding an injured workers' previous condition am I permitted to make this disclosure under HIPAA
    A covered entity may disclose protected health information where the individual’s written authorization has been obtained, consistent with the Privacy Rule’s requirements at 45 CFR 164.508.
Read the full answer
      328-Are hospitals or other health care providers required to provide their notices to patients they treat in an emergency
    Hospitals and other covered health care providers with a direct treatment relationship with individuals are not required to provide their notices to patients at the time they are providing emergency treatment.
Read the full answer
      329-Does the provider have to make a good faith effort to obtain the individual's acknowledgement of the notice
    Yes. The HIPAA Privacy Rule requires that a covered health care provider with a direct treatment relationship with individuals make a good faith effort to obtain written acknowledgments from those individuals that they have received the provider’s notice, regardless of whether the provider also chooses to obtain the individuals’ consent.
Read the full answer
      330-Can covered entities distribute their notices as part of other mailings or distributions
    Yes. The HIPAA Privacy Rule provides covered entities with discretion in this area; no special or separate mailings or distributions are required to satisfy the Privacy Rule’s notice distribution requirements.
Read the full answer
      332-Does HIPAA require a provider to obtain a new acknowledgement of receipt if the facility changes its privacy policy
    No. A covered health care provider with a direct treatment relationship with individuals is required to make a good faith effort to obtain an individual's acknowledgement of receipt of the notice only at the time the provider first gives the notice to the individual -- that is, at first service delivery. See 45 CFR 164.520(c)(2).
Read the full answer
      333-Does HIPAA permit providers to obtain an electronic acknowledgement of the notice
    For notice delivered electrically, an electronic return receipt or other return transmission from the individual is considered a valid written acknowledgment of the notice.
Read the full answer
      334-Are covered entities permitted to give individuals a layered notice
    Covered entities may use a “layered” notice to implement the HIPAA Privacy Rule’s requirements, so long as the elements required by 45 CFR 164.520(b) are included in the document that is provided to the individual.
Read the full answer
      335-Are health plans required to make a good faith effort to obtain a written acknowledgement of receipt of the notice
    Under the HIPAA Privacy Rule, only covered health care providers that have a direct treatment relationship with individuals are required to make a good faith effort to obtain the individual's acknowledgment of receipt of the notice.
Read the full answer
      336-How are providers supposed to provide the notice and obtain acknowledgement when the first treatment is over the phone
    The HIPAA Privacy Rule is intended to be flexible enough to address the various types of relationships that covered health care providers may have with the individuals they treat, including those treatment situations that are not face-to-face.
Read the full answer
      337-We participate in an OHCA how do we provide notices and obtain individuals' acknowledgements
    Health care providers and other covered entities that participate in an organized health care arrangement (OHCA) may use a single, joint notice that covers all of the participating covered entities (provided that the conditions at 45 CFR 164.520(d) are met), or may each maintain separate notices.
Read the full answer
      338-Does a health plan have to provide a copy of its notice to each dependent receiving coverage under a policy
    A health plan satisfies the HIPAA Privacy Rule’s requirements for providing the notice by distributing its notice only to the named insured of a policy under which coverage is provided both to the named insured and his or her dependents. See 45 CFR 164.520(c)(1)(iii).
Read the full answer
      339-For group health plan products can the health plan send its notice to the administrator of the group product
    The HIPAA Privacy Rule requires a health plan to distribute its notice to each individual covered by the plan.
Read the full answer
      340-As a pediatrician, am I required to give my notice of privacy practices to the children I treat
    The HIPAA Privacy Rule requires a covered health care provider with a direct treatment relationship with the individual to provide the notice to the individual receiving treatment no later than the date of first service delivery. In cases where the individual has a personal representative, as is generally the case when a parent brings a child in for treatment, the provider satisfies the notice distribution requirements by providing the notice to the personal representative (e.g., the child’s parent), and making a good faith effort to obtain the personal representative’s acknowledgment of the notice.
Read the full answer
      341-Are providers required to post their entire notice at their facility
    Covered health care providers that maintain an office or other physical site where they provide health care directly to individuals are required to post their entire notice at the facility in a clear and prominent location.
Read the full answer
      342-Can a covered entity bypass obtaining an individual's authorization for a use or disclosure not permitted by HIPAA
    A covered entity’s notice is not a substitute for an individual’s authorization.
Read the full answer
      343-Is our medical practice required to notify patients through the mail of any changes to our notice
    The HIPAA Privacy Rule does not require a covered health care provider to mail out its revised notice or otherwise notify patients by mail of changes to the notice.
Read the full answer
      344-Is a physician required to give notice to every patient
    The HIPAA Privacy Rule requires a covered health care provider with direct treatment relationships with individuals to give the notice to every individual no later than the date of first service delivery to the individual and to make a good faith effort to obtain the individual’s written acknowledgment of receipt of the notice.
Read the full answer
      345-Does HIPAA prohibit collecting preoperative information over the phone if the patient has not yet received or acknowledged notice
    The Privacy Rule does not prohibit this practice.
Read the full answer
      346-Is a pharmacist permitted to have customer acknowledge receipt of the notice by signing or initialing the log book
    Yes. Provided that the individual is clearly informed on the log book of what they are acknowledging and the acknowledgment is not also used as a waiver or permission for something else that also appears on the log book (such as a waiver to consult with the pharmacist).
Read the full answer
      352-If I believe that my privacy rights have been violated, when can I submit a complaint
    By law, health care providers (including doctors and hospitals) who engage in certain electronic transactions, health plans, and health care clearinghouses, (collectively, “covered entities”) have until April 14, 2003, to comply with the HIPAA Privacy Rule.
Read the full answer
      353-If patients request copies of their medical records as permitted by the Privacy Rule, are they required to pay for the copies
    The Privacy Rule permits the covered entity to impose reasonable, cost-based fees. The fee may include only the cost of copying (including supplies and labor) and postage, if the patient requests that the copy be mailed.
Read the full answer
      354-Does the HIPAA Privacy Rule protect genetic information
    Genetic information is health information protected by the Privacy Rule. Like other health information, to be protected it must meet the definition of protected health information: it must be individually identifiable and maintained by a covered health care provider, health plan, or health care clearinghouse. See 45 C.F.R 160.103 and 164.501.
Read the full answer
      356-Can a physician’s office fax patient medical information to another physician’s office
    The HIPAA Privacy Rule permits physicians to disclose protected health information to another health care provider for treatment purposes. This can be done by fax or by other means.
Read the full answer
      360-My state requires consent to use or disclose health information. Does the HIPAA Privacy Rule take away this protection
    The Privacy Rule does not prohibit a covered entity from obtaining an individual's consent to use or disclose his or her health information and, therefore, presents no barrier to the entity's ability to comply with State law requirements.
Read the full answer
      364-Are long/short term disability; workers' compensation; automobile liability that includes coverage for medical payments covered under HIPAA
    No. The listed types of policies are not health plans. The HIPAA Administrative Simplification regulations specifically exclude from the definition of a “health plan” any policy, plan, or program to the extent that it provides, or pays for the cost of, excepted benefits, which are listed in section 2791(c)(1) of the Public Health Service Act, 42 U.S.C. 300gg-91(c)(1).





Date Created: 12/20/2002
Read the full answer
      365-Is an entity that is acting as a third party administrator to a group health plan a covered entity
    Providing services to or acting on behalf of a health plan does not transform a third party administrator (TPA) into a covered entity.
Read the full answer
      367-Was the Privacy Rule compliance date delayed by the ASCA that was enacted in December 2001
    The compliance dates for the Privacy Rule is April 14, 2003, or, for small health plans, April 14, 2004.
Read the full answer
      369-Does the HIPAA Privacy Rule require that covered entities provide patients with access to oral information
    The Privacy Rule requires covered entities to provide individuals with access to protected health information about themselves that is contained in their “designated record sets.”
Read the full answer
      370-Does the HIPAA Privacy Rule require that covered entities document all oral communications
    The Privacy Rule does not require covered entities to document any information, including oral information, that is used or disclosed for treatment, payment or health care operations.
Read the full answer
      390-Does the HIPAA Privacy Rule require a business associate to create a notice of privacy practices
    However, a covered entity must ensure through its contract with the business associate that the business associate's uses and disclosures of protected health information and other actions are consistent with the covered entity's privacy policies, as stated in covered entity's notice.
Read the full answer
      421-Is an fsa a covered entity for purposes of the Privacy Rule
    A "group health plan" is a covered entity under the Privacy Rule and the other HIPAA, Title II, Administrative Simplification standards.
Read the full answer
      455-Does the Privacy Rule permit health plans to disclose protected health information to pharmaceutical manufacturers
    The Privacy Rule permits a health plan to disclose protected health information, such as prescription numbers, to a pharmaceutical manufacturer for purposes of adjudicating claims submitted under a drug rebate contract.
Read the full answer
      464-Must a covered entity revise the whole notice every time one state law materially changes
    The Privacy Rule requires the Notice of Privacy Practices (Notice) to identify, among other things, what uses and disclosures the covered entity may make of protected health information.
Read the full answer
      481-Does HIPAA permit health care providers to share information for treatment purposes without authorization
    The Privacy Rule allows those doctors, nurses, hospitals, laboratory technicians, and other health care providers that are covered entities to use or disclose protected health information, such as X-rays, laboratory and pathology reports, diagnoses, and other medical information for treatment purposes without the patient’s authorization.
Read the full answer
      482-Does HIPAA permit a health care provider to share information for treatment purposes by fax, e-mail, or over the phone
    Yes. The Privacy Rule allows covered health care providers to share protected health information for treatment purposes without patient authorization, as long as they use reasonable safeguards when doing so. These treatment communications may occur orally or in writing, by phone, fax, e-mail, or otherwise.
Read the full answer
      494-Were there Privacy Rule compliance deadlines in 2004
    There are two deadlines for compliance with the HIPAA Privacy Rule on April 14, 2004:
Read the full answer
      495-Must all small health plans comply with the Privacy Rule
    No. Certain plans are specifically excluded from having to comply with the HIPAA Administrative Simplification requirements, including the Privacy Rule.
Read the full answer
      496-Is the fully insured group health plan subject to all of the Privacy Rule provisions
    The Privacy Rule recognizes that certain fully insured group health plans may not need to satisfy all of the requirements of the Privacy Rule since these responsibilities will be carried out by the health insurance issuer or HMO with which the group health plan has contracted for coverage of its members.
Read the full answer
      499-As an employer, I sponsor a group health plan for my employees. Am I a covered entity under HIPAA
    Covered entities under HIPAA are health care clearinghouses, certain health care providers, and health plans.
Read the full answer
      511-Does HIPAA limit what a doctor can do with a family medical history
    Does the HIPAA Privacy Rule limit what a doctor can do with a family medical history?
Read the full answer
      703-May a covered entity disclose protected health information in response to a court order
    A covered entity may disclose protected health information to comply with a court order, including an order of an administrative tribunal.
Read the full answer
      704-May a covered entity use or disclose protected health information for litigation
    A covered entity may use or disclose protected health information as permitted or required by the Privacy Rule, see 45 CFR 164.502(a); and, subject to certain conditions the Rule typically permits uses and disclosures for litigation, whether for judicial or administrative proceedings, under particular provisions for judicial and administrative proceedings set forth at 45 CFR 164.512(e), or as part of the covered entity’s health care operations, 45 CFR 164.506(a).
Read the full answer
      705-May a covered entity in a legal proceeding use or disclose PHI for the litigation
    Yes. Where a covered entity is a party to a legal proceeding, such as a plaintiff or defendant, the covered entity may use or disclose protected health information for purposes of the litigation as part of its health care operations.
Read the full answer
      706-What satisfactory assurances must a covered entity receive before it responds to a subpoena without a court order
    Under 45 CFR 164.512(e)(1)(ii) of the Privacy Rule, a covered entity that is not a party to the litigation may disclose protected health information in response to a subpoena, discovery request, or other lawful process if the covered entity receives certain satisfactory assurances from the party seeking the information.
Read the full answer
      707-For disclosures can notice be provided to the individual's lawyer instead of the individual
    Yes. A covered entity that is not a party to litigation must obtain or receive the satisfactory assurances required by 45 CFR 164.512(e) before making a disclosure for a judicial or administrative proceeding.
Read the full answer
      708-For disclosures when is a copy of the subpoena itself satisfactory assurance of notice to the individual
    A copy of the subpoena (or other request pursuant to lawful process) is sufficient when, on its face, it meets the requirements of 45 CFR 164.512(e)(1)(iii), such as by demonstrating that the individual whose protected health information is requested is a party to the litigation, notice of the request has been provided to the individual or his or her attorney, and the time for the individual to raise objections has elapsed and no objections were filed or all objections filed have been resolved. When the above requirements are evident on the face of the subpoena (or other request), no additional documentation is required.
Read the full answer
      709-Must a lawyer who is a business associate require PHI recipients agree to abide by privacy restrictions
    It depends on who the recipient is.
Read the full answer
      710-When must a covered entity account for disclosures of PHI made during the course of litigation
    Individuals have a right to receive, upon request, an accounting of disclosures of protected health information made by a covered entity (or its business associate), with certain exceptions.
Read the full answer
      711-May a covered entity disclose PHI in response to a lawful processnot accompanied by a court order
    Yes, if certain conditions are met. A covered entity that is not a party to litigation, such as where the covered entity is neither a plaintiff nor a defendant, may disclose protected health information in response to a subpoena, discovery request, or other lawful process, that is not accompanied by a court order, provided that the covered entity: ...
Read the full answerBack to top
    Contact HHS
    
                        
                                            
      
      
      Careers
    
                        
                                            
      
      
      HHS FAQs
    
                        
                                            
      
      
      Nondiscrimination NoticeHHS Archive
    
                        
                                            
      
      
      Accessibility Statement
    
                        
                                            
      
      
      Privacy Policy
    
                        
                                            
      
      
      Viewers & PlayersBudget/Performance
    
                        
                                            
      
      
      Inspector General
    
                        
                                            
      
      
      Web Site Disclaimers
    
                        
                                            
      
      
      EEO/No Fear ActFOIA
    
                        
                                            
      
      
      The White House
    
                        
                                            
      
      
      USA.gov
    
                        
                                            
      
      
      Vulnerability Disclosure Policy
        Sign Up for Email Updates

Receive the latest updates from the Secretary, Blogs, and News Releases.

Sign Up
  HHS Headquarters
          200 Independence Avenue, S.W.
                  Washington, D.C. 20201
                  Toll Free Call Center: 1-877-696-6775​