HIPAA Competency Test

The Privacy Rule gives you, with few exceptions, the right to inspect, review, and receive a copy of your medical records and billing records that are held by health plans and health care providers covered by the Privacy Rule.
Only you or your personal representative has the right to access your records.

The Privacy Rule gives you, with few exceptions, the right to inspect, review, and receive a copy of your medical records and billing records that are held by health plans and health care providers covered by the Privacy Rule.

Covered entities are not permitted to simply abandon PHI or dispose of it in dumpsters or other containers that are accessible by the public or other unauthorized persons. •For PHI in paper records, shredding, burning, pulping, or pulverizing the records so that PHI is rendered essentially unreadable, indecipherable, and otherwise cannot be reconstructed.

In the final Omnibus rule, Individual rights are expanded in important ways. Patients can ask for a copy of their electronic medical record in an electronic form. When individuals pay by cash they can instruct their provider not to share information about their treatment with their health plan. The final omnibus rule sets new limits on how information is used and disclosed for marketing and fundraising purposes and prohibits the sale of an individuals’ health information without their permission.

PHI stands for Protected Health Information.

If the patient feels their rights are being denied or the health information isn't being protected, they can file a complain with the provider and also with HHS, OCR division.

Under HIPAA, patients have the following rights:
Notice of Privacy Practices.
Right to Access.
Right to Accounting of Disclosures.
Right to Amendment.
Right to Request Confidential Communications.
Right to Restrictions. Information on your right to restrict certain disclosures of your health information.
Right to Restrict Disclosure to Health Plan. Information on your right to request restrictions on disclosure of your health information when you paid for service out-of-pocket in full.
Right to Complain for Privacy Rights Violations.
Using and Disclosing Your Health Information.

Offenses committed with the intent to sell, transfer, or use individually identifiable health information for commercial advantage, personal gain or malicious harm permit fines of $250,000, and imprisonment for up to ten years.

The HIPAA Privacy Rule protects most “individually identifiable health information” held or transmitted by a covered entity or its business associate, in any form or medium, whether electronic, on paper, or oral.

You are not allowed to release PHI without a signed HIPAA compliant authorization from the patient. Releasing the records without the proper authorization is grounds for immediate disciplinary action and may result in civil and criminal penalties.

The HIPAA Privacy Rule protects most “individually identifiable health information” held or transmitted by a covered entity or its business associate, in any form or medium, whether electronic, on paper, or oral. The Privacy Rule calls this information protected health information (PHI)2.

Definition of Breach. A breach is, generally, an impermissible use or disclosure under the Privacy Rule that compromises the security or privacy of the protected health information.

Three of the examples describe uses of information related to TPO (Treatment, Payment, Operations) and do not require a written authorization. For the most part, any other uses beyond TPO will need a written authorization.

Viewing a medical record for the sake of curiosity is not allowed under HIPAA. Only those healthcare providers involved in the patient’s care should review the record, as needed for that care.

HIPAA defines “individually identifiable health information” as information that is a subset of health information, including demographic information collected from an individual, and:
1.Is created or received by a health care provider, health plan, employer, or health care clearinghouse; and
2.Relates to the past, present, or future physical or mental health or condition of an individual; the provision of health care to an individual; or the past, present, or future payment for the provision of health care to an individual; and
1.That identifies the individual; or
2.With respect to which there is reasonable basis to believe the information can be used to identify the individual.

Under HIPAA, an authorization must contain the following elements in order to be valid:
1) Authorization is written in plain language.
2) Authorization identifies the name of the patient whose PHI is being disclosed.
3) Authorization identifies the type of information to be disclosed.
4) Authorization identifies the names or classes of persons or types of healthcare providers authorized to make the disclosure.
5) Authorization identifies the names or classes of persons or types of healthcare providers authorized to whom the organization may make the disclosure.
6) Authorization identifies the purpose of the disclosure.
7) Authorization contains the signature of the patient or patient's authorized legal representative.
8) If signed by an authorized legal representative, the authorization identifies the relationship of that person to the patient.
9) Authorization includes the date on which the authorization is signed.
10) Authorization identifies the time period for which the authorization is effective and expiration date or event.
11) Authorization contains a statement informing the individual regarding the right to revoke the authorization in writing and a description how to do so.
12) Authorization contains a statement informing the individual about the organization's ability or inability to condition treatment, payment, enrollment or eligibility for benefits.
13) Authorization contains a statement informing the individual about the potential for information to be redisclosed and no longer protected by the federal privacy rule.
14) Authorization contains a statement that if an organization is seeking the authorization, a copy must be provided to the individual signing the authorization.
15) Authorization contains statement that the individual may inspect or copy the health information disclosed.

A subset of health information that identifies the individual or can reasonably be used to identify the individual; HIPAA protects individually identifiable health information. Common individual identifiers include name, address, and social security number, but may also include date of birth, Zip Code, or county location. If the information is not individually identifiable, such as healthcare research information that only identifies a particular population, not individuals, then it is not protected by HIPAA. In research, this can get complicated, and further inquiry should be made when seeking a determination on a small population. IIHI only becomes PHI when a covered entity creates, receives, or maintains the information.

The “need to know” rule states protected health information should only be used or disclosed as necessary to perform your job duties.

The Privacy Rule permits a covered entity to disclose protected health information about a decedent to a family member, or other person who was involved in the individual’s health care or payment for care prior to the individual’s death, unless doing so is inconsistent with any prior expressed preference of the deceased individual that is known to the covered entity. This may include disclosures to spouses, parents, children, domestic partners, other relatives, or friends of the decedent, provided the information disclosed is limited to that which is relevant to the person’s involvement in the decedent’s care or payment for care.

The respiratory therapy personnel that are doing an ordered procedure is the only example that can receive and use patient information without written authorization because it is covered under TPO (treatment, payment, operations).

The following patients are considered adults regardless of their age for purposes of consenting to medical care and access to their medical care records regardless of the type of care they receive:
◾Married individuals
Since this individual is considered an adult by marriage, he would need to request his own medical records.

In providing access to the individual, a covered entity must provide access to the PHI requested, in whole, or in part (if certain access may be denied as explained below), no later than 30 calendar days from receiving the individual’s request.

The only example that falls under TPO (Treatment, Payment, Operations) is when a colleague needs information about the patient to provide proper care. All other examples need a written authorization to release information.

Consents are used to get the patient’s permission to use or disclose health information for treatment, payment, or business operations. Authorizations are used to obtain permission to disclose PHI for activities outside the realm of treatment, payment, or operations.

HIPAA stands for the Health Insurance Portability and Accountability Act of 1996 (HIPAA).

A covered entity may use and disclose protected health information for its own treatment, payment, and health care operations activities.19 A covered entity also may disclose protected health information for the treatment activities of any health care provider, the payment activities of another covered entity and of any health care provider, or the health care operations of another covered entity involving either quality or competency assurance activities or fraud and abuse detection and compliance activities, if both covered entities have or had a relationship with the individual and the protected health information pertains to the relationship.

Offenses committed with the intent to sell, transfer, or use individually identifiable health information for commercial advantage, personal gain or malicious harm permit fines of $250,000, and imprisonment for up to ten years.

The HIPAA Privacy Rule states the Minimum Necessary Standard applies when using or disclosing protected health information (PHI), or when requesting PHI from others, a covered entity must take reasonable steps to limit uses and disclosures of PHI to "the minimum necessary to accomplish the intended purpose of the use, disclosure, or request."

An incidental use or disclosure is a secondary use or disclosure that cannot reasonably be prevented, is limited in nature, and that occurs as a result of another use or disclosure that is permitted by the Rule.

Unless the step-parent is a legal guardian and the provider has the guardianship papers on file, or a legal guardian has provided authorization. Step-parents may call to schedule appointments, but do not have access to their stepchildren’s PHI without authorization by a legal guardian.

The Privacy Rule requires that an Authorization contain either an expiration date or an expiration event that relates to the individual or the purpose of the use or disclosure. For example, an Authorization may expire "one year from the date the Authorization is signed," "upon the minor’s age of majority," or "upon termination of enrollment in the health plan."

The Omnibus rule states that when individuals pay by cash they can instruct their provider not to share information about their treatment with their health plan.

The Office for Civil Rights (OCR) ensures equal access to certain health and human services and protects the privacy and security of health information.

A subpoena issued by someone other than a judge, such as a court clerk or an attorney in a case, is different from a court order.

A HIPAA-covered provider or plan may disclose information to a party issuing a subpoena only if the notification requirements of the Privacy Rule are met. Before responding to the subpoena, the provider or plan should receive evidence that there were reasonable efforts to:
•Notify the person who is the subject of the information about the request, so the person has a chance to object to the disclosure, or
•Seek a qualified protective order for the information from the court.

A breach is treated as discovered:
On first day the breach is known to the covered entity, or
In the exercise of reasonable diligence, it should have been known to the covered entity.
Notification time period for a breach begins when the organization did or should have known it existed

All of these examples fall under the category of TPO (Treatment, Payment, Operations) and would not require written authorization.

As defined by the Health Information Portability and Accountability Act (HIPAA), a business associate is any organization or person working in association with or providing services to a covered entity who handles or discloses Personal Health Information (PHI) or Personal Health Records (PHR).

Check your current state guidelines. According to Missouri:
Unless a parent has been denied custody rights pursuant to this section or visitation rights under section 452.400, both parents shall have access to records and information pertaining to a minor child, including, but not limited to, medical, dental, and school records. If the parent without custody has been granted restricted or supervised visitation because the court has found that the parent with custody or the child has been the victim of domestic violence, as defined in section 455.200, RSMo, by the parent without custody, the court may order that the reports and records made available pursuant to this subsection not include the address of the parent with custody or the child. Unless a parent has been denied custody rights pursuant to this section or visitation rights under section 452.400, any judgment of dissolution or other applicable court order shall specifically allow both parents access to such records and reports.

Please always check individual state guidelines!
Missouri law permits, but does not require, healthcare providers to inform a parent or guardian if their minor child has been
diagnosed with or treated for pregnancy, STD, or drug or alcohol abuse. Such disclosure should only be made when doing so is consistent with the confidentiality policies of the practice setting and with professional ethical guidelines, and when it is in the minor’s best interest. The law does not permit healthcare providers to disclose any information if the minor patient is found not to be pregnant, afflicted with an STD, or suffering from drug or alcohol abuse.

The HIPAA Privacy Rule gives individuals a fundamental new right to be informed of the privacy practices of their health plans and of most of their health care providers, as well as to be informed of their privacy rights with respect to their personal health information.

Accounting of Disclosures Does Not Include Disclosures For:
Treatment (to persons involved in the individual’s care), payment or health care operations.
Individual subject of PHI.
Incident to an otherwise permitted disclosure.
Disclosure based on individual’s signed authorization.
For facility directory.
For national security or intelligence purposes.
To correctional facilities or law enforcement on behalf of inmates.
As part of a limited data set (see 45 CFR s. 164.514).

An individual that has been given a health care power of attorney will have the right to access the medical records of the individual related to such representation to the extent permitted by the HIPAA Privacy Rule at 45 CFR 164.524.

The HIPAA Privacy Rule recognizes that a deceased individual’s protected health information may be relevant to a family member’s health care. The Rule provides two ways for a surviving family member to obtain the protected health information of a deceased relative.

First, disclosures of protected health information for treatment purposes—even the treatment of another individual—do not require an authorization; thus, a covered entity may disclose a decedent’s protected health information, without authorization, to the health care provider who is treating the surviving relative.

Second, a covered entity must treat a deceased individual’s legally authorized executor or administrator, or a person who is otherwise legally authorized to act on the behalf of the deceased individual or his estate, as a personal representative with respect to protected health information relevant to such representation.

Covered entities that experience a breach affecting more than 500 residents of a State or jurisdiction are, in addition to notifying the affected individuals, required to provide notice to prominent media outlets serving the State or jurisdiction.

•“Payment” encompasses the various activities of health care providers to obtain payment or be reimbursed for their services and of a health plan to obtain premiums, to fulfill their coverage responsibilities and provide benefits under the plan, and to obtain or provide reimbursement for the provision of health care.

This includes providers such as:
•Doctors
•Clinics
•Psychologists
•Dentists
•Chiropractors
•Nursing Homes
•Pharmacies

...but only if they transmit any information in an electronic form in connection with a transaction for which HHS has adopted a standard.

Disclosures Without Individual Authorization. The Privacy Rule permits covered entities to disclose protected health information to workers’ compensation insurers, State administrators, employers, and other persons or entities involved in workers’ compensation systems, without the individual’s authorization:
•As authorized by and to the extent necessary to comply with laws relating to workers’ compensation or similar programs established by law that provide benefits for work-related injuries or illness without regard to fault. This includes programs established by the Black Lung Benefits Act, the Federal Employees’ Compensation Act, the Longshore and Harbor Workers’ Compensation Act, and the Energy Employees’ Occupational Illness Compensation Program Act. See 45 CFR 164.512(l).
•To the extent the disclosure is required by State or other law. The disclosure must comply with and be limited to what the law requires. See 45 CFR 164.512(a).
•For purposes of obtaining payment for any health care provided to the injured or ill worker. See 45 CFR 164.502(a)(1)(ii) and the definition of “payment” at 45 CFR 164.501.

Individual may request accounting of disclosures as far back as six years before the time of the request.

Under HIPAA, the patient has a right to request an amendment to the medical record, but the hospital doesn't have to comply. They have an obligation to review the request for amendment and consider it but are under no obligation to comply.

The monetary penalties for violating HIPAA are broken into a tier system as follows:
1. Covered entity or individual did not know (and by exercising reasonable diligence would not have known) the act was a HIPAA violation.
$100-$50,000 for each violation, up to a maximum of $1.5 million for identical provisions during a calendar year

2. The HIPAA violation had a reasonable cause and was not due to willful neglect.
$1,000-$50,000 for each violation, up to a maximum of $1.5 million for identical provisions during a calendar year

3. The HIPAA violation was due to willful neglect but the violation was corrected within the required time period.
$10,000-$50,000 for each violation, up to a maximum of $1.5 million for identical provisions during a calendar year

4. The HIPAA violation was due to willful neglect and was not corrected.
$50,000 or more for each violation, up to a maximum of $1.5 million for identical provisions during a calendar year