There are two basic concepts that are essential to an understanding of the new approach. First, identifiable health information that is created or used during the medical treatment or payment process becomes protected health information, or individually identifiable patient information relating to the provision of health care or payment for health care. This new terminology emphasizes the sensitivity of the information and connotes an obligation to safeguard the data. Protected health information generally remains subject to statutory restriction no matter how it is used or disclosed. The second basic concept is that of a health information trustee.
Trustees have different sets of responsibilities and authorities depending on their functions.
Of course, every health information trustee has an obligation to maintain adequate security for protected health information. The term trustee was selected in order to underscore that those in possession of identifiable health information have obligations that go beyond their own needs and interests. A doctor who possesses information about a patient does not own that information. It is more accurate to say that both the record subject and the recordkeeper have rights and responsibilities with respect to the information. My legislation defines those rights and responsibilities.