The Privacy Rule addresses the use and disclosure of individuals’ health information and establishes individuals’ rights to obtain and control access to this information. Specifically, the rule covers “protected health information,” defined as individually identifiable health information that is transmitted or maintained in any form. It applies to “covered entities,” defined as health plans, health care clearinghouses, and health care providers that transmit information electronically with respect to certain transactions. The protections under the Privacy Rule extend to all individuals, regardless of the state in which they live or work, but the rule does not preempt state privacy laws that are more stringentthat is, more protective of health information privacy. Under the Privacy Rule, a covered entity may use and disclose an individual’s protected health information without obtaining the individual’s authorization when the information is used for treatment, payment, or health care operations. Protected health information may also be disclosed without an individual’s authorization for such purposes as certain public health and law enforcement activities, and judicial and administrative proceedings, provided certain conditions are met. In addition, an individual’s authorization is not required for disclosures for research purposes if a waiver of authorization, under defined criteria, is obtained from an institutional review board (IRB) or a privacy board. Except where the rule specifically allows or requires a use or disclosure without an authorization, the individual’s written authorization must be obtained; for example, authorization is generally required for disclosures to life insurers or employers. In addition, the rule contains specific provisions that generally require an individual’s authorization for the use or disclosure of psychotherapy notes or of protected health information for marketing purposes. In many circumstances, a provider or health plan can choose not to disclose information, regardless of whether an individual’s authorization is required. The Privacy Rule allows covered entities to use their discretion in deciding whether to disclose protected health information for many types of disclosures, such as those to family and friends, public health authorities, and health researchers. The Privacy Rule provides individuals with a number of rights regarding access to, and use of, their health information. Specifically, the rule provides the following: Access to and amendment of health information. Individuals have the right to inspect and copy their protected health information and to request amendments of their records. Notice of privacy practices. Individuals generally have a right to written notice of the uses and disclosures of their health information that may be made by a covered entity as well as the individual’s rights and the entity’s duties with respect to that information. Accounting for disclosures. Individuals generally have the right to request and receive a listing of disclosures of their protected health information that is shared with others for purposes other than treatment, payment, or health care operations. Complaints. In addition to being able to complain directly to a covered entity, any person who believes a health care provider, health plan, or clearinghouse is not complying with the Privacy Rule may file a complaint with the Secretary of HHS. Covered entities are required to comply with Privacy Rule provisions and follow various procedures. They must do the following: Develop policies and procedures for protecting health information. A covered entity must maintain administrative, technical, and physical safeguards. Among other requirements, a covered entity must also designate a privacy official, train its employees on the entity’s privacy policies, and develop procedures to receive and address complaints. Limit information used and disclosed to the minimum necessary. Covered entities must make reasonable efforts to limit their employees’ access to identifiable health information to the minimum needed to do their jobs. When sharing protected health information with other entities (such as collection agencies and researchers), they must make reasonable efforts to limit the information disclosed to the minimum necessary to accomplish the purpose of the data request. However, providers may share the full medical record when the disclosure is for treatment purposes. Account for disclosures of protected health information. Upon request, covered entities must provide individuals with an accounting of disclosures of their protected health information made in the preceding 6 years. This requirement applies to most disclosures other than those for treatment, payment, or operations purposes, including those that are mandated by lawsuch as certain disclosures to public health entities and law enforcement agencies. The accounting must include the date of each disclosure; the name and, if known, the address of the entity or person who received the information; a description of the information disclosed; and a statement of the purpose of the disclosure. Ensure that “downstream users” protect the privacy of health information by implementing business associate agreements. Covered entities must enter into a contract or other written agreement with any business associates with which they share protected health information for various purposes. A business associate performs certain functions or activities—such as claims processing and benefit management—on behalf of a covered entity involving the use or disclosure of individually identifiable health information. Business associate contracts must establish conditions and safeguards for uses and disclosures of identifiable health information and authorize termination of contracts if the covered entities determine that business associates have violated the agreements. The regulation establishes requirements that apply to both federally and privately funded research that seeks to use protected health information: Researchers may seek to obtain from covered entities health information without authorization if the data do not identify an individual and there is no reasonable basis to believe it could be used to identify an individual. Researchers must use one of three options to gain access to protected health information: obtain patient authorization, obtain a waiver of authorization by having their research protocol reviewed and approved by an IRB or privacy board, or use a limited data set provided by the covered entity. OCR has responsibility for implementing and enforcing the Privacy Rule as follows: Provide guidance. OCR is responsible for communicating policies contained in the Privacy Rule by issuing guidance to answer common questions and clarify certain provisions. Mechanisms by which OCR makes information available to various entities on its Web site include links to guidance documents as well as answers to frequently asked questions (FAQ). In addition, OCR has provided guidance through roundtable discussions, answers to written inquiries, an automated e- mail notification system, a toll-free hotline for questions about the Privacy Rule, as well as presentations and telephone conference calls. Administer a complaint process. OCR is responsible for investigating complaints received from health care consumers. Enforce compliance. OCR may provide covered entities with technical assistance to help them comply voluntarily with the Privacy Rule. OCR investigates complaints and may conduct reviews to determine if covered entities are in compliance and attempts to resolve issues of noncompliance through informal means. Violators are subject to civil and criminal penalties. OCR administers the civil monetary penalties while the Department of Justice administers criminal penalties involving a knowing disclosure or obtaining identifiable health information in violation of HIPAA. Organizations representing providers and health plans stated that implementation of the Privacy Rule was smoother than expected over the past year and that some initial confusion has abated. Although many provider and health plan organizations reported dealing with various ongoing problems, they noted that two provisions were particularly burdensome: the requirement to maintain a record of certain disclosures of patient information and the requirement to create business associate agreements with downstream users of protected health information. Several organizations suggested that OCR could take steps to facilitate compliance with these provisions. Some organizations we interviewed told us that the first year they were required to be compliant with the Privacy Rule was smoother than they had anticipated. The American Medical Association and the American Hospital Association stated that in general, they have heard relatively few negative reactions from their members during the past year. Many provisions were considered straightforward and relatively easy to implement, including developing the notice of privacy practices and limiting disclosures for marketing purposes. In addition, many provider, health plan, and consumer representatives reported that the Privacy Rule has increased provider awareness of, and sensitivity to, patient privacy issues, and new privacy procedures have become routine practice. For example, representatives from the American Health Information Management Association (AHIMA)—which assists providers with their management of protected health information—noted that the Privacy Rule has helped to make staff working for covered entities more aware of the flow of patient information. Organizations we interviewed also reported that some early confusion has subsided. Groups commented that initial confusion stemmed from challenges in understanding and implementing the Privacy Rule. The American Hospital Association, for example, stated that hospitals were initially concerned about the requirement to limit information disclosures to the “minimum necessary” but now understand that they can share the information needed to ensure that appropriate clinical care is provided to their patients. Representatives from the American Pharmacists’ Association (APhA) stated that members faced initial confusion implementing the Privacy Rule, but that pharmacies have since developed new standard procedures to address these issues. Representatives of the American Medical Association noted that after receiving and resolving many calls requesting clarification early in the year, it has since received few calls from its members related to the Privacy Rule. However, organizations also commented that some uncertainties and misunderstandings continue. For example, provider groups stated that some physicians and hospitals remain unclear about what type of information may be disclosed for law enforcement purposes. In addition, health plan representatives reported ongoing difficulties associated with knowing whether state laws prevail over the Privacy Rule. Despite these problems, AHIMA representatives told us that “the number of people talking about the ship sinking” because of the Privacy Rule has decreased. Overall, the organizations had mixed opinions about the extent to which OCR’s guidance facilitated implementation of the Privacy Rule. As of June 29, 2004, OCR has posted 223 FAQs and answers on its Web site. While some provider and health plan representatives reported that the OCR Web site—particularly the FAQs—was very helpful, others stated that the FAQs were not specific enough to explain certain vague or ambiguous Privacy Rule provisions. Furthermore, organizations we interviewed stated that various types of guidance offered by OCRincluding roundtable discussions and guidance on particular provisions—would have been more helpful if they had been offered sooner.