Paubox is HIPAA compliant inasmuch as the email encryption solution supports HIPAA compliance and can be used by Covered Entities and Business Associates to communicate Protected Health Information in emails without violating the standards of the HIPAA Privacy or Security Rules.

• What is Paubox?
• What are the HIPAA Email Requirements?
• Privacy Rule Challenges to HIPAA Email Compliance
• Security Rule Challenges to HIPAA Email Compliance
• How Paubox Can Help Overcome the Challenges
• Making Paubox HIPAA Compliant
• Conclusion: Paubox is HIPAA Compliant

What is Paubox?

Paubox Inc. is a Californian provider of email encryption products with varying capabilities. At the entry level, Paubox works in the background to encrypt outbound emails to prevent Protected Health Information (PHI) from being impermissibly disclosed during the transit of emails.

Further up the product suite, Paubox offers an effective email filter for inbound emails, a HIPAA-compliant email archiving service, and an email marketing solution. The suite also includes an email API for automating HIPAA-compliant emails at a scale.

To substantiate the company’s commitment to security, Paubox is HITRUST CSF Certified. HITRUST is an acronym for the Health Information Trust Alliance, and being certified demonstrates that Paubox complies with the HITRUST Common Security Framework.

What are the HIPAA Email Requirements?

When HIPAA was passed in 1996, email was not the force it is today. Web clients (i.e., Hotmail, Yahoo, etc.) had only just been launched and the first mobile device with email capabilities (the Blackberry 5810) was still six years away. Gmail was not launched until 2004.

Consequently, Congress’ instructions to the Secretary of the U.S. Department of Health and Human Services – to develop privacy and security standards for the protection of individually identifiable health information – did not factor in specific HIPAA email requirements.

Nonetheless, some standards are relevant to HIPAA compliance for email. These include a patient’s right to request how they receive communications containing PHI, the requirement to implement audit controls, and the implementation specifications relating to transmission security.

Privacy Rule Challenges to HIPAA Email Compliance

The first challenge to HIPAA email compliance is when a patient requests communications containing PHI are sent by email. Unencrypted emails are not HIPAA compliant because they can be intercepted in transit and tampered with, or read by unauthorized individuals in a “man-in-the-middle” attack, in a similar way to email filters reading the content of emails to identify spam.

Therefore, if a patient exercises their right to request communications by email – or initiates a conversation via email – Covered Entities should warn the patient that unencrypted email is an unsecured channel of communication; and, if the patient still wants to receive emails containing PHI, document the request and the warning that was provided.

A further Privacy Rule challenge to HIPAA email compliance is human error. There are numerous examples of Covered Entities inadvertently disclosing PHI via email; and while the HHS Breach Portal lists examples in which the PHI of more than 500 individuals has been disclosed via email, there are likely many thousands of smaller data breaches that do not make the list.

Security Rule Challenges to HIPAA Email Compliance

The Security Rule challenges to HIPAA email compliance can be summed up in two words – Technical Safeguards. Most standard email services lack the capabilities to (for example) record when PHI is included in an email, ensure the content of the email is not modified without authorization, and prevent PHI from being disclosed in man-in-the-middle attacks or by legitimate software such as spam filters.

Measures proposed by HHS could – if adopted – ultimately remove the technical burden of recording when PHI is included in an email (provided that the inclusion of PHI is permissible) and ensure the validity of attachments by confirming there has been no tampering. The challenge of preventing man-in-the-middle interceptions can easily be overcome with encryption.

It is important to be aware that encryption does not stop man-in-the-middle interceptions. It simply ensures the content of an email and any attachments are not disclosed because the encryption has made the content and/or attachment unreadable, indecipherable, and unusable. Therefore, in the event of an email being intercepted, there would be no data breach.

How Paubox Can Help Overcome the Challenges

Paubox can help overcome the challenge of HIPAA email compliance in various ways depending on which products are used. For example:

• The entry-level email suite can be configured to automatically encrypt emails without the necessity for members of the workforce to go through extra procedures or for recipients to enter a password or visit a secure portal to read the email.
• The suite can be integrated with major business email platforms and the Salesforce CRM for a seamless user experience, while administrators and compliance officers can take advantage of a library of analytic and email reports.
• The email suite “Plus” includes advanced email filtering capabilities to reduce the risk of malware and ransomware. It also includes two extremely efficient capabilities to mitigate the threat of phishing – DomainAge and ExecProtect.
• At the top level of the Paubox email suite, Covered Entities can take advantage of a HIPAA-compliant email archiving service and a Data Loss Prevention feature that prevents PHI from being sent outside the corporate network by unauthorized members of the workforce.

Two further products in the Paubox portfolio may also be of interest to Covered Entities and Business Associates – Paubox Marketing and the Paubox Email API.

• Paubox Marketing is a simple-to-use email builder that enables marketing departments to personalize marketing emails according to patients’ medical conditions, prescribed medications, and more.
• The Paubox Email API is a tool that can be used to automate email communications at scale while ensuring HIPAA compliance. When used with Paubox Marketing, Paubox can be configured to automatically respond to specified triggers.

Making Paubox HIPAA Compliant

Software is not usually HIPAA compliant “out of the box”. In most cases, the software has to be configured to operate compliantly – especially when integrated with other technologies. Fortunately, making Paubox HIPAA compliant is not complicated due to the simple-to-follow instructions for integrating the email suite with existing business email platforms and the Salesforce CRM.

Once user email addresses have been imported into Paubox, members of the workforce will not notice any difference when sending emails. Nonetheless, it is advisable to explain to users what changes have been made in case a patient raises a concern about PHI being disclosed via email. HIPAA training on Paubox will enable users to answer patient concerns quickly.

Additionally, Covered Entities and Business Associates subscribing to the email encryption service will need to enter into a Business Associate Agreement with Paubox. Like many major software vendors, Paubox has its own Business Associate Agreement; but, having reviewed its content, we have no concerns about the Paubox HIPAA-compliant Business Associate Agreement.

Conclusion: Paubox is HIPAA Compliant

Covered Entities and Business Associates looking at ways to overcome the challenges of HIPAA email compliance can consider Paubox a HIPAA-compliant solution. At the entry level, Paubox removes the compliance overhead of warning patients about the dangers of unencrypted email and documenting their requests to receive PHI via email.

At higher subscription levels, Paubox has a number of HIPAA-compliant capabilities that can help organizations maintain the security of PHI and archive emails for fast search and retrieval. Naturally, the software can be used to ensure other confidential information (governed by other regulations) remains private and is protected against unauthorized access.

Therefore, in answer to the question is Paubox HIPAA compliant, the answer is yes, provided that Covered Entities and Business Associates configure the software to comply with the technical safeguards of the Security Rule and enter into a Business Associate Agreement with Paubox. It is also recommended to provide user training in order to prevent unjustified complaints from uninformed patients.

The post Is Paubox HIPAA Compliant? appeared first on HIPAA Journal.

The text of the Healthcare Insurance Portability and Accountability Act is full of HIPAA exceptions – adding to the complexity of complying with the Act and often resulting in organizations and public agencies applying far more stringent restrictions than necessary.

In 2007, the Reporters Committee for the Freedom of the Press published a Guide to Medical Privacy Law. The Guide highlighted multiple instances in which hospitals, ambulance services, schools, and public agencies unjustifiably withheld news from reporters for fear of violating HIPAA – even though several of the entities were not covered by HIPAA.

According to the Guide, the fear of violating HIPAA led to many entities applying HIPAA overzealously – often applying standards without considering when HIPAA exceptions exist. And there are many HIPAA exceptions. A comb through the Administrative Simplification provisions finds 50 uses of the word “exception” and a further 100+ uses of the word “except”.

It is impractical to list all the HIPAA exceptions in one article, especially as some exist which are not mentioned in the Administrative Simplification provisions. Therefore, we have highlighted a few of the most common exceptions and recommend Covered Entities seek professional compliance advice to identify others that may be relevant to their specific circumstances.

HIPAA General Rule Exceptions

The first HIPAA exceptions appear in the General Rule (45 CFR § 160.102). The General Rule stipulates that when there is a contradiction between HIPAA and State law, HIPAA takes precedence. However, there are multiple exceptions listed in the General Rule including that State law preempts HIPAA when the State law:

• Has more stringent privacy provisions or patients´ rights than HIPAA,
• Provides for reporting information to public health agencies, and
• Requires a health plan to report information for the purpose of audits, etc.

The first exception is the one that has caused more problems for HIPAA Covered Entities than most. This is because nearly every state has a law relating to the privacy of patient information with more stringent privacy provisions than HIPAA. However, many State laws apply to only one element of privacy information (i.e., HIV-related information), only in specific circumstances (i.e., for emergency care), or only to certain entities (i.e., pharmacists).

The other two General Rule exceptions can also be problematic for Covered Entities because, although a State law may permit certain disclosures of PHI to state and federal agencies, the information provided to state and federal agencies can be accessed via Freedom of Information requests. If Freedom of Information requests reveal the Covered Entity has provided more PHI than the minimum necessary, they would be in violation of HIPAA.

Most other uses of the word “exception” in the text of HIPAA relate to exceptions from transaction standards and medical code sets. However, it is worth noting exceptions exist to the right to revoke a patient authorization for the disclosure of PHI and to who should be given Notices of Privacy Practices (i.e., inmates of correction institutions). Covered Entities with public-facing operations may need to be familiar with these HIPAA exceptions.

Other State and Federal HIPAA Exceptions

The relationship between HIPAA and other state and federal laws can further complicate HIPAA compliance due to multiple HIPAA exceptions. The best example of a complicated relationship of this nature is the relationship between HIPAA, the Family Education Rights and Privacy Act (FERPA), and the Texas´ Medical Records Privacy Act (as amended by HB300).

Generally, public schools, colleges, and other educational institutions that provide medical services for students and staff (as a work benefit) are not considered to be Covered Entities under HIPAA. This is because medical treatments provided to students are classified as educational records and protected by FERPA, while medical services provided for staff are non-portable benefits.

Complications start to arise when an educational institution provides medical services for members of the public (i.e., a medical teaching university). Under these circumstances, the educational institution becomes a hybrid entity and has to implement safeguards in order to isolate FERPA-covered treatment records from HIPAA-covered PHI and apply two sets of rules for staff.

When the educational institution is covered by the Texas Medical Records Privacy Act, all medical treatment records relating to students, staff, and the public are subject to HIPAA-esque privacy standards. This is further complicated by the Texas Medical Records Act applying to all citizens of Texas regardless of their location. Consequently, a medical teaching university in New York could be required to comply with three sets of regulations if it accepts mature students from Texas.

Operational and Occupational Exceptions

Operational and occupation exceptions to HIPAA can occur in many different circumstances. For example:

• Ambulance services that bill electronically are subject to HIPAA; but in counties without electronic billing, HIPAA does not apply to ambulance services.
• Healthcare facilities are allowed to disclose directory “health condition” information to callers or visitors who ask about the patient by name
• Some uses and disclosures of PHI allowed by the Privacy Rule are not allowed by the Federal Substance Abuse Confidentiality Requirements (42 CFR Part 2).
• Exceptions exist to the privacy requirements for psychotherapy notes when state laws mandate a duty to warn (i.e., of imminent harm) or duty to report (i.e., abuse).
• Exceptions to a patient´s right to an accounting of disclosures exist if a Covered Entity is ordered not to release the information by a health oversight agency or law enforcement officer.

HIPAA exceptions also exist in the military. Military treatment facilities are HIPAA Covered Entities; however, under the Military Command Exception, healthcare professionals are allowed to disclose Protected Health Information to command authorities without the patient´s authorization in order to report on the patient´s fitness for duty, fitness to perform an assignment, or fitness to perform another activity necessary for a military mission.

HIPAA Privacy Rule Exceptions

The HIPAA Privacy Rule occupies Subpart E of the Administrative Simplification provisions (45 CFR § 164.501 – 164.534) and, within this subpart, there are multiple exceptions to HIPAA. To help Covered Entities and Business Associates better negotiate the volume of HIPAA Privacy Rule exceptions, we have included those that relate to confidentiality in a separate section below.

The first HIPAA Privacy Rule exception to be aware of is that the Privacy Rule does not apply to the Department of Defense (DoD), a federal agency, or any organization acting behalf of either when the DoD, federal agency, or organization acting on behalf of either provides healthcare services to an overseas foreign national beneficiary. This exception has caused some confusion because it has been interpreted in various ways, so here is a brief explanation.

Under the HIPAA Privacy Rule, Covered Entities and Business Associates must protect personally identifiable information of an individual regardless of the individual´s nationality or the location in which the Covered Entity or Business Associate collects, processes, maintains, uses, or discloses PHI. The exception exists because (for example) in a war zone it would be impractical to deny treatment to an injured soldier because they did not understand they had to give consent.

Further HIPAA Privacy Rule exceptions exist when the PHI of one individual is included with the PHI of another. This can happen if (for example) a patient´s medical record includes medical information relating to their parents. In this example, the PHI in the patient´s medical record must be safeguarded as one; and although the parents´ PHI is recorded in the patient´s medical record, neither parent has the right to access the medical record and request amendments to their PHI.

HIPAA Exceptions to Confidentiality

Most HIPAA exceptions to confidentiality relate to uses and disclosures “required by law” and “for health care operations”. These include (but are not limited to):

• When a Covered Entity is a defendant or witness in a malpractice claim.
• When a Covered Entity is contesting a licensing revocation.
• When a Covered Entity is pursuing payment of an outstanding bill.
• When a Covered Entity conducts a patient safety activity (i.e., fire drill).
• When a Covered Entity conducts training programs or credentialling activities.

HIPAA exceptions to confidentiality attributable to health care operations can be a gray area. Consequently, it is recommended any uses and disclosures in non-standard circumstances are documented and retained for disclosure of accounting purposes – even though the use or disclosure may be allowed under the HIPAA Privacy Rule. Additionally, in all cases it is important Covered Entities only disclose the minimum necessary PHI for the stated purpose.

Further HIPAA exceptions to confidentiality exist when a law enforcement official requests health data for the purpose of identifying or locating a suspect, fugitive, material witness, or missing person. However, although it is permissible to disclose an individual´s blood type under these circumstances, Covered Entities are not allowed to disclose information such as dental records, DNA, or body tissue analyses – elements of PHI that would help identify the body of a missing person.

Conversely, there are no limitations on the nature of PHI it is permissible to disclose to law enforcement officers when attending an off-site emergency, nor when disclosing PHI to a law enforcement officer on-site if the nature of the emergency is related to abuse, neglect, or domestic violence. Despite these HIPAA exceptions to confidentiality, it is recommended to seek the consent of the patient if possible, and to check state disclosure laws for superseding contradictions.

Summary: HIPAA Exceptions List

As mentioned previously, it would be impractical to compile a HIPAA exceptions list because there are many exceptions in the Transactions and Code Sets Rule that would be irrelevant to most Covered Entities. Nonetheless, to summarize what has been discussed thus far:

1. HIPAA preempts state law unless a state law has stronger privacy provisions or enhances patients´ rights.
2. HIPAA exceptions also exist when a state law has public agency reporting requirements.
3. Exceptions to the right to revoke patient authorizations exist in certain circumstances.
4. There are also exceptions to when it is necessary to provide a Notice of Privacy Practices.
5. HIPAA does not apply in most schools as medical records are classed as educational  under FERPA.
6. Exceptions to the school exception may apply with regards to records of immunization.
7. HIPAA does not apply to healthcare services and facilities that do not conduct covered transactions.
8. Standard disclosure rules do not apply to substance use disorder patient records.
9. State laws can also override HIPAA on the non-disclosure of psychotherapy notes.
10. Further exceptions exist in the Armed Forces and when an overseas foreign national beneficiary receives treatment provided by the DoD, a federal agency, or an organization working on behalf of either.

Why it is Important to be Aware of HIPAA Exceptions

Protecting patient privacy was not the only objective of HIPAA. The Act also intended to streamline healthcare functions and improve efficiency in the healthcare industry. Covered Entities who are not aware of the HIPAA exceptions can apply the regulations more rigorously than necessary – potentially stifling healthcare functions and harming efficiency. Therefore, if you are unaware of the HIPAA exceptions, it is in your best interests to seek professional compliance advice.

HIPAA Exceptions FAQs

How can I find out which State laws preempt HIPAA in my area?

Speak with a compliance professional or healthcare attorney in your area. If you would like some background information before doing so, the healthit.gov website published a “Report on State Law Requirements for Patient Permission to Disclose Health Information” (PDF). Although this may now be out of date in some areas, Appendix A includes some useful state-by-state information relating to which privacy information, circumstances, and entities are exempt from authorizations.

Does FERPA or HIPAA apply to elementary student health records maintained by a health care provider not employed by the school?

When health services are provided to students by an entity not employed by, under contract to, or otherwise acting on behalf of the school, the student health records are not educational records subject to FERPA even when the health services are provided on the school campus. For example, immunization services provided by a public health agency to students on the school campus are subject to the HIPAA Privacy Rule and, if data are stored electronically, the HIPAA Security Rule.

Where the HIPAA Privacy Rule applies, does it allow an external healthcare provider to disclose PHI about a student to a school nurse or physician?

Yes. The HIPAA Privacy Rule allows covered healthcare providers to disclose PHI about students to school nurses, physicians, and other health care providers for treatment purposes without the authorization of the student or student’s parent. For example, a student’s primary care physician may discuss the student’s medication and other healthcare needs with a school nurse who will administer the student’s medication and provide care to the student while the student is at school.

What is the duty to warn exception that applies to psychotherapy notes?

Psychotherapy notes contain sensitive information not usually required for treatment, payment, or healthcare operations, and therefore should not be disclosed without a patient´s written authorization. However, the duty to warn exception gives healthcare professionals the authority to disclose their notes when they believe a patient poses a threat to another person. This exception also protects healthcare professionals from prosecution for breach of confidentiality.

How likely is it PHI will be disclosed in a Freedom of Information request?

Under the Freedom of Information Act Exemption 6, public agencies can withhold “personnel and medical files and similar files the disclosure of which would constitute a clearly unwarranted invasion of personal privacy.” However, the inclusion of the word “can” implies PHI could be disclosed in a Freedom of Information request is the information is considered to be in the public interest. Unfortunately, different public agencies interpret Exemption 6 in different ways.

When does HIPAA not apply?

In addition to the examples discussed above, HIPAA does not apply when payments are processed by a bank or other financial institution – even when PHI is disclosed to the payment processor by the healthcare provider or health plan on whose behalf payments are being processed. Additionally, under 42 USC § 1320d-8, individuals do not have the right to request PHI is not disclosed to banks and financial institutions.

Can HIPAA information be shared with law enforcement?

HIPAA information can be shared with law enforcement, but the circumstances of each request determine what information can be shared. For example, a Covered Entity may be required by law to disclose certain types of wounds or other physical injuries or may be required to comply with a court order – in which case the court order must stipulate the scope of information required.

When sharing HIPAA information with law enforcement for identification or location purposes, §164.512 limits what information can be shared. Therefore, while it is permissible to share a patient´s name, address, type of injuries, and distinguishing features, it is not permissible to share images, dental records, or car license plate number.

What is an example of when HIPAA does not apply?

One current issue relating to when HIPAA does not apply – at least partly – concerns vendors of personal health records. Even though personal health records collect individually identifiable health information that can be used and disclosed by vendors, the HIPAA Privacy and Security Rules do not apply. However, if a vendor experiences a data breach, the vendor must comply with the Breach Notification Rule – notifying individuals and the Federal Trade Commission of the breach.

Who is exempt from HIPAA?

Although one of the objectives of HIPAA was to protect the confidentiality of health and payment information, and despite the fact that direct patient payments to healthcare providers can sometimes reveal what the payment was for (i.e., counselling services), banks and payment processors are exempt from HIPAA. Consequently, Covered Entities should be careful about how direct patient payments are initiated to comply with the minimum necessary standard.

The post HIPAA Exceptions appeared first on HIPAA Journal.

Compared to the specific HIPAA safeguards of the Security Rule (the Administrative, Physical, and Technical Safeguards), most other references to safeguards in the text of HIPAA are intentionally flexible to accommodate the different types of covered entities and business associates that have to comply with them. While this flexibility means it can be easier for some organizations to comply with the HIPAA safeguards, other organizations may find the lack of direct guidance unhelpful.

To demonstrate the difference between the safeguards of the Security Rule and the safeguards of the Privacy Rule, we have provided a synopsis of the Security Rule Administrative, Physical, and Technical Safeguards to compare against the safeguards mentioned in the Privacy Rule Administrative Requirements. There is also a section relating to the Organization Requirements of the Privacy and Security Rules – both of which include further HIPAA safeguards.

HIPAA Security Rule Safeguards

The HIPAA Security Rule is dominated by the Administrative, Physical, and Technical Safeguards – the remainder of the Rule being assigned to General Rules, Organization Requirements (discussed below), Documentation Requirements, and Compliance Dates. The General Rules provide an oversight of the what the HIPAA safeguards set out to achieve and the “flexibility of approach”, and explain the difference between required and addressable implementation specifications.

Addressable implementation specifications are not as flexible as they may appear. Addressable specifications must be implemented unless they are “not reasonable or appropriate in the environment” or an alternative safeguard provides at least as much protection to ePHI as the addressable specification. In most circumstances, covered entities and business associates have no option but to implement addressable specifications in order to provide adequate protection.

HIPAA Administrative Safeguards

More than half of the Security Rule focuses on the HIPAA Administrative Safeguards (45 CFR § 164.308) – defined in the Security Rule as “administrative actions, and policies and procedures, to manage the selection, development, implementation, and maintenance of security measures to protect electronic PHI and to manage the conduct of the covered entity’s or business associate’s workforce in relation to the protection of that information”.

To achieve the objectives of the HIPAA Administrative Safeguards, covered entities and business associates must appoint a Security Officer responsible for developing a security management program that addresses access controls, incident response, and security awareness training. The Security Officer is also responsible for conducting risk assessments and implementing policies and procedures to protect ePHI from threats and vulnerabilities.

Possibly the most important standard in the HIPAA Administrative Safeguards is the requirement to implement a security awareness and training program for all members of the workforce (including management). It is important to be aware that this requirement also applies to members of the workforce with no authorized access to systems, devices, or databases containing ePHI – including agency staff, volunteers, and students.

HIPAA Physical Safeguards

The HIPAA Physical Safeguards are measures, policies, and procedures intended to protect a covered entity’s or business associate’s buildings, equipment, and information systems from unauthorized intrusion and natural or environmental hazards. Compliance with these safeguards not only involves securing buildings and controlling access to buildings, but also validating the identity of anyone with access to equipment and information systems hosting ePHI.

Compared to the Privacy Rule HIPAA Safeguards (below), the HIPAA Physical Safeguards provide direct guidance on the measures covered entities and business associates should take to (for example) govern the movement of devices and media containing ePHI, document maintenance records for facilities in which ePHI is stored, back up data before moving equipment, and properly dispose of any hardware ePHI is stored on to eliminate the possibility of unauthorized disclosures.

With regards to what members of the workforce can do to comply with the HIPAA Physical Safeguards, standard §164.310(b) requires workstation users to consider the environment in which they are using technology to access ePHI. For example, workstations used in public areas should have their screens obscured from public view, while those used to conduct telehealth consultations should be located in a private area.

HIPAA Technical Safeguards

The HIPAA Technical Safeguards relate to the technology used by covered entities and business associates, and the policies and procedures for its use and access to it. Like the HIPAA Physical Safeguards, the HIPAA Technical Safeguards include fine details on the measures that organizations should implement to protect ePHI from unauthorized access – including audit controls, user verification, and automatic log-off so ePHI cannot be accessed by unauthorized users when devices are left unattended.

Despite being the shortest of the Security Rule HIPAA Standards, the HIPAA Technical Safeguards make it clear that encryption is a significant factor in preventing unauthorized uses and disclosures. This point has been reinforced through several subsequent HHS publications – most notably a recent Fact Sheet that answers questions about ransomware and whether or not a ransomware attack is a reportable breach under the HIPAA Breach Notification Rule.

Although “passwords” are not referred to directly in the HIPAA Technical Safeguards, an effective HIPAA password policy that includes 2FA can support compliance with the standards relating to access controls, unique user identification, and person or entity authentication, so it is easier to comply with the HIPAA Technical Safeguards relating to audit controls and event logs. Indeed, an effective password policy can make it easier to comply with many of the HIPAA Security Rule Safeguards.

Privacy Rule HIPAA Safeguards

Compared to the HIPAA security safeguards, the safeguards mentioned in the Administrative Requirements of the Privacy Rule lack direct guidance. According to 45 CFR § 164.530 a covered entity “must have in place appropriate administrative, technical, and physical safeguards to protect the privacy of Protected Health Information”. The only implementation specifications offered to support this standard are:

• A covered entity must reasonably safeguard PHI from any intentional or unintentional use or disclosure that is in violation of the standards, implementation specifications, or other requirements of this subpart.
• A covered entity must reasonably safeguard PHI to limit incidental uses or disclosures made pursuant to an otherwise permitted or required use or disclosure.

The reason the Administrative Requirements lack direct guidance is the inclusion of “other requirements of this subpart”. “This subpart” refers to the Privacy Rule; and as different covered entities develop different policies and procedures to comply with the Privacy Rule, it would be impossible to develop “one-size-fits-all” safeguards to protect the privacy of PHI in the same way as required and addressable safeguards protect the confidentiality, integrity, and availability of ePHI.

Organizational Requirements in the Privacy and Security Rules

Both the Privacy Rule and the Security Rule contain Organizational Requirements. The Organizational Requirements of the Privacy Rule (45 CFR § 164.105) apply to covered entities that are not whole units (hybrid entities) or that are not single units (affiliated entities), while the Organizational Requirements of the Security Rule (45 CFR § 164.314) relate to Business Associate contracts with subcontractors and relationships between group health plans and plan sponsors.

Additional HIPAA Safeguards for Hybrid Entities

An example of a hybrid entity is a public teaching institution that provides healthcare facilities for staff, students, and the public. The institution is a hybrid entity because the provision of healthcare for staff is a non-portable benefit (and exempt from HIPAA), the provision of healthcare for students is covered by FERPA (which pre-empts HIPAA), and only the provision of healthcare for the public is covered by HIPAA.

Hybrid entities must implement appropriate HIPAA safeguards to ensure that any PHI collected, used, and maintained by the public healthcare component of its operations is not disclosed to the other components of its operations. This includes disclosures of PHI by healthcare professionals working for a hybrid entity when the healthcare professionals assist with medical procedures for staff, students, and the public.

Additional HIPAA Safeguards for Affiliated Entities

Affiliated Entities are legally separate covered entities under the same ownership or control that designate themselves a single Affiliated Covered Entity for the purposes of HIPAA compliance. Being affiliated enables covered entities within an affiliated group to disclose ePHI to each other without the need for individual Business Associate Agreements, which increases integration and efficiency. Affiliated Entities can also use common documentation and share the same Privacy and Security Officers.

The additional HIPAA safeguards in the Organizational Requirements prevent unauthorized disclosures to other business units under the same ownership or control that do not qualify as covered entities. For example, several hospitals within a healthcare system under the same ownership can designate themselves as an Affiliated Entity; but, if the parent organization is not a covered entity, ePHI cannot be disclosed to the parent organization.

Business Associate Contracts with Subcontractors

Most covered entities and business associates are familiar with the requirement to enter into a Business Associate Agreement before ePHI is disclosed by a covered entity to a business associate, but it is not so widely known that a business associate has to enter into a Business Associate Contract before disclosing ePHI with a subcontractor or another of the covered entity´s business associates acting as a subcontractor for the primary business associate.

Originally, business associates had to ensure any subcontractors to whom they disclosed ePHI had appropriate measures in place to comply with the HIPAA Administrative Safeguards of the Security Rule. However, this requirement was changed in the Omnibus Final Rule to “ensure that any agent to whom it provides this information agrees to implement reasonable and appropriate security measures to protect the information”. Naturally, all assurances must be documented.

Relationships between Group Health Plans and Plan Sponsors

The relationship between group health plans and plans sponsors is similar to that between covered entities and business associates with the exception that there are some allowable uses and disclosures of ePHI allowed. In all other cases, group health plans must ensure the plan sponsor has implemented the administrative, physical, and technical HIPAA safeguards required by the Security Rule before disclosing further ePHI to the group sponsor.

It is Important to Comply with All Applicable HIPAA Safeguards

Covered entities and business associates must comply with all applicable HIPAA safeguards. Ignorance of the safeguards – or how to comply with them – is not a justifiable defense if an organization is audited by HHS’ Office for Civil Rights or investigated following a patient complaint or self-reported data breach. In the worst cases, substantial fines can be issued for noncompliance with HIPAA safeguards that organizations should have known about had they exercised due diligence.

HIPAA Safeguards FAQs

Are there further references to HIPAA safeguards in the Privacy Rule?

Yes. These can be found in the section of the Privacy Rule regarding “Other Requirements Relating to Uses and Disclosures of PHI” (45 CFR § 164.514). The relevant standards relate to limited data sets of de-identified PHI and the measures Covered Entities must have in place before disclosing limited data sets.

These include safeguarding any codes or mechanisms that could be used to re-identify PHI, entering into a data use agreement with the recipient of the limited data set, and ensuring the recipient has appropriate safeguards in place to prevent the use or disclosure of data – although de-identified – other than allowed by the data use agreement.

What security awareness training should a Covered Entity provide?

According to the HIPAA Administrative Safeguards, a security and awareness training program should be implemented for all members of the workforce – including management. The content of the program should be determined by a risk assessment to establish what threats exist to the confidentiality, integrity, and availability of ePHI.

It is important to be aware that the requirement to implement a security and awareness training program differs from the training requirements of the Privacy Rule inasmuch as all members of the workforce should undergo security awareness training regardless of their roles, and the program should be ongoing – rather than a one-off training session on policies and procedures.

How is it possible to govern the movement of devices and media in community nursing?

The standard relates to governing the movement of devices and media containing ePHI. If ePHI is stored on devices used in community nursing, the devices need to be configured to comply with the technical safeguards inasmuch as they should PIN-locked, data should be encrypted and password protected, and the transmission of ePHI should be done over secure channels.

With regards to monitoring the movement of devices and media at all at times, the physical safeguards do not stipulate around-the-clock monitoring. However, many community nursing units have “check-in” procedures to ensure the safety of nursing professionals in the community, and these procedures could be adapted to increase the governance of device movement.

Is a ransomware attack reportable if data is encrypted?

This depends. According to the HHS Fact Sheet there are circumstances in which a ransomware attack is reportable even if data is unreadable, unusable, and indecipherable by the attacker due to it being encrypted. This is because some full disk encryption systems automatically decrypt data when the system is powered on, and the operating system loaded.

The Fact Sheet does make it clear that a ransomware attack on unencrypted data is a reportable offence because, at the time of the attack, the attacker was in control of unsecured data and there is no way of knowing whether it was viewed and/or extracted or not. In these circumstances, it is impossible to prove a low probability that ePHI was compromised to avoid reporting requirements.

What are the penalties for failing to comply with the HIPAA safeguards?

The penalties for failing to comply with the HIPAA safeguards vary according to the nature of the violation, the extent of the harm caused by the violation, and the organization´s previous history of HIPAA compliance. There are four tiers of violation type depending on the degree of culpability, and penalties are calculated within these tiers per violation.

It is important to be aware it is not necessary to experience a data breach in order to be issued a penalty. Eleven Covered Entities were recently investigated and fined for failing to comply with patient right of access requirements – even though no data breach had occurred. All eleven also suffered operational disruption due to the requirement to comply with a corrective action.

The post Guide to HIPAA Safeguards appeared first on HIPAA Journal.

The Health Insurance Accountability and Portability Act (HIPAA) introduced a number of HIPAA rights relating to the portability of health coverage, the continuation of health coverage between jobs, and the coverage of employees with preexisting conditions. However, many more HIPAA rights were added in the Privacy Rule, and the failure to comply with Privacy Rule HIPAA rights is one of the leading reasons for complaints to the HHS Office for Civil Rights.

When HIPAA was enacted in 1996, references to individuals’ rights mostly focused on the original purpose of the Act – to enable employees to carry forward insurance coverage from one employer to another after a break, to prevent the denial of coverage – or additional premiums for coverage – on the grounds of a pre-existing condition, and to guarantee renewability in multiemployer plans.

HIPAA Special Enrollment Rights

Possibly the most utilized of the “insurance rights” are the HIPAA special enrollment rights. These HIPAA rights allow individuals to enroll in a health plan as a result of a special enrollment event such as the loss of other health insurance coverage, the acquisition of a dependent through marriage, birth, or adoption, or becoming eligible for a Medicaid or premium assistance subsidy.

The events eligible for special enrollment – and the requirements for special enrollment periods – can vary according to each State’s insurance licensing laws. To explain what events are eligible for special enrollment and how long individuals have to apply for special enrollment, health plans (and, in some cases, employers) are required to provide a HIPAA Notice of Special Enrollment Rights

The HIPAA Privacy Rule Rights

The HIPAA rights most people are familiar with – the right to health information privacy and the right to access and correct health information – are mentioned in the text of HIPAA (Section 264), but only in the context of the recommendations the Secretary for Health & Human Services was tasked with preparing in the event that Congress did not pass a privacy law within three years.

As Congress did not pass a privacy law, the Privacy Rule was introduced to establish patients´ rights under HIPAA. These can be found between 45 CFR § 164.508 and 45 CFR § 164.528 in the HIPAA Administration Simplification provisions. However, as the HIPAA Administrative Simplification provisions are complex, we have provided a synopsis of the most important HIPAA Privacy Rule rights below.

Rights under the Privacy Rule

Information for which individuals have rights under the Privacy Rule is known as Protected Health Information or PHI. In addition to information relating to a patient’s past, present, or future physical or mental condition being protected – including the provision of treatment and healthcare services – past, present, or future payment information is also protected under the Privacy Rule.

45 CFR § 164.508 – Uses and disclosures of PHI for which an authorization is required

HIPAA Covered Entities and Business Associates are allowed to use or disclose PHI to carry out selected treatment, payment, or healthcare operations. All other uses and disclosures require the prior authorization of a patient. Patients have the right to request a copy of the authorization to keep, and the right to revoke the authorization at any time.

45 CFR § 164.520 – Notice of Privacy Practices for PHI

Patients have the right to receive a Notice of Privacy Practices. The Notice must explain what uses and disclosures of PHI are allowed, and when an authorization is required for other uses and disclosures. The Notice must also list the patient´s other rights, how to exercise them, and how to make a complaint if their privacy rights are violated.

45 CFR § 164.522 – Right to request privacy protection for PHI

Two of the HIPAA rights listed in the Notice of Privacy Practices are that patients can request restrictions on certain uses and disclosures of PHI – for example not informing a health plan when a patient receives treatment and pays for the treatment privately – and that they can request how Covered Entities communicate with them when a communication involves a disclosure of PHI.

45 CFR § 164.524 – Access of individuals to PHI

The right in this standard should also be included in a Notice of Privacy Practices inasmuch as it explains a patient´s right to inspect and receive a copy of their PHI within 30 days (currently under review). Patients can also stipulate how they want to receive a copy of their PHI – for example, by email, on a USB drive, or in paper format.

45 CFR § 164.526 – The right to amend PHI

Patients have the right to request corrections to their medical records if, on obtaining a copy of their PHI, it is found to be inaccurate or incomplete. There are several scenarios in which a Covered Entity can decline to comply with this request, including in these days of interoperability between Covered Entities, that the Covered Entity to whom the request is made did not create the PHI.

45 CFR § 164.528 – Accounting of disclosures of PHI

The right to access an accounting of disclosures – which explains who the patient´s PHI has been disclosed to and why over the past six years – is one of the most complicated HIPAA rights standards because there are so many exclusions allowed. It is also possible for this right to be suspended if a suspension is requested by a law enforcement officer or public health official.

The Importance of Patients’ Rights to Medical Records

Patients are encouraged to exercise their HIPAA Privacy Rule rights – especially the HIPAA patients’ rights to medical records required by 45 CFR § 164.524 – to improve their knowledge of their health and engage in their own care. The “sense of ownership” is believed to reduce misdiagnoses and medical mistakes by patients alerting healthcare providers to inaccuracies and omissions.

In addition to identifying any inaccuracies and omissions in their medical records, individuals exercising their patient rights under HIPAA can also help prevent fraud and abuse in the healthcare system by raising concerns about treatments that appear on their medical records they have not received. These indicate a third party has used the patient’s PHI to commit insurance fraud.

Rights under the Breach Notification Rule

In addition to the rights granted by the Privacy Rule, individuals also have HIPAA rights under the Breach Notification Rule – a Rule that specifies the process for reporting breaches of unsecured PHI. The Rule was extended in the Final Omnibus Rule in 2013 to include Business Associate data breaches, and further changes are being considered in response to the Safe Harbor Act 2021.

At present, patients have the right to be notified of any breach of unsecured PHI when there is reason to believe the PHI has been accessed, acquired, used, or disclosed without authorization. The notification must explain how the breach happened, the nature of the PHI that was breached, and what steps individuals should take to protect themselves from harm as a result of the breach.

In addition, Covered Entities must describe what they are doing to investigate the breach, mitigate harm to individuals, and protect against further breaches. Covered Entities must also provide contact details – which should include a toll-free number – where affected individuals can seek help or ask further questions. These procedures apply regardless of how many patients are affected.

Noncompliance with HIPAA Rights

As mentioned in the introduction to this article, the failure to comply with Privacy Rule HIPAA rights is one of the leading reasons for complaints to the HHS Office for Civil Rights (OCR) and subsequent enforcement action. In recent years, complaints about patients´ rights of access have been among the top five complaints investigated by OCR that have resulted in corrective action and/or a civil penalty.

As of January 2024, OCR has issued fines or reached settlement agreements with 46 covered entities for noncompliance with the HIPAA rights. It is important to note that the settlements of up to $160,000 involved smaller practices as well as larger organizations. Therefore, it is important that every Covered Entity is aware of – and complies with – patients´ HIPAA rights.

HIPAA Rights FAQs

Why might a patient not want their health plan informed they have received treatment?

When a patient receives medical treatment and pays for it privately, the patient has the right to withhold this information from their insurance provider in case the provider subsequently increases the insurance premium, limits the benefits of the plan, or refuses future coverage. While decisions such as these are often appealed successfully, the appeal process can be particularly stressful while recovering from medical treatment.

Why does it matter how a Covered Entity communicates with a patient?

Face-to-face communications are usually exempt from this standard because they are likely to relate to the provision of treatment. However, remote communications (i.e., a telephone call to work) could be intercepted by third parties (i.e., work colleagues) who the patient may not wish to share their personal information with. This standard allows patients to request a preferred communication channel, location, and time.

Do Covered Entities have to comply with the Breach Notification Rule if a breach affects just one patient?

This depends on the outcome of a risk assessment. If the risk assessment demonstrates a low probability that unsecured PHI has been compromised due to the unauthorized access, acquisition, use, or disclosure, Covered Entities do not have to notify patients (although they may still wish to do so). In all other cases, unauthorized disclosures of unsecured PHI have to be notified to affected individuals even if only one patient is affected.

How can Covered Entities avoid penalties for noncompliance with patients´ HIPAA rights?

In many cases, noncompliance with patients´ HIPAA rights is attributable to a lack of understanding. Therefore, to mitigate the risk of noncompliance, Covered Entities should develop policies and procedures to meet the requirements of the Privacy and Breach Notification Rules, train members of the workforce on the policies and procedures, and organize periodic refresher training to maximize retention of the policies and procedures.

What exclusions apply to the accounting of disclosures right?

When a patient requests an accounting of disclosures, Covered Entities do not have to include disclosures for treatments, payments, or health care operations, any disclosures made to the patient, any disclosures previously authorized by the patient, and disclosures to law enforcement. In addition, incidental disclosures, disclosures of PHI in a limited data set, and disclosures of de-identified PHI do not have to be included in the accounting of disclosures.

How many basic rights are covered under HIPAA?

As mentioned in the introduction to this article, HIPAA introduced multiple rights – including the rights of individuals to carry forward health insurance coverage, the rights of individuals not to be discriminated against due to a pre-existing condition, and the rights of individuals to have guaranteed health insurance renewability in multiemployer plans.

With regards to the rights to health information privacy and to access and correct health information (etc.), these are not “basic rights” in the sense that they are absolute or fundamental rights. Covered Entities can disclose health information without patient authorization and deny an individual their right to access and correct health information in certain circumstances.

How many patient privacy rights are there?

Strictly speaking, there are six patient privacy rights mandated by the Privacy Rule. However, once you include patients´ rights under the Breach Notification Rule and the right to request a review if a request to access or correct health information is denied – or a request for an accounting of disclosures is denied – it could be argued that there are eight patient privacy rights.

Are all healthcare providers required to comply with the standards for HIPAA patient rights?

No, because not all healthcare providers are Covered Entities under HIPAA, and healthcare providers that do not qualify as Covered Entities are not required to comply with the HIPAA Privacy Rule and the standards for HIPAA patient rights. However, even when healthcare providers are not required to comply with the standards for HIPAA patient rights, they may be required to comply with state privacy laws that have similar requirements to HIPAA.

For the record, only healthcare providers that conduct electronic transactions for which the Department of Health and Human Services has developed standards are Covered Entities. Covered electronic transactions include patient eligibility requests, treatment authorizations, and claims for payments. Therefore, if a healthcare provider conducts these transactions non-electronically or bills patients directly, the healthcare provider is not a HIPAA Covered Entity.

Do the standards for HIPAA privacy rights apply to pharmacies?

Although you might not think of a pharmacy as a healthcare provider, the HIPAA Administrative Simplification Regulations define health care as including “the sale or dispensing of a drug, device, equipment, or other item in accordance with a prescription.”

Consequently, provided the pharmacy conducts electronic transactions for which the Department of Health and Human Services has published standards and it sells or dispenses drugs in accordance with a prescription, it is a Covered Entity and the standards for HIPAA privacy rights apply.

One grey area relates to marijuana dispensaries. Strictly speaking, they are not Covered Entities under HIPAA because – unless they use a third-party service provider to conduct transactions on their behalf – they do not conduct covered transactions.

However, because of the sensitive nature of PHI collected by marijuana dispensaries, the Department for Health and Human Services has taken an interest in how HIPAA privacy rights are applied – notwithstanding that state privacy and security laws may also dictate whether privacy rights similar to those stipulated by HIPAA apply to marijuana dispensaries.

The post HIPAA Rights appeared first on HIPAA Journal.