The preliminary rule covered only electronic data and medical records.
Patient consent is required before information can be released, even for routine disclosures.
Detailed procedures must be followed. Medical data cannot be used for employment purposes without specific authorization. Companies that sponsor health plans, for example, cannot access the personal health information held by the plan for employment-related purposes without patient authorization. Encryption is technically optional, but required in a practical sense Audit control Audit control mechanisms must record and examine system activity, to identify suspicious data access activities, assess your security program, and respond to potential weaknesses. Authorization control Must include a mechanism for obtaining consent for the use and disclosure of health information.