Opinion ID: 3066860
Heading Depth: 3
Heading Rank: 3

Heading: “Health Care Operations”

Text: An additional HIPAA provision that the trial court found applicable is the exemption which permits a “covered entity” to “use or disclose protected health care information for its own treatment, payment, or health care operations.” 45 C.F.R. § 164.506(c)(1) (2014) (emphasis added). Because “health care operations” are defined to include “[c]onducting quality assessment,” “auditing functions, including . . . abuse detection and compliance programs,” and “[r]esolution of internal grievances,” the trial court ruled that the advocacy and auditing services provided by Legal Aid are part of the hospitals’ covered health care operations. See 45 C.F.R. § 164.501 (2014). 19 Once again, the trial court has deemed a HIPAA exemption to apply based on a flawed interpretation of the subject definition. Reading from the bottom up, the trial court simply concludes that because auditing and compliance functions are part of “health care operations,” then the services performed by Legal Aid must necessarily be covered by this exemption. What the trial court overlooks is the critical distinction, similar to the limitation imposed on a “business associate,” that these services, by definition, are those that are performed at the direction of or on behalf of the facility as part of its own internal operating procedures. “[H]ealth care operations are the listed activities undertaken by the covered entity that maintains the protected health information.” 65 Fed. Reg. 82462-01, 82490 (emphasis supplied). The auditing and compliance functions performed by an independent entity such as Legal Aid–an entity charged by law to uncover violations of patient rights by the facilities rather than to assist a facility with the management of its operations–do not fall within the meaning of “health care operations” as that term is defined by HIPAA. See 45