What do I have to do to comply with Federal HIPAA Privacy Rules?
HHS HIPAA Summary
Get Instant Individual & Family Quotes including Subsidy Calculation
Open Enrollment till January 15th
Click here for Special Enrollment Opportunities
Federal – HIPAA Privacy (HHS.gov) and Calif. Civil Code provides in a one sentence summation that:
Any [medical] records which contain individually identifiable (PHI) Protected Health Information must be secured, so that they are not readily available to those who do not need them. (HSS Q & A) Thus, the people who can see your medical records is very limited. HHS Summary of HIPAA Privacy Rule (25 Pages) Each covered entity, with certain exceptions, must provide a notice of its privacy practices.
I think if people just followed the 10 Commandments, the 7 Noahide Laws, and the Golden Rule, and be careful about Gossip, we wouldn’t have to have ALL these pages and tons of paperwork.
Consumer Links Summaries and Links
Our page on how to read law – 3 times and when you think you understand it, read it again.
Office for Civil Rights – HIPAA H & HS Website – has a ton of information and links
Our webpage on California Privacy
Privacy wikipedia.org/ wikipedia.org HIPAA harvard.edu privacy Torts Privacy Rights.org ACLU
CA Patients Guide How and why to get your medical records – Center for Democracy & Technology Website Health Privacy . Org HIPPA Myths and Facts Lot’s of Information in Simple to Understand Format
Anti-Phishing Act of 2005 Phony Websites & Email to gather identity theft information
Jewish Thought on Gossip, Tale Bearing JewFAQ.org
Online Education Torah.org
CMS Webinar 56 pages on Privacy
Health Information Privacy hhs.gov/hipaa
Hints on writing the notice in Plain English
Our Quote Engines – Privacy Policy
How to comply – Solutions
Sample business associate agreement
National Association of Health Underwriters – Compliance Guide
Blue Cross’s Privacy Statement
Blue SHIELD Privacy Statement – Release Form
What does the HIPAA Privacy Rule do?
Most health plans and health care providers that are covered by the new Rule must comply with the new requirements by April 14, 2003.
The HIPAA Privacy Rule for the first time creates national standards to protect individuals’ medical records and other personal health information. – It gives patients more control over their health information. – It sets boundaries on the use and release of health records. – It establishes appropriate safeguards that health care providers and others must achieve to protect the privacy of health information. – It holds violators accountable, with civil and criminal penalties that can be imposed if they violate patients’ privacy rights. – And it strikes a balance when public responsibility supports disclosure of some forms of data – for example, to protect public health. For patients – it means being able to make informed choices when seeking care and reimbursement for care based on how personal health information may be used. – It enables patients to find out how their information may be used, and about certain disclosures of their information that have been made. – It generally limits release of information to the minimum reasonably needed for the purpose of the disclosure. – It generally gives patients the right to examine and obtain a copy of their own health records and request corrections. – It empowers individuals to control certain uses and disclosures of their health information.
When is an authorization required from the patient before a provider or health plan engages in marketing to that individual?
The HIPAA Privacy Rule expressly requires an authorization for uses or disclosures of protected health information for ALL marketing communications, except in two circumstances: (1) when the communication occurs in a face-to-face encounter between the covered entity and the individual; or (2) the communication involves a promotional gift of nominal value.
If the marketing communication involves direct or indirect remuneration to the covered entity from a third party, the authorization must state that such remuneration is involved.
Can contractors (business associates) use protected health information for its own marketing purposes?
No. While covered entities may share protected health information with their contractors who meet the definition of “business associates” under the HIPAA Privacy Rule, that definition is limited to contractors that obtain protected health information to perform or assist in the performance of certain health care operations on behalf of covered entities. Thus, business associates, with limited exceptions, cannot use protected health information for their own purposes. Although, under the HIPAA statute, the Privacy Rule cannot govern contractors directly, the Rule does set clear parameters for how covered entities may contract with business associates. See 45 CFR 164.502(e) and 164.504(e), and the definition of “business associate” at 45 CFR 160.103.
Further, the Privacy Rule expressly prohibits health plans and covered health care providers from selling protected health information to third parties for the third party’s own marketing activities, without authorization. So, for example, a pharmacist cannot, without patient authorization, sell a list of patients to a pharmaceutical company, for the pharmaceutical company to market its own products to the individuals on the list.
1st HIPAA Privacy Conviction
Defendant Richard Gibson obtained the demographic information of a cancer patient from his employer, Seattle Cancer Care Alliance. Gibson then used this data to obtain credit cards in the patient’s name, eventually incurring over $9,000 in debt for items such as video games, apparel, and jewelry. (Attorney’s Corwel & Moring)
Plain Language Instructional Video Minnesota DHS Training