Skip to main content


U.S. flag
      An official website of the United States government
              Here’s how you know
        Here’s how you knowDot gov**Official websites use .gov**
                 A **.gov** website belongs to an official government organization in the United States.
                  HTTPS**Secure .gov websites use HTTPS**
                 A **lock** (A locked padlock) or **https://** means you’ve safely connected to the .gov website. Share sensitive information only on official, secure websites. 
  Menu Close
          Enter the terms you wish to search for.
    Search
        








  
  
    

  
      

                                      About HHS
    
                        
                              
      
      
      Programs & Services
    
                        
                              
      
      
      Grants & Contracts
    
                        
                              
      
      
      Laws & Regulations                  
Health Information Privacy
  HIPAA for Individuals
    
                        
                                            
      
      
      Filing a Complaint
    
                        
                                            
      
      
      HIPAA for Professionals
    
                        
                                            
      
      
      Newsroom

              

    



Breadcrumb
    HHS
                              HIPAA Home
                              For Professionals
                              FAQ
                              Health Information Technology


    

    

    Navigate to:
  Authorizations (30)
          Business Associates (41)
          Compliance Dates (2)
          Covered Entities (14)
          Decedents (9)
          Disclosures for Law Enforcement Purposes (5)
          Disclosures for Rule Enforcement (1)
          Disclosures in Emergency Situations (2)
          Disclosures Required by Law (6)
          Disclosures to Family and Friends (28)
          Disposal of Protected Health Information (6)
          Facility Directories (7)
          Family Medical History Information (3)
          FERPA and HIPAA (10)
          Group Health Plans (3)
          Incidental Uses and Disclosures (10)
          Judicial and Administrative Proceedings (8)
          Minimum Necessary (14)
          Notice of Privacy Practice (20)
          Preemption of State Law (10)
          Privacy Rule: General Topics (12)
          Protected Health Information (2)
          Public Health Uses and Disclosures (13)
          Research Uses and Disclosures (20)
          Right to an Accounting of Disclosures (8)
          Right to File a Complaint (1)
          Right to Request a Restriction (4)
          Safeguards (13)
          Security Rule (24)
          Smaller Providers and Businesses (145)
          Student Immunizations (8)
          Transition Provisions (3)
          Treatment, Payment, and Health Care Operations Disclosures (30)
          Workers Compensation Disclosures (5)
          Limited Data Set (6)
          Marketing (17)
          Marketing - Refill Reminders (16)
          Personal Representatives and Minors (12)
          Right to Access and Research (58)
          Mental Health (35)
          Health Information Technology (41)
          Telehealth (11)Text resize icon

                    




Health Information Technology
  
  
  
      537-What is a covered entity's liability under HIPAA for sharing data inappropriately to a HIO
    What is a covered entity's liability under the HIPAA Privacy Rule for sharing data inappropriately to or through a health information organization (HIO) or other electronic health information exchange network?
Read the full answer
      538-Does HIPAA require a covered entity to police na HIO
    Does the HIPAA Privacy Rule require a covered entity to “police” a health information organization (HIO), which functions as its business associate?
Read the full answer
      539-How should a covered entity respond to any HIPAA violation of an HIO
    How should a covered entity respond to any HIPAA Privacy Rule violation of a health information organization (HIO) acting as its business associate?
Read the full answer
      540-Who is liable under HIPAA where multiple entities signed a single business associate agreement and one member breaches
    Who is liable under the HIPAA Privacy Rule where multiple covered entities have signed on to a single business associate agreement and one member breaches the agreement?
Read the full answer
      541-May a covered provider disclose electronic PHI through an HIO to another provider
    may a covered health care provider disclose electronic protected health information (PHI) through a health information organization (HIO) to another health care provider for treatment?
Read the full answer
      542-May a HIO manage a master patient index on behalf of multiple HIPAA covered entities
    May a health information organization (HIO) manage a master patient index on behalf of multiple HIPAA covered entities?
Read the full answer
      543-What may a HIPAA covered entity’s business associate agreement authorize a HIO to do with electronic PHI
    What may a HIPAA covered entity’s business associate agreement authorize a health information organization (HIO) to do with electronic protected health information (PHI) it maintains or has access to in the network?
Read the full answer
      544-May a HIO de-identify information and then use it for its own purposes
    May a health information organization (HIO), acting as a business associate of a HIPAA covered entity, de-identify information and then use it for its own purposes?
Read the full answer
      545-How may HIPAA’s minimum necessary standard apply to EHI exchange through a networked environment
    How may the HIPAA Privacy Rule’s minimum necessary standard apply to electronic health information exchange through a networked environment?
Read the full answer
      546-Does HIPAA permit a covered entity to disclose psychotherapy notes to a HIO
    Does the HIPAA Privacy Rule permit a covered entity to disclose psychotherapy notes to or through a health information organization (HIO)?
Read the full answer
      547-Does HIPAA allow third parties to access PHI through a HIO
    To what extent does the HIPAA Privacy Rule allow third parties to access protected health information (PHI) through a health information organization (HIO) for purposes other than treatment, payment, and health care operations?
Read the full answer
      548-Who is responsible for amendment of PHI in an electronic health information exchange
    Who is responsible for amendment of protected health information in an electronic health information exchange environment?
Read the full answer
      549-Notifying others in a network if an amendment to PHI is made
    What are a covered entity’s responsibilities to notify others in a network if an amendment to protected health information is made?
Read the full answer
      550-What is a designated record set for purposes of an individual’s right of access under HIPAA
    In an electronic health information exchange environment, what is a designated record set for purposes of an individual’s right of access under the HIPAA Privacy Rule?
Read the full answer
      551-How would an HIO know if someone were a personal representative
    How would a covered entity or health information organization (HIO), acting on its behalf, know if someone were a personal representative for the purpose of granting access under the HIPAA Privacy Rule?
Read the full answer
      552-How may judgments be made electronically about denial of access under HIPAA
    How may judgments be made electronically about denial of access under the HIPAA Privacy Rule?
Read the full answer
      553-Does HIPAAinhibit EHI exchange across different states or jurisdictions
    Does the HIPAA Privacy Rule inhibit electronic health information exchange across different states or jurisdictions?
Read the full answer
      554-How do HIPAA authorizations apply to an electronic health information exchange environment
    How do HIPAA authorizations apply to an electronic health information exchange environment?
Read the full answer
      555-Can a covered entity use existing aspects of HIPAA to give the right to Opt-In or Opt-Out
    Can a covered entity use existing aspects of the HIPAA Privacy Rule to give individuals the right to Opt-In or Opt-Out of electronic health information exchange?
Read the full answer
      556-Who has the right to consent to electronically exchanging a minor’s PHI through an HIO
    Who has the right to consent or the right to request restrictions with respect to whether a covered entity may electronically exchange a minor’s protected health information to or through a health information organization (HIO)?
Read the full answer
      557-Can a covered entity use HIPAA to give individuals the right to decide to disclose information through an HIO
    Can a covered entity use existing aspects of the HIPAA Privacy Rule to give individuals the right to decide whether sensitive information about them may be disclosed to or through a health information organization (HIO)?
Read the full answer
      558-Does HIPAA permit a covered entity to disclose psychotherapy notes through a HIO
    Does the HIPAA Privacy Rule permit a covered entity to disclose psychotherapy notes to or through a health information organization (HIO)?
Read the full answer
      559-Is a health information organization (HIO) covered by the HIPAA Privacy Rule
    Is a health information organization (HIO) covered by the HIPAA Privacy Rule?
Read the full answer
      560-Can a HIO operate as a business associate of multiple covered entities
    Can a health information organization (HIO) operate as a business associate of multiple covered entities participating in a networked environment?
Read the full answer
      561-What are considerations for a business associate agreement with a HIO
    What are some considerations in developing and implementing a business associate agreement with a health information organization (HIO)?
Read the full answer
      562-Can a HIO exchange PHI with another HIO acting as a business associate
    Can a health information organization (HIO), as a business associate, exchange protected health information (PHI) with another HIO acting as a business associate?
Read the full answer
      563-Can a HIO participate as part of an OHCA
    Can a health information organization (HIO) participate as part of an organized health care arrangement (OHCA)?
Read the full answer
      564-Can a HIO participate as part of an affiliated covered entity
    Can a health information organization (HIO) participate as part of an affiliated covered entity?
Read the full answer
      565-May a NPP specifically mention that PHI will be disclosed to a HIO
    May a HIPAA Notice of Privacy Practices (NPP) specifically mention that protected health information (PHI) will be disclosed to and through a health information organization (HIO)? May the NPP mention that the covered health care provider uses an electronic health record (EHR)?
Read the full answer
      566-Are HIOs required to have a HIPAA NPP
    Are health information organizations (HIOs) required to have a HIPAA Notice of Privacy Practices (NPP)?
Read the full answer
      567-May covered entities provide individuals with their NPP electronically
    May covered entities that operate in electronic environments provide individuals with their HIPAA Notice of Privacy Practices (NPP) electronically?
Read the full answer
      568-Does HIPAA permit a covered health care provider to e-mail PHI with another provider for treatment purposes
    Does the HIPAA Privacy Rule permit a covered health care provider to e-mail or otherwise electronically exchange protected health information (PHI) with another provider for treatment purposes?
Read the full answer
      569-How may requirements for verification of identity and authority be met in an EHI exchange
    How may the HIPAA Privacy Rule’s requirements for verification of identity and authority be met in an electronic health information exchange environment?
Read the full answer
      570-Does HIPAA permit health care providers to use e-mail to discuss with their patients
    Does the HIPAA Privacy Rule permit health care providers to use e-mail to discuss health issues and treatment with their patients?
Read the full answer
      571-Does HIPAA allow entities participating in EHI exchange with a HIO to establish common safeguards
    Does the HIPAA Privacy Rule allow covered entities participating in electronic health information exchange with a health information organization (HIO) to establish a common set of safeguards?
Read the full answer
      2074-May a business associate of a HIPAA covered entity block or terminate access by the covered entity to the protected health information (PHI) maintained by the business associate for or on behalf of the covered entity?
    First, a business associate may not use PHI in a manner or to accomplish a purpose or result that would violate the HIPAA Privacy Rule. See 45 CFR § 164.502(a)(3).
Read the full answer
      3009-Does a HIPAA Covered Entity-bear Liability
    Does a HIPAA covered entity that fulfills an individual’s request to transmit electronic protected health information (ePHI) to an application or other software (collectively “app”)See also OCR FAQ 2039, “What is the liability of a covered entity in responding to an individual’s access request to send the individual’s PHI to a third party,” available at https://www.hhs.gov/hipaa/for-professionals/faq/2039/what-is-the-liability-of-a-covered-entity-in-responding/index.html bear liability under the HIPAA Privacy, Security, or Breach Notification Rules (HIPAA Rules) for the app’s use or disclosure of the health information it received?
Read the full answer
      3010-What Liability Does a Covered Entity Face
    What liability does a covered entity face if it fulfills an individual’s request to send their ePHI using an unsecure method to an app?
Read the full answer
      3011-Where an individual directs a Covered Entity to Send ePHI to a Designated App Does a Covered Entity's EHR System Developer Bear Liability
    Where an individual directs a covered entity to send ePHI to a designated app, does a covered entity’s electronic health record (EHR) system developer bear HIPAA liability after completing the transmission of ePHI to the app on behalf of the covered entity?
Read the full answer
      3012-Can a Covered Entity Refuse to Disclose ePHI
    Can a covered entity refuse to disclose ePHI to an app chosen by an individual because of concerns about how the app will use or disclose the ePHI it receives?
Read the full answer
      3013-Does HIPAA Require a Covered Entity to Enter Into a Business Associate Agreement
    Does HIPAA require a covered entity or its EHR system developer to enter into a business associate agreement with an app designated by the individual in order to transmit ePHI to the app?
Read the full answerBack to top
    Contact HHS
    
                        
                                            
      
      
      Careers
    
                        
                                            
      
      
      HHS FAQs
    
                        
                                            
      
      
      Nondiscrimination NoticeHHS Archive
    
                        
                                            
      
      
      Accessibility Statement
    
                        
                                            
      
      
      Privacy Policy
    
                        
                                            
      
      
      Viewers & PlayersBudget/Performance
    
                        
                                            
      
      
      Inspector General
    
                        
                                            
      
      
      Web Site Disclaimers
    
                        
                                            
      
      
      EEO/No Fear ActFOIA
    
                        
                                            
      
      
      The White House
    
                        
                                            
      
      
      USA.gov
    
                        
                                            
      
      
      Vulnerability Disclosure Policy
        Sign Up for Email Updates

Receive the latest updates from the Secretary, Blogs, and News Releases.

Sign Up
  HHS Headquarters
          200 Independence Avenue, S.W.
                  Washington, D.C. 20201
                  Toll Free Call Center: 1-877-696-6775​