Review of HIPAA, Part 1: History, Protected Health Information, and Privacy and Security Rules

HISTORY

In 1996, the federal government passed a law that created national standards to protect the confidentiality of medical records. HIPAA can be found at title 45 of Code of Federal Regulations parts 160–164. The law was passed by Congress and signed by President Bill Clinton on August 21, 1996, with the primary intent of ensuring portability and continuity of health insurance coverage for millions of Americans; however, HIPAA entails more than portability, privacy, and security. HIPAA consists of 5 sections, called titles, in title 45 of Code of Federal Regulations part 164, and the regulations are complex and voluminous.

THE 5 HIPAA TITLES

Title I provides the ability to transfer and continue health-care coverage for American workers and their families who change or lose their jobs; it also limits the ability to deny health plan coverage due to preexisting conditions (3). Title II has an administrative simplification provision requiring that the U.S. Department of Health and Human Services (DHHS) establish national standards for electronic health-care transactions and national identifiers for providers, health plans, and employers; it also addresses the security and privacy of health data and helps prevent health-care fraud and abuse (3). Title III provides changes to health insurance laws and deductions for medical insurance, as well as guidelines for pretax medical spending accounts (3). Title IV specifies conditions for group health plans regarding coverage of persons with preexisting conditions and modifies the continuation-of-coverage requirements (3). Title V includes provisions related to company-owned life insurance and to the treatment of individuals without U.S. citizenship (3).

Health-care professionals are most familiar with the HIPAA title that addresses the protection of the privacy and security of patients’ medical records. After all, this is the part of HIPAA on which health-care professionals receive periodic training. Before the introduction of HIPAA, multiple federal rules and regulations addressed privacy in various forms, but these rules and regulations lacked clarity and consistency (1). State and federal requirements differed, and there was confusion as to which regulations were applicable in which situations. Congress recognized the need, on a national level, for privacy and security standards as the use of electronic technology surged. Patients’ health data needed to be readily accessible to doctors, nurses, technicians, pharmacies, billing and coding companies, and administrative staff. There was a growing need to modernize the flow of medical data to facilitate and expedite access to health records (1).

The responsibility for implementing the new regulations that would help maintain the safety of health records was deferred to the DHHS, which established a schedule for this implementation (4). These rules and standards apply to covered entities, which DHHS defines as health-care providers, health plans, and health-care clearinghouses and business associates (5). Creating and enacting these general rules took time because private and government systems needed to be upgraded, policies and procedures had to be reviewed for adequacy and applicability, and personnel needed to be trained. Initially, HIPAA was met with skepticism and confusion (1,6). Lawmakers and health-care professionals wondered about its cost-effectiveness, how meaningful the protections would be, and how these rules could interfere with efficient patient care (6).

NEW RULES

Although HIPAA was signed into law in 1996, it was not until 2003 that HIPAA was fully implemented. By that time, the need for enforcement standards and additional rules addressing specific privacy issues had been identified (4). HIPAA grew in prominence after the enactment of the HITECH Act in 2009 (7). The goal of the HITECH Act was to support the nationwide implementation of electronic health records to provide integrated medical data and information to providers as well as patients. HITECH offered incentive programs that helped to encourage the adoption of electronic health records by hospitals and other providers while also penalizing those who were eligible for the incentives but chose not to implement them (7,8). Additionally, HITECH significantly increased monetary penalties for HIPAA violations (1).

The surge in medical records collected, archived, and transmitted electronically led to unprecedented challenges regarding patient privacy. As a response to these challenges, DHHS developed changes to HIPAA that addressed subsequent standards and rules. The omnibus final rule was enacted on January 25, 2013, and expanded covered entities to include business associates, which consist of auditors, consultants, information technology companies, and others with whom facilities have agreements involving the use of protected health information (PHI) (4,5). HIPAA requires that updated agreements be executed and maintained between the practice and all business associates (4). A business associate agreement is a contract that defines how the associates adhere to HIPAA along with the responsibilities and risks they accept. Because of the omnibus rules, both covered entities and business associates are subject to the full civil and criminal penalties for violations of the laws (1,4). The omnibus rule is intended to strengthen the privacy and security safeguards of patient data. The enactment of these new rules significantly reduced the number of privacy breaches among business associates (7).

PHI

PHI includes all information that could be used to identify an individual. Any part of a person’s medical record and payment history is considered PHI and may not be shared with unauthorized personnel. PHI is used within a medical facility and includes verbal and written communications. PHI can be found in computer files, paper medical records, information from insurance companies, information from the provider, and information from legal offices (9). Name, address, date of birth, phone number, social security number, medical record number, medical history, photographs, charts, health plan beneficiary numbers, license numbers, vehicle identifiers, internet protocol addresses, biometric identifiers (such as retina, voice, and fingerprints), and test results are all considered PHI (10). Physicians’ and nurses’ notes, billing records, and other treatment records are also included. Medical images are also considered PHI (11).

Medical images exist in DICOM format, which combines sets of images with patient information and a description of the radiology modality. Under HIPAA, this type of DICOM data must also be protected and secured (11).

NEED-TO-KNOW BASIS

Health-care providers have the ethical and legal obligation to maintain the confidentiality of patients’ PHI. It is also a responsibility to ensure that patient information is disclosed only to individuals or companies with a legal right to have it. Health-care professionals should use patient data only to perform specific job tasks and nothing more—that is, health-care professionals must use the minimum necessary information to accomplish the purpose of the request (3). When there is not a specific rule to follow in a situation or a question arises, one should also rely on personal ethics and use the best judgement in deciding whether to disclose PHI.

PRIVACY RULE

In the context of PHI, the term privacy refers to the obligation of authorized persons using PHI to keep such information secret. The privacy rule regulates the use and disclosure of PHI and sets the minimum national standards that every covered entity must follow to protect patients’ private medical information. Under HIPAA guidelines, all PHI about an individual must remain private and confidential. The HIPAA privacy rule applies to health plans (e.g., Anthem, Medicare, and Cigna), health-care clearinghouses (e.g., billing companies), and health-care providers (e.g., hospitals, clinics, and doctor’s offices) and their business associates (e.g., attorneys and consultants) that conduct health-care transactions. This rule also gives patients the right to request their own radiographic images and a copy of their health records. By law, an individual must receive the requested PHI within 30 d after such a request (3).

EXCEPTIONS TO THE PRIVACY RULE

An entity covered under HIPAA may not disclose PHI unless a patient authorizes its disclosure in writing. However, HIPAA outlines specific circumstances in which disclosure of PHI is allowed in the absence of an individual’s written permission. PHI may be disclosed without authorization under certain circumstances:

• For treatment, payment, or general health-care operations. Providers can also share PHI with billing companies to receive payment for services rendered. PHI can also be used to perform system or compliance quality checks that improve health-care operations (12). Under HIPAA, only 2 types of clinical care information cannot be shared between care providers without the patient’s explicit consent: substance-abuse records from a licensed abuse program and written psychotherapy notes (13,14).

• If the patient can agree to or object to a disclosure. For example, when a patient brings another person into the room with him or her, the patient automatically agrees that that person can hear the PHI (6,15).

• During a natural disaster. For example, some violation penalties were waived during Hurricane Harvey in 2017 after the disaster protocol was implemented in Texas- and Louisiana-area hospitals. The waiver is granted by the U.S. president or a state official and it applies only to hospitals in the disaster area for the emergency period identified in the public health emergency declaration and for up to 72 h after implementation of a hospital’s disaster protocol. The waiver does not apply to all elements of the privacy rule, and these provisions are usually stated in the official waiver (3,12,16).

• For public health activities and purposes, such as preventing or controlling the spread of disease or receiving reports of child abuse or neglect (12).

• If requested to do so by court orders (3,12).

SECURITY RULE

In the context of PHI, security refers to procedures designed to prevent unauthorized persons from accessing PHI. The HIPAA security rule complements the privacy rule and requires entities to implement physical, technical, and administrative safeguards to protect the privacy of PHI.

CONCLUDING RECOMMENDATIONS

Each facility is responsible for using the necessary safeguards to ensure compliance with HIPAA regarding the privacy and security of PHI. Employers should ensure that employees are adequately trained and following HIPAA requirements. HIPAA compliance includes more than just not talking about PHI in an elevator. Make sure business associates can be trusted and have updated business associate agreements. Remember that authorized personnel who handle PHI are responsible for protecting it. Each facility must be committed to developing a culture of HIPAA compliance. Organizations need to ensure a knowledgeable workforce that understands the new HIPAA rules. It is important for employers to be proactive rather than reactive. Part 2 of this series, which will appear in a future issue of this journal, will go further into the HIPAA limitations, patient rights, compliance, violations, and the role that imaging technologists play.

DISCLOSURE

No potential conflict of interest relevant to this article was reported.