Compliance Glossary

HIPAA summary is a brief of the HIPAA frameworks. It talks about how healthcare providers and related entities must process health information and the measures to abide by while transmitting or sharing PHI.

Key topics covered in the HIPAA summary are:

The Privacy Rule (PHI and Key Concepts)

The Privacy Rule governs the use and disclosure of PHI, which includes health-related information, payment details, and individually identifiable information. Identifiers under the Privacy Rule are broadly defined and encompass various personal data.

Note that the Privacy Rule only applies to individually identifiable information, and when in doubt, it’s wise to assume that the Privacy Rule protects all information.

Use and disclosure 

• “Use” refers to using PHI within the entity that maintains it.
• “Disclosure” relates to releasing or providing access to PHI outside the entity.

Minimum necessary information

Individuals should limit access to and use/disclosure of PHI to the minimum amount required to perform their job or intended purpose. Exceptions exist for treatment-related information.

For example:

• A receptionist scheduling appointments should only read part of the patient file.
• A clinic volunteer working on specific patient files must not access the files of other patients.

Protection of PHI

Those working in healthcare entities must safeguard PHI. This involves securing records, promptly removing documents from fax machines and copiers, and preventing unauthorized access.

Patient’s right to object

Patients have the right to object to using or disclosing their PHI in specific instances, such as including inpatient directories or sharing information with individuals involved in their care.

Uses and disclosures not requiring patient permission

Certain routine uses and disclosures of PHI don’t need patient authorization. These include 

Examples:

• Treatment-related use of patient information
• Billing coordination with health insurance
• Quality assurance and peer review activities

Other disclosures

The Privacy Rule also permits disclosures without patient permission for public health activities when required by law and for employment or worker’s compensation purposes.