Overview of the HIPAA Final Privacy Regulations
The Health Insurance Portability and Accountability Act (HIPAA) of 1996 is a broad federal law, only part of which is intended to protect the privacy of health care information. HIPAA required Congress to enact a health information privacy law by August 1999 and stated that if it did not act by then (as it did not), then the U.S. Department of Health and Human Services (DHHS) must develop privacy regulations. DHHS proposed regulations in November 1999, and following a public comment period in which it received more than 52,000 comments, published a final rule at the end of December 2000.
In January 2001, the Bush Administration put the Privacy Rule on hold and, in February, reopened it for public comment. President Bush then lifted the hold, indicating that changes would follow in response to the comments, but confirming the rule’s effective date of April 14, 2001. The rule requires compliance by April 14, 2003 (two years after the effective date).
Notably, DHHS proposed many changes to the rule in March 2002, and after further public comment, published a “new” final version on August 14, 2002. Despite the recent changes, the compliance deadline remains April 14, 2003.
II. Why Was the Rule Issued?
The intent of the rule is to protect the privacy of individuals’ health care information. It creates a federal “floor” of protection so that every person in this country has at least the same basic rights and protections, though some may have additional rights depending on state law.
III. Whom Does the Rule Cover?
A. Covered Entities
The Privacy Rule directly regulates three types of “covered entities”: health care providers (including individuals and organizations), health plans (including insurers and other payors), and health care clearinghouses (entities, such as billing services, that process health information from nonstandard into standard forms or vice versa). Most components of and individuals within Partners HealthCare System, Inc. (“Partners”) are health care providers; however, Partners itself and Partners Community HealthCare, Inc. (“PCHI”) are considered clearinghouses because of certain billing-related functions they perform.
Importantly for Partners, the Privacy Rule allows separate covered entities that are under common ownership or control to designate themselves as one covered entity. Partners has elected this option, and therefore Partners, PCHI, and affiliated hospitals and providers are considered to be one affiliated covered entity. This option offers valuable efficiencies (such as use of common forms and policies, and easier sharing of health information for treatment and other purposes within the system). Significant coordination, however, is needed for compliance.
B. Business Associates
While the Privacy Rule covers only the aforementioned three entities, it expands the reach of its protections by requiring that covered entities obtain written confidentiality assurances from their business associates. Business associates are defined as individuals or entities outside of the Partners system that receive, create, or have access to individually identifiable health information and (1) perform a service on behalf of Partners or its affiliates, or (2) fit within the list of specific service providers (i.e., outside legal, actuarial, accounting, consulting, management, administrative, accreditation, data aggregation, and financial services).
The written assurance (which may be in a stand-alone agreement or part of a larger contract) must include several provisions: for example, restrictions on how the business associate may use or release identifiable health care information, promises to protect such information and to return or destroy it at the end of the contract, and assurances to make such information available for compliance purposes. If a covered entity knows that its business associate has violated these provisions, the covered entity must take reasonable steps to correct the problem and terminate the contract (in most cases) if such steps fail.
IV. What Health Information Is Covered?
A. Protected Health Information (PHI)
The Privacy Rule protects individually identifiable health information that a covered entity creates or receives, whether in electronic, paper, or verbal form (“Protected Health Information” or “PHI”). The definition is broad and includes information relating to the past, present, or future physical or mental health of a person, the provision of health care to a person, and payment for health care. The rule covers one’s PHI for as long as the covered entity retains it; hence, decedents’ health information is protected by this rule.
B. Deidentified Information
The Rule does not apply to deidentified health information. It permits deidentification in two ways: (1) a qualified statistician or expert must determine that the risk of reidentification is “very small” and must document the methods used to reach that conclusion; or (2) 18 identifiers must be removed, and the covered entity must not have actual knowledge that the remaining information could be used to identify an individual. The identifiers of the individual — and of relatives, employers, or household members of the individual — that must be removed include:
(2) All geographic subdivisions smaller than a State, including street address, city, county, precinct, zip code, and their equivalent geocodes, except for the initial three digits of a zip code in certain situations;
(3) All elements of date (except year) for dates directly related to an individual, including birth date, discharge date, date of death; and all ages over 89 and all elements of dates (including year) indicative of such age, except that such ages and elements may be aggregated into a single category of age 90 or older;
(4) Telephone numbers;
(5) Fax numbers;
(6) Electronic mail addresses;
(7) Social security numbers;
(8) Medical record numbers;
(9) Health plan beneficiary numbers;
(10) Account numbers;
(11) Certificate/license numbers;
(12) Vehicle identifiers and serial numbers, including license plate numbers;
(13) Device identifiers and serial numbers;
(14) Web Universal Resource Locators (URLs);
(15) Internet Protocol (IP) address numbers;
(16) Biometric identifiers, including finger and voice prints;
(17) Full face photographic images and any comparable images; and
(18) Any other unique identifying number, characteristic, or code.
C. Limited Data Set: Option for Research, Operations, and Public Health
The final Privacy Rule (August 2002) introduced a new category of information that may be used by an entity or disclosed externally without triggering all of the rule’s requirements. This option is available only for research, health care operations, and public health purposes. DHHS requires many “direct” identifiers to be removed, but certain information – such as dates and geographic information without street address – may be retained. Whoever receives the information must agree to a “data use agreement” that describes the permitted uses and disclosures of the information received and prohibits any attempt to reidentify or contact the individuals. Of note, the data use agreement has fewer requirements than a business associate agreement.
Accordingly, researchers who remove most direct identifiers but need to retain dates (e.g., date of birth, admission and discharge date) and some geographic information may do so without triggering all of the Privacy Rule requirements. Because DHHS has defined only what may not be included in a limited data set, it is possible that other information may also be retained. The “minimum necessary” standard (described below) still applies, but the requirement of accounting for all disclosures of PHI does not apply (also described below).
V. What Does the Rule Require?
The general rule is that a covered entity may not use or disclose PHI without an individual’s written authorization, except if permitted or required by the Privacy Rule. Individuals have several rights that the covered entities must protect.
Notice of Privacy Practices and Written Acknowledgement: Covered entities (including health care providers) must give individuals an understandable notice of the ways in which PHI will be used and disclosed. “Use” means sharing within the Partners system, and “disclose” means releasing outside of the system. Entities must make a good faith effort to obtain a written acknowledgement of receipt of the notice.
Uses and Disclosures of Protected Information
No permission or authorization required: Covered entities may use or disclose PHI for the core activities of treatment, payment, and health care operations without written authorization. “Health care operations” refers to a covered entity’s health-related activities (e.g., quality assessment, clinical guideline development, teaching, and general administration). The Privacy Notice should describe these uses and disclosures with reasonable specificity. In addition, permission is not needed to use or disclose PHI for certain activities that are in the public interest. These uses and disclosures include: as required by law; for public health activities (e.g., reporting births, deaths, and injuries); about victims of abuse, neglect, or domestic violence; for health oversight activities (e.g., audits, investigations, licensure, or disciplinary action); for judicial and administrative proceedings; for law enforcement purposes; about decedents (e.g., to funeral directors or medical examiners); for organ and tissue donation purposes; for limited research purposes, as explained below; to avert a serious threat to health or safety; and for special government functions (e.g., military and veterans activities, national security).
Authorization: Authorization is required for several uses and disclosures of PHI. One example is for research; generally, a researcher must obtain a subject’s authorization before using or disclosing PHI for a study, unless the researcher obtains an IRB-approved waiver of authorization.
Oral Agreement or Objection: If a covered entity wants to include PHI in a facility directory, disclose it to clergy, or disclose it to family or close friends of the patient, it does not need the patient’s written authorization. It must, however, give the patient a reasonable opportunity to opt in or opt out.
Minimum Necessary Standard: When a covered entity uses or discloses PHI or requests it from another covered entity, the entity generally must try to limit such information to the “minimum necessary” needed to achieve the purpose. The entity must adopt policies that address what information generally meets this standard for uses, requests, and routine disclosures. For non-routine requests and disclosures, criteria must be developed to permit case-by-case review of the minimum necessary for each purpose. Importantly, the minimum necessary standard does not apply to treatment-related disclosures made to facilitate treatment (e.g., a hospital may release a copy of a full record to an outside physician providing a second opinion). The minimum necessary standard also does not apply when an individual has authorized the use or disclosure (e.g., if a person enrolls in a study and authorizes use and disclosure of her PHI for that purpose, then the researchers do not need to determine what is the minimum necessary information they may use or disclose for the research).
Individual Rights and Entity Responsibilities
Notice, Authorization, and Revocation: Covered entities must give individuals a notice of privacy practices, try in good faith to obtain a written acknowledgement of receipt of the notice, and obtain authorizations when applicable. Individuals have a right to revoke the authorization except to the extent an entity has relied on it. In the event an individual refuses to sign or revokes an authorization, the entity must have mechanisms to track those decisions and ensure they are followed.
Access: Individuals generally have a right of access to their PHI. A covered entity may charge a reasonable fee for copying and postage.
The Privacy Rule generally preempts conflicting state law, with certain exceptions. For example, a state law that offers stricter privacy protections will generally govern.
B. Interaction with Other Federal Laws
HHS explains in its preamble how the privacy rule interacts with other federal laws. A full discussion of this is not possible here, but case-by-case analysis will be needed.
VIII. How Will HHS Enforce the Rule?
The rule permits compliance reviews by HHS and the filing of complaints by individuals, which HHS may investigate. HIPAA authorizes both civil and criminal penalties, including significant fines and imprisonment.