HIPAA

HIPAA sets the federal rules for protecting health information in the United States. Its Privacy Rule governs how protected health information may be used and shared, its Security Rule sets safeguards for electronic health information, and its Breach Notification Rule sets who must be told, and how fast, when unsecured health information is compromised.

It applies to covered entities and to the business associates that handle health information for them, and each carries its own direct duties.

• Covered entities: health plans, health care clearinghouses, and health care providers that conduct standard transactions electronically, such as billing insurance.
• Business associates: vendors and contractors that create, receive, keep or transmit protected health information for a covered entity, and their subcontractors.
• It covers protected health information: individually identifiable health information in any form, held by a covered entity or business associate.
• Health data outside these relationships, such as many consumer health apps, is usually outside HIPAA and falls under state privacy laws and the FTC.

Individuals can:

• get a copy of their records, generally within 30 days, with one 30-day extension (45 CFR 164.524);
• ask for corrections (164.526);
• get an accounting of certain disclosures (164.528);
• ask for restrictions and for communications by other means or at other locations (164.522);
• receive a notice of privacy practices (164.520);
• complain to the HHS Office for Civil Rights.

Civil money penalties in four tiers based on the level of culpability, from violations the entity did not know about to willful neglect left uncorrected, with annual caps; the amounts are adjusted for inflation each year. The HHS Office for Civil Rights enforces, often through settlements with corrective action plans, and state attorneys general can also bring actions. Knowingly obtaining or disclosing protected health information in violation of HIPAA is a federal crime.

1. Confirm your role for each relationship: covered entity, business associate, or neither.
2. Run and document a security risk analysis, then manage the risks it finds.
3. Inventory business associates and put a compliant agreement in place with each.
4. Check your notice of privacy practices and your process for access requests within 30 days.
5. Apply the minimum necessary standard to routine uses and disclosures.
6. Rehearse a breach: the four-factor risk assessment, and the 60-day clock from discovery.