The regulation will be enforced by the HHS Office for Civil Rights. With few exceptions, an individual's health care information should be used for health purposes only, including treatment and payment. For example, a hospital may use personal health information to provide care, teach, train, conduct research, and ensure quality. However, employers who also sponsor health plans may not obtain information for non-health purposes like hiring, firing, or determining promotions, without permission from the individual. Similarly, insurers may not use such information to underwrite other products, such as life insurance.
Disclosure is to be kept to the minimum information needed for the purpose of the disclosure.
The new standards reflect the need to balance privacy protections with the public responsibility to support such national priorities as protecting public health, conducting medical research, improving the quality of care, and fighting health care fraud and abuse. For example, when there is an infectious disease outbreak, public health agencies need to obtain important information to better protect the public. The new regulation provides standards for how such information should be released to balance privacy and public health needs. It is the responsibility of organizations that are entrusted with health information to protect it against deliberate or inadvertent misuse or disclosure. The final regulation requires covered organizations to establish clear procedures to protect patients' privacy, including designating an official to establish and monitor the entity's privacy practices and training.