🩺 Stuff Every Healthcare Worker Should Know: Training Guide

Protected Health Information

Protected health information, called PHI, is identifiable health information. It can be spoken, written on paper, or kept in electronic form. It covers a patient's past, present, and future health care and payment.

Some health information is not PHI under HIPAA. A covered entity's employment records held in its role as employer are excluded. Education records covered by FERPA are also excluded from the definition.

HIPAA keeps protecting a deceased person's health information for 50 years after death. After that, the information no longer counts as PHI.

Who Must Follow HIPAA

Three kinds of organizations are covered entities under HIPAA: health plans, health care clearinghouses, and health care providers who send health information electronically in standard transactions. Most doctors and hospitals that bill electronically qualify.

A covered entity's workforce includes employees, volunteers, and trainees under its direct control, whether paid or unpaid. Every workforce member must be trained on privacy policies.

Every covered entity must designate a privacy official to develop and carry out privacy rules. It must also name a contact person to receive complaints. The privacy official and contact person can be the same person.

Business Associates

A business associate is an outside person or company that handles PHI on a covered entity's behalf. Billing companies, claims processors, and outside legal or accounting firms can be business associates.

A covered entity must have a written business associate agreement before sharing PHI with an outside company for services. The agreement must state how the business associate may use and disclose PHI.

When a business associate contract ends, the business associate must return or destroy all PHI it still holds, if feasible. If return or destruction is not feasible, the contract's protections keep applying.

A business associate must get written assurances from any subcontractor that will handle PHI. The covered entity does not have to sign directly with its business associate's subcontractor.

Sharing PHI with another provider for a patient's treatment does not make that provider a business associate. Treatment includes consultations between providers and referrals.

Routine Uses Without Authorization

Minimum necessary means workers should see only the PHI needed for their task. A billing clerk needs an insurance ID, not the whole chart.

Minimum necessary does not apply when providers share PHI for treatment. Care teams need the full picture to treat safely.

HIPAA permits covered entities to use or disclose PHI for treatment, payment, and health care operations without a signed authorization. Consent may be requested but cannot replace an authorization when one is required.

Payment includes billing, claims, collections, and checking eligibility or coverage. A hospital sending a claim to an insurer is making a payment use.

Health care operations include quality improvement, reviewing staff performance, and supervised training programs. Using real charts to review nurse performance is health care operations, not research.

Involving Family, Friends, and the Directory

If a capable patient is present, staff may share relevant information with a friend after giving the patient a chance to object or reasonably inferring no objection. Share only what is relevant to that person's involvement.

Staff may use professional judgment and common practice to let someone else pick up filled prescriptions, supplies, or X-rays for a patient. In an emergency when the patient cannot decide, staff may share relevant information if it is in the patient's best interest.

A facility directory may include a patient's name, location, general condition, and religion. Anyone asking by name may learn name, location, and general condition, but religious affiliation may go only to clergy. Patients must be told about the directory and given the chance to limit or opt out of it.

Everyday Privacy Practices

Providers with a direct treatment relationship must give the Notice of Privacy Practices no later than the first service delivery. In an emergency, they give it as soon as reasonably practicable after the emergency.

HIPAA requires disclosure of PHI in only two situations: to the patient, and to HHS for compliance reviews. Most other disclosures are permitted, not required.

Workers may not look up a neighbor's chart out of curiosity. Snooping is an impermissible use even if nothing is shared, and organizations must discipline workers who break the rule.

Staff should use reasonable safeguards in public areas. Speak quietly and avoid using patients' names in hallways and elevators. HIPAA does not require removing every chance of being overheard, only reasonable safeguards.

Before faxing PHI, double-check the number and use a cover sheet. If a fax goes to the wrong place, report it right away so it can be assessed.

Psychotherapy Notes

Psychotherapy notes get extra protection under HIPAA. Almost any use or disclosure of psychotherapy notes needs the patient's authorization, with narrow exceptions like the note writer using them for treatment.

Psychotherapy notes are a mental health professional's notes about counseling session conversations. Prescriptions, session times, test results, diagnoses, and treatment plans are not part of psychotherapy notes.

Psychotherapy notes are also left out of a patient's HIPAA right of access. A patient generally cannot use HIPAA access rights to get a copy of them.

Marketing and Selling PHI

A drug company paying a clinic to mail patients ads for a new product is marketing. The clinic needs each patient's written authorization, and the authorization must say a third party is paying.

A pharmacy's refill reminder about a drug the patient is currently prescribed is not marketing. This is true as long as any payment the pharmacy gets is reasonably related to its cost of sending the reminder.

Disclosing PHI in exchange for payment is a sale of PHI. A sale requires each patient's authorization, and the authorization must say the covered entity will be paid.

Posting a patient's photo or story on social media is a disclosure of PHI. Without a valid signed authorization, it is not allowed. Blurring a face does not remove other details that can identify someone.

Authorization Rules

A patient may revoke a signed authorization at any time in writing. Revoking does not undo what the covered entity already did while relying on it. Every valid authorization must include an expiration date or expiration event.

A covered entity generally may not make treatment, payment, enrollment, or benefits depend on signing an authorization. A provider cannot refuse to treat a patient who will not sign a marketing authorization.

A covered entity generally cannot combine an authorization with other documents into one compound form. Narrow exceptions apply, such as certain research authorizations.

Access to Records

A covered entity must generally act on a patient's request for copies within 30 days. It may extend once by up to 30 more days with a written reason and a new date. Denials must be in writing.

If records are kept electronically and the patient asks for an electronic copy, the entity must provide the requested electronic form if readily producible. If not, another readable electronic form the patient agrees to is acceptable. The right lasts as long as the records are kept.

A provider may charge a reasonable, cost-based fee for copying labor, supplies, and postage. Searching for and retrieving records is not on the fee list. A patient may get a summary instead of a full copy if they agree to it and any fee in advance.

Amendments and Accounting

A covered entity must act on a request to amend a record within 60 days. It may extend by up to 30 more days if it explains the delay in writing. An amendment may be denied if the record is already accurate and complete.

If an amendment request is denied, the patient may submit a written statement of disagreement. That statement gets linked to the disputed record and can travel with future disclosures. The covered entity may write a rebuttal, but it must give the patient a copy.

Patients may ask for an accounting of certain disclosures made in the six years before the request. Routine treatment, payment, and health care operations disclosures are left out. Disclosures the patient authorized are also left out.

The first accounting in any 12-month period is free. More requests in that period may receive a reasonable cost-based fee if the patient is told first. The accounting must be provided within 60 days, with one possible 30-day extension.

Restrictions, Contacts, and Representatives

Covered entities usually do not have to agree to restriction requests. They must agree not to tell a health plan about an item or service paid in full out of pocket, unless law requires it. Even an agreed restriction can be set aside to give emergency treatment.

Providers must accommodate reasonable requests to receive communications by other means or at other places. A provider may ask for the request in writing but cannot demand a reason. Health plans must accommodate these requests when the person says disclosure could endanger them.

A parent, guardian, or person acting in loco parentis with legal authority is generally treated as the minor child's personal representative. If a minor may lawfully consent to a service alone, the parent may not be the personal representative for that service.

For a deceased patient, a person with legal authority to act for the deceased person or estate, such as an executor or administrator, is the personal representative. Their rights cover only the PHI relevant to that role.

A provider may decline to treat someone as a personal representative if staff reasonably believe that person has abused or may endanger the patient. This is allowed when staff judge it is not in the patient's best interest.

Two De-identification Methods

Under Safe Harbor, remove all 18 listed identifiers from health data. You must also have no actual knowledge that the remaining data could identify someone. If you meet the standard, the data is no longer individually identifiable.

Under expert determination, a person skilled in statistical methods finds that the risk of identifying anyone is very small. The expert must document the methods and results. A covered entity may keep a secret code to re-identify the data later, but the code must not be built from patient information.

Data that meets either de-identification method is no longer individually identifiable. The Privacy Rule no longer applies to it.

Safe Harbor Geographic, Date, and Age Rules

Remove all places smaller than a state. The first three ZIP digits may stay only if all ZIP codes sharing them hold more than 20,000 people. Street address, city, and county must go, but the state can stay.

Remove every part of a date tied to a person, except the year. That covers birth, admission, discharge, and death dates. A record that says only 2024 passes, but March 2024 does not.

Ages 89 and under are safe to keep. For ages over 89, group them as 90 or older. The birth year also must go for those older than 89.

Identifiers and Relatives

Biometric identifiers, including voice prints and finger prints, must be removed. Full face photos and comparable images are also on the list. Blood type and diagnosis codes are health facts, not identifiers, so they can stay after identifiers are gone.

Removing the patient's own name is not enough. The 18 identifiers must also be removed for the patient's relatives, employers, and household members because they could point back to the patient. Device serial numbers and web addresses are also on the remove list.

Security Rule Basics

Electronic protected health information, or ePHI, is PHI transmitted or maintained in electronic media. It includes records in an EHR, emails, and files on a laptop. Paper records are handled under the Privacy Rule.

The Security Rule applies to covered entities and business associates with respect to ePHI. Business associates are directly responsible for following the Security Rule.

The Security Rule groups safeguards into administrative, physical, and technical categories. Administrative safeguards are management actions, policies, and procedures. Physical safeguards protect systems and buildings. Technical safeguards use technology and policies to protect ePHI and control access.

Managing Security and Recovery

Before choosing safeguards, an organization must perform a risk analysis of potential risks and vulnerabilities to ePHI. After that, risk management means reducing risks to a reasonable and appropriate level. Risk analysis is not a one-time task and should be updated when systems change.

The Security Rule requires a designated security official to develop and implement security policies. All workforce members, including management, must receive security training. Sanctions must apply to workforce members who fail to follow security policies.

Security awareness training includes periodic security reminders, password management, malware and phishing procedures, and login monitoring. Organizations must also respond to and report security incidents.

A contingency plan covers emergencies that damage systems containing ePHI. It includes data backup, disaster recovery, and emergency mode operation plans. Testing and revision procedures are addressable and should happen periodically.

Technical and Physical Safeguards

Physical safeguards include a facility security plan, workstation use policies, and restricted physical access. Electronic media holding ePHI must be disposed of securely and cleared before reuse. Movement of hardware and media should be tracked through accountability records.

Unique user IDs and emergency access procedures are required technical safeguards. Automatic logoff and stored-data encryption are addressable, meaning the organization must assess whether they are reasonable and implement them or document an equivalent. Audit controls are required and must record and examine activity in systems that contain ePHI.

Integrity and authentication protections help prove ePHI was not altered. Person authentication is required before someone accesses ePHI. Integrity controls and encryption for ePHI sent over a network are addressable.

Paper PHI disposal follows the Privacy Rule. Phones that store ePHI follow device and media controls. Security documentation must be kept for 6 years. Addressable means assess the item, implement it if reasonable, or document why not and implement an equivalent if reasonable.

Breaches, Penalties, and Complaints

A breach is a disallowed use or disclosure that compromises PHI. Lost encrypted data is not unsecured PHI. A worker's accidental, good-faith look at PHI within their job is not a breach if it goes no further.

An impermissible use or disclosure is presumed to be a breach. It remains a breach unless a risk assessment of at least four factors shows a low probability the PHI was compromised. The first factor is the nature and extent of the PHI involved.

Individuals must be notified without unreasonable delay and no later than 60 days after discovery of a breach. A breach is discovered on the first day the organization knew, or with reasonable diligence would have known. Knowledge of the person who committed the breach does not count.

A breach affecting more than 500 residents of a state requires notice to HHS and prominent media outlets in that state. Breaches affecting fewer than 500 people are logged and reported to HHS yearly. Substitute notice is used when contact information is missing for 10 or more people.

Properly encrypted PHI is a safe harbor from breach notification. A breach letter must describe what happened, what PHI was involved, steps patients can take, what the organization is doing, and how to contact it.

HIPAA civil penalties have four tiers, with the highest for willful neglect not corrected within 30 days. Criminal violations can lead to up to 10 years in prison for knowingly selling or harming. File privacy complaints with the HHS Office for Civil Rights within 180 days.

Report suspected breaches right away to the privacy officer. Employers may not retaliate against someone for filing a HIPAA complaint. Do not click suspicious links in emails; report them to IT or security.