HIPAA Advice

HIPAA And Social Media Guidelines

Posted March 12, 2018 by HIPAA Journal

The most important rule for any HIPAA and social media guidelines is that social media content must NEVER include protected health information (PHI). This must be front and center of any HIPAA social media policy.

Organizations subject to HIPAA can use our HIPAA and Social Media Checklist to understand how to avoid HIPAA violations due to misuse of social media by employees.

What Are The HIPAA And Social Media Rules?

Because HIPAA was enacted several years before social media such as Facebook, TikTok and Instagram existed, the Privacy Rule does not include any specific references to social media.

Nevertheless, the HIPAA social media rules are the standards relating to permissible uses and disclosures of PHI in the Privacy Rule.

As permissible uses and disclosures do not include publishing individuals’ PHI in the public domain, these effectively prohibit Covered Entities and Business Associates from using or disclosing PHI without an individual´s authorization.

If no PHI is disclosed – and the FTC Rules (see below) are complied with – the Privacy Rule does not apply, and Covered Entities and Business Associates can freely use social media networks to promote healthy lifestyles, market health insurance products, and promote B2B services.

However, it is important to understand what is considered PHI under HIPAA. The term PHI does not solely relate to health information, and it could be possible that – due to a lack of knowledge – a member of the workforce inadvertently discloses PHI in violation of the Privacy Rule.

Understanding Patient Authorization Rules

In addition to understanding what is considered PHI under HIPAA, it is also important to understand the patient authorization rules which must be part of any HIPAA social media policy.

These can be found in §164.508 of the Privacy Rule and stipulate that valid authorizations must include the following core elements:

A meaningful description of the information to be used or disclosed
A meaningful description of the purpose of the use or disclosure
An explanation that the information may be further disclosed
The individual´s right to revoke the authorization
An expiration date for the authorization

With regards to the final core elements, it is important for the individual to be aware that a social media post containing their PHI may be widely shared, screenshot, and republished. In the event that a patient requests a revocation of their authorization, the organization may be unable to comply.

This scenario is covered in the Privacy Rule by a clause that exempts revocations in cases where “the Covered Entity has taken action in reliance thereon”. However, these core elements must be included in the authorization in order for it to be considered valid at the time it was signed.

HIPAA Social Media Violations On The Rise

Sharing too much information on social media platforms can have devastating effects on both healthcare organizations and employees if patient-specific information is shared.

With over a billion people on social networks and professional blogs, it is not surprising that HIPAA violations are on the rise and are raising major concerns among medical practices.

There are many benefits to be gained from using social media if your organization is a HIPAA Covered Entity or Business Associate. For example, healthcare providers can promote healthy lifestyles, raise awareness of emerging health issues, and make announcements when special clinics or services are available to the public.

Health plans can use social media to market health insurance products, advertise new plans and benefits, and attract new customers; while Business Associates can promote B2B services and quickly answer questions from interested parties. However, all of these uses of social media may be subject to FTC and HIPAA social media rules.

HIPAA And Social Media Cases

There are several examples of HIPAA social media cases that have resulted in disciplinary action against the offender. For example, in October 2019, a dental practice was fined $10,000 for impermissibly disclosing PHI on a social media review site; while in January 2016, a nursing assistant was fired from her job and sentenced to 30 days in jail for posting a video of a patient online.

Covered Entities, Business Associates, and members of their workforces should take steps to avoid HIPAA violations of this nature. The steps should include providing training on the organization´s social media policies, enforcing sanctions policies that prohibit impermissible uses and disclosures of PHI on social media, and implementing safeguards to prevent inadvertent disclosures.

For further information on the best ways to avoid HIPAA violations when using social media, seek professional advice from a compliance expert. Alternatively, you are invited to download our HIPAA and Social Media Checklist which contains the key points organizations may wish to consider when developing a social media policy to comply with HIPAA.

What are the FTC Social Media Rules?

The FTC social media “rules” are the regulations relating to deceptive acts or practices in Section 5 of the Federal Trade Commission Act. The regulations apply to all forms of advertising and marketing, and define an act or practice as deceptive if:

a representation, omission, or practice misleads or is likely to mislead the consumer;
a consumer’s interpretation of the representation, omission, or practice is considered reasonable under the circumstances; and
the misleading representation, omission, or practice is material.

This means any claim – whether made by an organization or on behalf of an organization, and regardless of whether Protected Health Information is disclosed to support the claim – must not “seek to gain an advantage while avoiding competing on the merits”.

HIPAA Social Media Rules – FAQs

What do you need to know about social media and HIPAA?

What you need to know about social media and HIPAA is that posting PHI on social media is permissible under HIPAA only if you have a written authorization from the subject of the PHI. However, once something is posted on social media, you have no control over what happens to it. If the subject of the PHI subsequently wants to revoke an authorization, you cannot comply with the request because you have no control over who has seen the post or what copies have been made.

What is one reason that social media increases the risk for HIPAA violations?

One reason that social media increases the risk for HIPAA violations is that social media channels make it easy for users to take a photo and upload it with the tap of a screen. This increases the risk for HIPAA violations because members of a covered entity´s workforce can unthinkingly take a photo of something or someone they have seen and post it on the Internet within seconds. If the photo reveals a PHI identifier and health information (for example, a celebrity being brought into ER) it is a violation of HIPAA unless the written authorization of the celebrity has been obtained in advance.

What is considered a HIPAA violation with social media?

One thing considered a HIPAA violation with social media is posting any individually identifiable health information without a written authorization. If a authorization is obtained, the form on which the disclosure is authorized has to inform the subject what the disclosure is for and explain that the subject has the right to revoke the authorization. The subject should also be given the option of stipulating a time period after which the disclosure must end.

As it is impossible to control what happens to a social media post once it has been published, it is unlikely a covered entity will be able to comply with a revocation or expiration request. This is a violation of HIPAA unless the authorization form includes the “reliance upon” clause excluding covered entities from revocation and expiration requests after the event.

If an employee attaches an image of a patient’s injury to a Tweet without any other identifying information, is that a breach of the HIPAA Privacy Rule?

If an employee attaches an image of a patient’s injury to a Tweet without any other identifying information it is a breach of the HIPAA Privacy Rule if the identity of the individual can be determined from image. However, if the patient has given their written authorization for the image to be used, and the image is shared under the conditions of the authorization, there is no violation of the HIPAA Privacy Rule.

Do the HIPAA social media rules apply to all accounts or just corporate accounts?

The HIPAA social media rules apply to all accounts – not just corporate accounts. It is important to be aware that images posted on private social media accounts without patient consent are in double violation of HIPAA, as the individual has not only posted ePHI impermissibly, they have also obtained the image from a corporate source that lacked the protections of the HIPAA Security Rule.

If there are no specific social media rules, can covered entities still be fined for violations of HIPAA on social media?

If there are no specific social media rules, covered entities still be fined for violations of HIPAA on social media because in most cases unauthorized disclosures of ePHI on social media are impermissible disclosures – which is a breach of the Privacy Rule. If an employee has accessed ePHI without authorization to publish PHI on social media, the covered entity would be liable for the likely breach of the Security Rule for not protecting ePHI from unauthorized disclosure.

Do all employees have to be trained on HIPAA social media rules, or just those with access to ePHI?

All employees should be trained on HIPAA social media rules as part of their security awareness training. All members of the workforce should be aware of the organization’s policies relating to social media whether they have access to ePHI or not. Even members of the workforce without access to ePHI can disclose information on social media such as a patient’s name and what they are being treated for, so it is important they know not to disclose information without authorization through any media.

How can covered entities and business associates implement controls that flag potential HIPAA violations on social media?

Covered Entities and business associates can implement various controls that flag potential HIPAA violations on social media. For example, the simplest way to monitor social media for HIPAA violations is to search for specific hashtags relating to a healthcare facility (i.e., #nyp, #mayoclinic, #UPMC, etc.). Although a manual control rather than a technology control, reviewing what is written about a healthcare facility on social media can help facilities improve their services – and their HIPAA policies – in many different ways.

Why is posting patient information on social media a HIPAA violation?

Posting patient information on social media is a HIPAA violation if you do not have the patient’s authorization because it discloses individually identifiable health information to the public that could be used to commit fraud or identity theft. Even if you do not name the patient when you post Protected Health Information on social media, the patient can still be identified from other information included in the social media post.

What is a HIPAA compliant social media policy?

A HIPAA compliant social media policy is a policy that stipulates the circumstances under which it is allowed to post any information to social media. As social media posts can never be fully retracted (because they may have been shared, screenshot, or copied and pasted prior to retraction) , it is a best practice to prohibit any post containing individually identifiable health information and enforce tough sanctions on any member of the workforce that breaches this policy.

What is the penalty for a social media HIPAA violation?

The penalty for a social media HIPAA violation depends on who is responsible for an impermissible disclosure of PHI and what the consequences are. For example, if a Covered Entity posts PHI on a social media site without authorization for a marketing campaign, and the subject(s) of the PHI complain to HHS’ Office for Civil Rights, the penalty could be a substantial fine.

However, if a member of a Covered Entity’s workforce posts PHI on a social media site without authorization, the penalty will be whatever sanction is listed in the Covered Entity’s sanctions policy. This could range from a verbal warning and retraining to termination of contract and loss of license – a more likely outcome if the violation demeans the patient or is a repeated offense.

Is Facebook HIPAA compliant?

Facebook is not HIPAA compliant. Although social media has some mechanisms to control unauthorized access to accounts, Meta will not sign a Business Associate Agreement with Covered Entities. Indeed, under Facebook’s terms for the Workplace by Facebook service, Meta prohibits the use of the service to “submit […] any patient, medical, or other protected health information regulated by HIPAA or any similar federal or state laws, rules, or regulations”.

Are there any examples of HIPAA violations on social media?

There are several examples of HIPAA violations on social media that have resulted in fines being issued by HHS’ Office for Civil Rights and dozens of examples of employees being fired and/or charged for HIPAA violations on social media.

In 2019, Elite Dental Associates was fined $10,000 for disclosing a patient’s name, details of her health condition, treatment plan, insurance, and cost information in response to a negative online review.
In 2022, another dental practice – Dr. U. Phillip Igbinadolor and Associates – responded to a patient complaint on social media disclosing the patient’s name and treatment. The dentist was fined $50,000.
In 2017, ProPublica published more than fifty examples of HIPAA violations on social media that resulted in employees being sanctioned, fired and/or charged with a criminal offense.

What are the recommended social media guidelines for healthcare professionals?

The recommended social media guidelines for health professionals are not to post anything relating to patients on social media channels. Even if you have the patient’s authorization to comment about someone you are caring for or have treated, there is no way you can fully retract the social media post if the patient decides to revoke their authorization. As well as not being able to retract the post, if a friend or family member of the patient – who does not know you have the authority to publish the patient’s PHI – sees the post, they may file a complaint with your employer or HHS’ Office for Civil Rights.

Is posting a photo of a patient on social media considered a disclosure?

Posting a photo of a patient on social media is considered a disclosure if the photo identifies the individual and either the photo or a description of the photo implies a past, present, or future treatment relationship. However, posting a photo of a patient on social media is not necessarily an impermissible disclosure if you have obtained the patient’s written authorization.

Is it a HIPAA violation to look up a patient on Facebook?

It is not a HIPAA violation to look up a patient on Facebook because information on Facebook pages is posted by individuals who are aware – or who should be aware – they are publishing information about themselves in the public domain. However, if you are discovered looking up a patient on Facebook, it may raise concerns you could also be snooping on the patient’s medical records. Although not a HIPAA violation, it is best to avoid looking up patient information on any media for purposes not permitted by the Privacy Rule.

Who is allowed to share personal health information on social media sites?

The issue of who is allowed to share personal information on social media sites is complicated. There are guidelines in HIPAA about sharing protected health information on social media; but, if an individual or organization is not covered by the HIPAA guidelines or an employer’s social media policy, other data privacy laws may apply – and these can vary from state to state.

With regards to HIPAA and social media, Covered Entities and Business Associates can share personal health information on social media sites provided they have the patient’s authorization to do so. Employees of Covered Entities and Business Associates are advised not to share personal health information on social media sites unless they have a valid reason for doing so (i.e., marketing) and the patient’s authorization has been acquired by their employer.

What are the rules for social media and patient privacy in HIPAA?

There are no specific rules for social media and patient privacy in HIPAA because HIPAA was created many years before social media. However, each Covered Entity and Business Associate should have a social media policy that either prohibits members of the workforce from posting patient information on social media channels or that outlines the procedures to post patient information on social media channels in compliance with HIPAA. Each Covered Entity and Business Associate should also have – and enforce – a sanctions policy for patient privacy violations on social media.

The post HIPAA And Social Media Guidelines appeared first on HIPAA Journal.

Is Ademero HIPAA Compliant?

Posted February 12, 2018 by HIPAA Journal

Content Central by Ademero is HIPAA compliant and organizations in the healthcare sector can use the cloud-based document management system to streamline document-intensive processes and workflows when documents contain Protected Health Information (PHI). Ademero has told us the company is willing to enter into a Business Associate Agreement with HIPAA covered entities and business associates as necessary.

What is Content Central?

Content Central is an enterprise document management system that works by capturing documents and files from scanners, network folders, and email accounts, and converting them into searchable PDF files. The PDF files can be grouped together according to administrator-defined values and are stored in a secure cloud server for remote retrieval by authorized users. The process can significantly accelerate workflows by eliminating delays attributable to searching for and retrieving documents.

Once retrieved, documents can be shared with or among other authorized users via the Content Central platform without using external solutions. Alternatively, Content Central can be integrated with collaboration and productivity suites such as Microsoft Office 365 and Google Workspace – subject to the integrations being configured to support HIPAA compliance and a Business Associate Agreement being signed with the third party service provider.

Is Content Central by Ademero HIPAA Compliant?

Ademero Software has developed Content Central with HIPAA compliance at top of mind. The system includes unique user identification controls, automatic logoff, and emergency administrator access to comply with §164.312 of the Technical Safeguards. All documents are encrypted in transit and at rest, and the system’s audit controls allow administrators to track logon and logoff activity, file access, and document histories (i.e., edits, copies, and downloads).

Other than assigning user IDs (or integrating Content Central with an existing SSO solution), applying user permissions, and enabling or disabling “system fields”, there is little administrators have to do to make Content Central by Ademero HIPAA compliant. The company is flexible about the content of optional clauses in customers’ Business Associate Agreements and are happy to speak with compliance officers or system administrators who may have operational concerns.

Considerations before Adopting a Document Management System

There are two considerations to take into account before adopting a document management system – the first being that, when paper documents are converted into digital documents, members of the workforce may initially find PHI harder to access and tempted to take compliance shortcuts “to get the job done”. This risk of non-compliance can be overcome by tailoring HIPAA training to explain the purpose of the additional security measures and why they should not be circumnavigated.

The second consideration is the compliant disposal of PHI maintained on paper once it has been scanned and converted into a digital document. HHS’ Office for Civil Rights has published a fact sheet about the compliant disposal of PHI and has fined companies who do not comply with the HIPAA disposal requirements. If your organization is unsure about how best to dispose of PHI in compliance with HIPAA, it is recommended you seek professional compliance advice.

The post Is Ademero HIPAA Compliant? appeared first on HIPAA Journal.

Does HIPAA Apply to Employers?

Posted December 6, 2017 by HIPAA Journal

HIPAA applies to employers in certain circumstances and, although HIPAA does not protect individually identifiable health information maintained by a covered entity in its role as an employer, it is important for employers to understand what these circumstances are to avoid HIPAA violations. Employers also need to ensure that their workforces understand whether or not health data collected and maintained by their employer is protected by the HIPAA Privacy Rule.

Does HIPAA Apply To Employers You can use our HIPAA Checklist For Employers to view your compliance requirements and avoid HIPAA violations.

The HIPAA Privacy Rule is one of the most complicated pieces of legislation affecting the healthcare and health insurance industries. Because of its objectives to standardize how individually identifiable personal information is protected across many different use cases, the language of the HIPAA Privacy Rule is “non-specific” and open to a number of interpretations.

Many attempts have been made to summarize the HIPAA Privacy Rule in a format that clearly outlines who is covered by the legislation and how it should be applied.

Because of its complicated nature, most summaries fail to adequately answer the question how does HIPAA apply to employers? This article aims to answer that question as adequately as possible.

Let´s First Discuss HIPAA-Covered Transactions

Does HIPAA Apply To Employers In Healthcare The HIPAA Privacy Rule defines what constitutes individually identifiable health information and how it should be protected from unauthorized uses and disclosures.

It is often the case that a new employee may disclose some elements of protected health information – for example to an employer’s HR Department – when the new employee commences with the new employer. So, under that summarized interpretation, the answer to the question “Does HIPAA Apply to Employers”, would be “yes”.

However, Protected Health Information is only covered by HIPAA when it is used to communicate information about an individual´s past, present or future medical condition, the provision of healthcare to an individual, or the payment for the provision of healthcare. If a worker supplied their individually identifiable health information to an employer’s HR Department, and it was never used for any of these purposes, HIPAA does not apply to employers in this scenario.

One factor sometimes overlooked in summaries of the HIPAA Privacy Rule is that, in order for a “covered entity” to be subject to the regulations, the purpose of creating, using, storing or sharing Protected Health Information has to be a HIPAA-covered transaction. HIPAA-covered transactions include (but are not limited to):

A request to obtain payment from a healthcare provider to a health plan accompanied by supporting documentation.
An inquiry from a healthcare provider to a health plan about the eligibility of an individual to receive treatment.
A request to a health plan to refer an individual to another healthcare provider (and the health plan´s response).
The transmission of either of the following from a health plan to a healthcare provider: (1) Explanation of benefits. (2) Remittance advice.

For further information about what qualifies as a HIPAA-covered transaction, please refer to 45 CFR Part 2, specifically §§ 162.1101 to 162.1801. With regard to the question “Does HIPAA apply to Employers who Conduct HIPAA-Covered Transactions”, this is addressed in the next section.

Does HIPAA Apply to Employers’ Self-Insured Health Plans?

Using the criteria described above for HIPAA-covered transactions, the only circumstances in which an employer may be involved in these types of transactions if they provide onsite clinics as an employee health benefit, provide a self-insured health plan for employees, or act as an intermediary between employees, healthcare providers, and health plans.

Because an onsite clinic is an employee health benefit that is not “portable” (i.e. the benefit cannot be taken with an employee when they move to a new job), it is exempt from the Privacy Rule. Employers providing self-insured health plans are also exempt because HIPAA regards the employer and the health plan as two separate legal entities, even if the employer administers the self-insured health plan.

However, in order to administer a self-insured health plan, or act as an intermediary between employees, healthcare providers and health plans, the employer is subject to “partial compliance” and is required to provide a certification that Protected Health Information will be safeguarded as prescribed by the HIPAA Privacy Rule and not used for employment-related actions.

The certification is not unlike a Business Associate Agreement and it allows the self-insured health plan to share Protected Health Information with the employer, but only for the purposes of administering the health plan. Any other uses of the Protected Health Information would constitute an unauthorized disclosure and the employer would be subject to sanctions by the Department of Health & Human Services. Further information about employer certification can be found in 45 CFR 164.504(f).

What HIPAA Means to Employers

What HIPAA means to employers generally is that they do not have to implement measures to protect the privacy of individually identifiable health information in accordance with the Privacy and Security Rules, nor notify employees and HHS´ Office for Civil Rights in the event of a data breach. However, HIPAA is not the only legislation that relates to the privacy and security of employee data.

Other federal laws such as the Fair Credit Reporting Act and Fair and Accurate Credit Transaction Act govern what employers can do with certain types of employee data, while state laws such as the California Privacy Rights Act grants employees rights over what data is maintained about them similar to the patients´ right provisions of the HIPAA Privacy Rule.

Employers and Protected Health Information: Conclusion

The answer to the question “Does HIPAA Apply to Employers” is generally “no”. However there are circumstances in which employers are subject to HIPAA with regard to safeguarding the confidentiality, integrity and security of Protected Health Information. These circumstances may be few and far between; but, when they occur, it is important employers are aware of their compliance obligations.

In most cases, HIPAA does not prevent an employer from announcing the birth of a child to the parent´s workplace colleagues, but it will likely apply if an employer administers a self-insured health plan or acts as an intermediary in a high-deductible, consumer-directed health plan. Companies still unsure about how HIPAA applies to employers should seek professional advice relevant to their specific circumstances.

Does HIPAA Apply to Employers? FAQs

If I give my employer a doctor’s note to prove I was sick, does HIPAA apply to the doctor’s note?

If you give your employer a doctor’s note to prove you were sick, HIPAA does not apply to the doctor’s note, even if you work for a covered entity or business associate. This is because the doctor’s note will not be used for a HIPAA-covered transaction. The doctor’s note is considered to be part of your employment record, like any other personal information you might provide to your employer.

If an employer phones a hospital to enquire about the wellbeing of an employee, is the information provided by the hospital covered by HIPAA?

If an employer phones a hospital to enquire about the wellbeing of an employee, the information provided by the hospital is not covered by HIPAA once it has been disclosed to the employer. by the hospital provided. However, before any information is disclosed to an employer by a hospital, the hospital must obtain the employee´s consent to disclose PHI. A disclosure to an employer without consent – other than permissible disclosures for workers’ comp purposes and to comply with OSHA – is a violation of HIPAA.

Does HIPAA apply to employers in medical teaching institutions?

HIPAA can apply to employers in medical teaching institutions depending on the nature of medical services provided by the institution. If medical services are only available to employees and students, the institution is not a HIPAA covered entity because the provision of medical services to employees is not portable and the provision of medical services to students is covered by FERPA.

If medical services are available to the public, the institution is a hybrid entity required to comply with HIPAA for the medical services provided to members of the public, but not for non-portable medical services provided to employees or for FERPA-covered medical services provided to students. Further information about hybrid entities can be found in this HHS article.

If an employer is a federal agency, does HIPAA or the Privacy Act apply?

If an employer is a federal agency that qualifies as a covered entity and engages in HIPAA-covered transactions, HIPAA preempts the Privacy Act. In most other circumstances, federal agencies have to comply with the Privacy Act – the exceptions being when state or local laws offer greater protections to health information than HIPAA or the Privacy Act.

Does HIPAA apply to employers that are business associates of a covered entity?

HIPAA does not apply to employers that are business associates of a covered entity if a business associate in its role as an employer maintains employee healthcare data that is not used for HIPAA-covered transactions. In such cases, the business associate is not subject to HIPAA in respect of employee data – but still subject to HIPAA in respect of any ePHI received from the covered entity with whom the employer has a Business Associate Agreement.

Can an employer ask about medical conditions under HIPAA?

An employer can ask about medical conditions under HIPAA because employers – in their role of employers – are not covered entities. In the Privacy Rule there is nothing preventing an employer asking an employee about medical conditions that would violate HIPAA. However, if an employer asks a covered entity to disclose information about an employee´s medical condition, HIPAA only permits the disclosure under certain circumstances or with the consent of the employee.

When does HIPAA apply to employers?

HIPAA applies to employers when they create, maintain, or transmit Protected Health Information in connection with a HIPAA-covered transaction. This is a rare occurrence, and usually only happens when the employer administers a self-insured health plan. In such circumstances, the Protected Health Information created, maintained, or transmitted by the self-insured health plan should be kept separate from other employee data – which is not subject to the Privacy and Security Rules.

Is a new employee’s health information disclosed to an HR department protected by HIPAA?

A new employee’s health information disclosed to an HR department is not protected by HIPAA unless the information will be disclosed in a HIPAA-covered transaction by an employer who qualifies as a HIPAA covered entity. This is an extremely rare event – even if the new employee’s role is with a healthcare facility – because employers do not ordinarily qualify as HIPAA covered entities in their role as an employer.

What does “partial compliance” mean for employers in the context of HIPAA?

What partial compliance means in the context of HIPAA is that, if an employer administers a self-insured health plan or acts as an intermediary between employees, healthcare providers, and health plans, the employer is required to safeguard the PHI they have access to in their role as an administer or intermediary and certify that PHI will be protected as prescribed by the HIPAA Privacy Rule and not used for employment-related actions.

Can an employer announce the birth of a child to a parent’s workplace colleagues without violating HIPAA?

An employer can announce the birth of a child to a parent’s workplace colleagues without violating HIPAA unless the employer administers a self-insured health plan or acts as an intermediary between the parent and a health plan and learns of the birth in their role as an administrator or intermediary. In such circumstances, it would be necessary to obtain the parent’s consent to avoid violating HIPAA.

What is a HIPAA-covered transaction?

A HIPAA-covered transaction is any transaction that the Department of Health and Human Services has developed standards for in Part 162 of the HIPAA Administrative Simplification Regulations. Most HIPAA-covered transactions relate to eligibility checks for treatment, authorizations for treatment, billing, and remittances – transactions that rarely apply to employers in their role as employers.

If an employer qualifies as a partial entity, what is the first step to take to avoid HIPAA violations?

If an employer qualifies as a partial entity, the first step to take to avoid HIPAA violations is to understand what information collected, maintained, or transmitted by the employer is protected by the Privacy Rule. Thereafter, the employer must implement safeguards to protect the privacy of individually identifiable health information and to ensure the confidentiality, integrity, and availability of electronic PHI.

The post Does HIPAA Apply to Employers? appeared first on HIPAA Journal.

Can A Patient Sue for A HIPAA Violation?

Posted November 7, 2017 by HIPAA Journal

Yes, a patient can sue for a HIPAA violation and there are an increasing number of class action suits for protected health information data breaches, although not under the provisions of the HIPAA law. There is no private cause of action in HIPAA, so it is not possible for a patient to directly sue for a HIPAA violation under the HIPAA law. Even if HIPAA Rules have clearly been violated by a healthcare provider, and harm has been suffered as a direct result, it is not possible for patients to seek damages, at least not for the violation of HIPAA Laws. So, if it is not possible for a patient to directly sue for a HIPAA violation, does that mean legal action cannot be taken against a covered entity when HIPAA has clearly been violated? While HIPAA does not have a private cause of action, it is possible for patients to take legal action against healthcare providers and obtain damages for violations of state laws.

In some states, it is possible to file a lawsuit against a HIPAA covered entity on the grounds of negligence or for a breach of an implied contract, such as if a covered entity has failed to protect medical records. In such cases, it will be necessary to prove that damage or harm has been caused as a result of negligence or the theft of unsecured personal information.

Taking legal action against a covered entity can be expensive and there is no guarantee of success. Patients should therefore be clear about their aims and what they hope to achieve by taking legal action. An alternative course of action may help them to achieve the same aim.

Filing Complaints for HIPAA Violations

If HIPAA Rules are believed to have been violated, patients can file complaints with the federal government and in most cases complaints are investigated. Action may be taken against the covered entity if the compliant is substantiated and it is established that HIPAA Rules have been violated. The complaint should be filed with the Department of Health and Human Services’ Office for Civil Rights (OCR).

While complaints can be filed anonymously, OCR will not investigate any complaints against a covered entity unless the complainant is named and contact information is provided.

A complaint should be filed before legal action is taken against the covered entity under state laws. Complaints must be filed within 180 days of the discovery of the violation, although in limited cases, an extension may be granted.

Complaints can also be filed with state attorneys general, who also have the authority to pursue cases against HIPAA-covered entities for HIPAA violations.

The actions taken against the covered entity will depend on several factors, including the nature of the violation, the severity of the violation, the number of individuals impacted, and whether there have been repeat violations of HIPAA Rules.

The penalties for HIPAA violations are detailed here, although many complaints are resolved through voluntary compliance, by issuing guidance, or if an organization agrees to take corrective action to resolve the HIPAA issues that led to the complaint. Complaints may also be referred to the Department of Justice to pursue cases if there has been a criminal violation of HIPAA Rules.

Complaints about individuals can also be filed with professional boards such as the Board of Medicine and the Board of Nursing.

How to File a Lawsuit for a HIPAA Violation

If you have been informed that your protected health information has been exposed as a result of a healthcare data breach, or you believe your PHI has been stolen from a specific healthcare organization, you may be able to take legal action against the breached entity to recover damages for any harm or losses suffered as a result of the breach.

The first step to take is to submit a complaint about the violation to the HHS’ Office for Civil Rights. This can be done in writing or via the OCR website. If filing a complaint in writing, you should use the official OCR complaint form and should keep a copy to provide to your legal representative.

You will then need to contact an attorney to take legal action against a HIPAA covered entity. You can find attorneys through your state or local bar association. Try to find an attorney or law firm well versed in HIPAA regulations for the greatest chance of success and contact multiple law firms and speak with several attorneys before making your choice.

There will no doubt be many other individuals who are in the same boat, some of whom may have already taken legal action. Joining an existing class action lawsuit is an option. The more individuals involved, the stronger the case is likely to be.

Many class action lawsuits have been filed on behalf of data breach victims that have yet to experience harm due to the exposure or theft of their data. The plaintiffs claim for damages for future harm as a result of their data being stolen. However, without evidence of actual harm, the chances of success will be greatly reduced.

Can a Patient Sue for a HIPAA Violation? FAQs

What kind of lawyer deals with HIPAA violations?

Most lawyers will be prepared to offer advice about whether you have a claim for a HIPAA violation; and, if the violation occurred with the previous 180 days, may pursue a civil claim on your behalf against a Covered Entity or Business Associate. Often the lawyer´s willingness to take on a claim will depend on the nature of the violation, the nature of harm you suffered, and the state laws that apply in your location.

What happens after a HIPAA complaint is filed?

This depends on who you make the complaint to. If you complain directly to the organization that violated your HIPAA rights, the complaint will be dealt with internally (unless it involves a breach of unsecured PHI, in which case the organization is required by law to notify HHS´ Office for Civil Rights.

If you complain to a state Attorney General, the Office of the Attorney General may investigate the organization directly on your behalf or escalate your complaint to HHS´ Office for Civil. If the complaint is escalated – or you complain directly to the Office for Civil Rights – your compliant will be acknowledged and sent for review.

If the review confirms a HIPAA violation, the organization will be contacted to obtain their “side of the story”. Depending on how the organization responds, the Office for Civil Rights may initiate an investigation or reject your compliant. You will be informed of the decision and any subsequent outcome of an investigation.

Has a patient ever successfully sued for a HIPAA violation?

No. However, the HIPAA Privacy Standards have been used in court cases as a benchmark of the level of privacy an individual can reasonably expect. One of the most frequently-quoted cases in this respect is Byrne versus the Avery Center for Obstetrics and Gynecology. This case was originally denied when the plaintiff pursued compensation for a violation of HIPAA, but the decision was reversed on appeal when the claim was changed to a violation in the duty of confidentiality.

Have there ever been successful class actions for a HIPAA violation?

There have been several settled class actions involving HIPAA Covered Entities who have failed to adequately protect personal information (note: not for violating HIPAA). Furthermore, class actions are frequently settled without an admission of liability (as in Jessie Seranno et al. v. Inmediata Corp.), so it would be incorrect to classify the class actions as “successful”.

How can I find out if my state has a privacy law I can use to claim for a HIPAA violation?

The International Association of Privacy Professionals maintains a web page tracking privacy legislation by state. It is important to note that many of the privacy laws listed on the web page are still to be passed or enacted, and some may not contain provisions that could support a claim for a HIPAA violation. To establish whether you have a claim for a HIPAA violation under your state´s consumer rights legislation, you should speak with an attorney.

I have received a letter stating my health data has been breached. What should I do?

Your response to the breach should be appropriate to nature of the data disclosed. The nature of the data exposed should be explained to you in the letter as well as advice on the measures you should take to protect yourself from fraud and theft. The letter should also contain contact information to find out more about the breach. In several cases, healthcare organizations have provided free credit monitoring services, and it may be in your best interests to find out if these are available to you.

What happens after a HIPAA complaint is filed?

This depends on who the complaint is made to, the nature of the violation, and whether it involves a criminal motive. Complaints made by patients directly to their healthcare provider are usually dealt with internally unless they involve an impermissible disclosure of unsecured PHI – in which case the healthcare provider will escalate it to HHS´ Office for Civil Rights under the Breach Notification Rule.

When a complaint is escalated – or when a complaint is made directly to HHS´ Office for Civil Rights – the complaint is reviewed to see if it is justifiable and, if so, if it can be resolved via technical assistance. If the resolution of the complaint requires more than technical assistance, HHS´ Office for Civil Rights will conduct an investigation and potentially impose a correct action plan or fine.

Complaints can also be made to state attorneys general, who work with HHS´ Office for Civil Rights to resolve the violation. However, if a violation potentially involves a criminal motive, the Office for Civil Rights will refer the complaint to the Department of Justice for investigation. In these cases, the person making the complaint may be required to provide evidence for the investigation to proceed.

The post Can A Patient Sue for A HIPAA Violation? appeared first on HIPAA Journal.

The 10 Most Common HIPAA Violations You Should Avoid

Posted October 26, 2017 by HIPAA Journal

HIPAA violations most often occur when covered entities, business associates, or members of either’s workforces fail to comply with the Privacy, Security, or Breach Notification Rules. There are many different types of HIPAA violations, and the ten most common HIPAA violations that have resulted in financial penalties are:

Snooping on Healthcare Records
Failure to Perform an Organization-Wide Risk Analysis
Failure to Manage Security Risks / Lack of a Risk Management Process
Denying Patients’ Access to Health Records/Exceeding Timescale for Providing Access
Failure to Enter into a HIPAA-Compliant Business Associate Agreement
Insufficient ePHI Access Controls
Failure to Use Encryption or an Equivalent Measure to Safeguard ePHI on Portable Devices
Exceeding the 60-Day Deadline for Issuing Breach Notifications
Impermissible Disclosures of Protected Health Information
Improper Disposal of PHI

In this article we outline how you can avoid these common HIPAA violations. Ten Most Common HIPAA Violations

You can also use the article in conjunction with our free HIPAA Violations Checklist to understand what is required to ensure full compliance. Use any form on this page to arrange for your copy of the checklist.

What are the 10 Most Common HIPAA Violations?

Listed below are 10 of the most common HIPAA violations, together with examples of HIPAA-covered entities and business associates that have been discovered to be in violation of HIPAA Rules.

These example cases have had to settle those violations with the Department of Health and Human Services’ Office for Civil Rights (OCR) and state attorneys general. In many cases, investigations have uncovered multiple HIPAA violations.

The settlements pursued by OCR are for egregious violations of HIPAA Rules. Settlements are also pursued to highlight common HIPAA violations to raise awareness of the need to comply with specific aspects of HIPAA Rules.

The settlement amounts reflect the seriousness of the violation, the length of time the violation has been allowed to persist, the number of violations identified, and the financial position of the covered entity/business associate.

1. Snooping on Healthcare Records

What are the ten most common HIPAA violations Accessing the health records of patients for reasons other than those permitted by the Privacy Rule is a violation of patient privacy. Snooping on healthcare records of family, friends, neighbors, co-workers, and celebrities is one of the most common HIPAA violations committed by employees. When discovered, these violations can result in termination of employment but could also result in criminal charges for the employee concerned. Financial penalties for healthcare organizations that have failed to prevent snooping are relatively uncommon, but they are possible – as the University of California Los Angeles Health System discovered.

University of California Los Angeles Health System was fined $865,000 for failing to restrict access to medical records. The healthcare provider was investigated following the discovery that a physician had accessed the medical records of celebrities and other patients without authorization. Dr. Huping Zhou accessed the records of patients without authorization 323 times after learning that he would soon be dismissed. Dr. Zhou became the first healthcare employee to be jailed for a HIPAA violation and was sentenced to four months in federal prison.

2. Failure to Perform an Organization-Wide Risk Analysis

The failure to perform an organization-wide risk analysis is one of the most common HIPAA violations to result in a financial penalty. If the risk analysis is not performed regularly, organizations will not be able to determine whether any vulnerabilities to the confidentiality, integrity, and availability of PHI exist. Risks are likely to remain unaddressed, leaving the door wide open for violations to occur.

HIPAA settlements with covered entities for the failure to conduct an organization-wide risk assessment include:

Premera Blue Cross– $6,850,000 settlement for risk analysis and risk management failures, and other potential HIPAA violations
Excellus Health Plan – $5,100,000 settlement for risk analysis and risk management failures, and other potential HIPAA violations
Oregon Health & Science University– $2.7 million settlement for the lack of an enterprise-wide risk analysis.
Cardionet – $2.5 million settlement for an incomplete risk analysis and lack of risk management processes.
Cancer Care Group – $750,000 settlement for the failure to conduct an enterprise-wide risk analysis.
Lahey Hospital and Medical Center – $850,000 settlement for the failure to conduct an organization-wide risk assessment and other HIPAA violations.
Steven A. Porter, M.D – $100,000 penalty for risk analysis and risk management failures.
iHealth Solutions (dba Advantum Health) – $75,000 penalty for the failure to conduct an accurate and thorough risk analysis.

3. Failure to Manage Security Risks / Lack of a Risk Management Process

Performing a risk analysis is essential, but it is not just a checkbox item for compliance. Risks that are identified must then be subjected to a risk management process. They should be prioritized and addressed in a reasonable time frame. Knowing about risks to PHI and failing to address them is one of the most common HIPAA violations penalized by the Office for Civil Rights.

HIPAA settlements with covered entities for the failure to manage identified risks include:

Alaska Department of Health and Social Services – $1.7 million penalty for the failure to perform risk analysis and risk management failures.
University of Massachusetts Amherst (UMass) – $650,000 penalty for risk management failures.
Metro Community Provider Network – $400,000 penalty for risk management failures.

4. Denying Patients Access to Health Records/Exceeding Timescale for Providing Access

The HIPAA Privacy Rule gives patients the right to access their medical records and obtain copies on request. This allows patients to check their records for errors and share them with other entities and individuals. Denying patients access to health records, overcharging for copies, or failing to provide records within 30 days is a violation of HIPAA. OCR made HIPAA Right of Access violations one of its key enforcement objectives in late 2019.

HIPAA settlements with covered entities for denying patients access to their records or unnecessary delays in providing access include:

Great Expressions Dental Center of Georgia, P.C. – $80,000 penalty for excessive charges for a copy of PHI and delay in providing records.
Cignet Health of Prince George’s County – $4,300,000 penalty for denying patients access to their medical records.
Banner Health – $200,000 penalty for the delayed response to a patient’s request for a copy of their medical records.
Dignity Health, dba St. Joseph’s Hospital and Medical Center – $160,000 penalty for a delayed response to a patient’s request for a copy of their medical records.
NY Spine – $100,000 penalty for the delayed response to a patient’s request for a copy of their medical records.
Beth Israel Lahey Health Behavioral Services – $70,000 penalty for the delayed response to a patient’s request for a copy of their medical records.
University of Cincinnati Medical Center – $65,000 penalty for the delayed response to a patient’s request for a copy of their medical records.
Housing Works Inc – $38,000 penalty for the delayed response to a patient’s request for a copy of their medical records.
Peter Wrobel, M.D., P.C., dba Elite Primary Care – $36,000 penalty for a delayed response to a patient’s request for a copy of their medical records.
Riverside Psychiatric Medical Group – $25,000 penalty for a delayed response to a patient’s request for a copy of their medical records.
Dr. Rajendra Bhayani – $15,000 penalty for the delayed response to a patient’s request for a copy of their medical records.
All Inclusive Medical Services Inc – $15,000 penalty for the delayed response to a patient’s request for a copy of their medical records.
Wise Psychiatry, PC – $10,000 penalty for the delayed response to a patient’s request for a copy of their medical records.
King MD – $3,500 penalty for the delayed response to a patient’s request for a copy of their medical records.
OCR Announces 11 Enforcement Actions – One CMP and 10 settlements were announced by OCR in July 2021 to resolve Right of Access violations.

5. Failure to Enter into a HIPAA-Compliant Business Associate Agreement

The failure to enter into a HIPAA-compliant business associate agreement with all vendors that are provided with or given access to PHI is another of the most common HIPAA violations. Even when business associate agreements are held for all vendors, they may not be HIPAA compliant, especially if they have not been revised after the Omnibus Final Rule.

Notable settlements for these common HIPAA violations include:

MedEvolve Inc. – $350,000 settlement for lack of business associate agreement with a subcontractor and other HIPAA violations.
Raleigh Orthopedic Clinic, P.A. of North Carolina – $750,000 settlement for the failure to execute a HIPAA-compliant business associate agreement.
North Memorial Health Care of Minnesota – $1.55 million settlement for failing to enter into a BAA with a major contractor and other HIPAA violations.
Care New England Health System– $400,000 settlement for the failure to update business associate agreements

6. Insufficient ePHI Access Controls

The HIPAA Security Rule requires covered entities and their business associates to limit access to ePHI to authorized individuals. The failure to implement appropriate ePHI access controls is also one of the most common HIPAA violations and one that has attracted several financial penalties.

Financial penalties issued to covered entities for ePHI access control failures include:

Anthem Inc. – $16,000,000 penalty for access control failures and other serious HIPAA violations.
Memorial Healthcare System – $5,500,000 penalty for insufficient ePHI access controls.
Texas Department of Aging and Disability Services – $1,600,000 penalty for risk analysis failures, access control failures, and information system monitoring failures.
University of California Los Angeles Health System – $865,500 penalty for the failure to restrict access to medical records.
Pagosa Springs Medical Center – $111,400 penalty for the failure to terminate access to ePHI after an employee termination and a lack of a business associate agreement.

7. Failure to Use Encryption or an Equivalent Measure to Safeguard ePHI on Portable Devices

One of the most effective methods of preventing data breaches is to encrypt PHI. Breaches of encrypted PHI are not reportable security incidents unless the key to decrypt data is also accessed. Encryption is not mandatory under HIPAA Rules, but it cannot be ignored. If the decision is taken not to use encryption, an alternative, equivalent security measure must be used in its place.

Recent settlements for the failure to safeguard PHI include:

Children’s Medical Center of Dallas – $3.2 million civil monetary penalty for failing to take action to address known risks, including the failure to use encryption on portable devices.
Catholic Health Care Services of the Archdiocese of Philadelphia– $650,000 settlement for the failure to use encryption, the failure to conduct an enterprise-wide risk analysis, and to manage risks.
Lifespan Health System Affiliated Covered Entity – $1,040,000 penalty for the failure to encrypt data and implement appropriate device and media controls, resulting in the impermissible disclosure of 20,431 patients’ ePHI

8. Exceeding the 60-Day Deadline for Issuing Breach Notifications

The HIPAA Breach Notification Rule requires covered entities to issue notifications of breaches without unnecessary delay, and certainly no later than 60 days following the discovery of a data breach. Exceeding that time frame is one of the most common HIPAA violations, which has seen several recent penalties issued:

Oklahoma State University Center for Health Sciences – $875,000 settlement for delayed breach notifications to individuals and the HHS, and to resolve 5 other HIPAA violations.
Presence Health – $475,000 settlement for delaying the issuing of breach notifications by a month.
CoPilot Provider Support Services Inc. – $130,000 settlement with NY Attorney General for delayed breach notifications.

9. Impermissible Disclosures of Protected Health Information

Any disclosure of protected health information that is not permitted under the HIPAA Privacy Rule can attract a financial penalty. This violation category includes disclosing PHI to a patient’s employer for a purpose not permitted by the Privacy Rule, potential disclosures following the theft or loss of unencrypted laptop computers, careless handling of PHI, disclosing PHI unnecessarily, not adhering to the ‘minimum necessary’ standard, and disclosures of PHI after patient authorizations have expired.

Settlements for impermissible disclosures of PHI include:

Dr. U. Phillip Igbinadolor, D.M.D. & Associates, P.A. – $50,000 civil monetary penalty for impermissible disclosures of PHI on social media websites
Northcutt Dental-Fairhope – $62,500 settlement for unauthorized use of PHI for marketing, an insufficient notice of privacy practices, and no HIPAA Privacy Officer
New Vision Dental – $23,000 settlement for disclosing PHI in responses to patient reviews on the Yelp review platform
Memorial Hermann Health System – $2.4 million settlement for disclosing a patient’s PHI in a press release.
New York Presbyterian Hospital – $2,200,000 penalty for filming patients without consent.
Massachusetts General Hospital– $515,000 penalty for filming patients without consent.
Luke’s-Roosevelt Hospital Center – $387,000 settlement for careless handling of PHI/Disclosure of a patient’s HIV status to their employer.
Brigham and Women’s Hospital– $384,000 penalty for filming patients without consent.
Boston Medical Center – $100,000 penalty for filming patients without consent.

10. Improper Disposal of PHI

When physical PHI and ePHI are no longer required and retention periods have expired, HIPAA Rules require the information to be securely and permanently destroyed. For paper records this could involve shredding or pulping and for ePHI, degaussing, securely wiping, or destroying the electronic devices on which the ePHI is stored to prevent impermissible disclosures.

Financial penalties issued to covered entities for improper disposal of PHI/ePHI include:

New England Dermatology and Laser Center – $300,640 penalty for disposing of empty specimen containers with regular trash, exposing the PHI of 58,106 individuals over 10 years.
Parkview Health – $800,000 penalty for the failure to securely dispose of paper records containing PHI.
Cornell Prescription Pharmacy – $125,000 penalty for the improper disposal of PHI.
FileFax Inc. – $100,000 penalty for a defunct business over improper disposal of medical records.

Non-Financial HIPAA Violation Examples

HIPAA violations do not always result in financial penalties. Many violations of HIPAA investigated by OCR are resolved by guidance, technical assistance, and/or a corrective action plan depending on the nature of the violation and the harm caused, the covered entity’s previous history of violations, and their willingness to cooperate with an OCR investigation.

Because violations resolved by guidance, technical assistance, and/or a corrective action plan rarely attract headlines, some of the work done by OCR to promote compliance with HIPAA can be overlooked. However, as of March 2022, OCR has investigated and resolved 29,478 cases without issuing a financial penalty. Non-financial HIPAA violation examples include:

A hospital was required to implement new minimum necessary policies for telephone messages after an employee left a telephone message with the daughter of a patient that detailed both her medical condition and treatment plan.
A mental health center was required to correct its process for providing Notices of Privacy Practices prior to an intake assessment after the center failed to provide the father of a minor patient with an NPP prior to a mental health evaluation.
A covered entity was required to withdraw a $100 “records review fee” charged to a patient for providing the patient with copies of his medical records. Under the Privacy Rule, covered entities are only allowed to charge a reasonable cost-based fee.
A private practice was required to implement policies on the verbal communication of PHI after a staff member discussed HIV testing procedures with a patient in the practice´s waiting room – thereby disclosing PHI to others in the waiting room.
A radiology practice was required to revise its processes for workers´ compensation disclosures after a patient´s imaging tests were sent to the patient´s employer to support a claim for which the employer´s program was not responsible for payment.
A health plan was required to correct a flaw in its computer system, review transactions for a six-month period, and correct corrupted patient information after PHI was included in an explanation of benefits letter mailed to an unauthorized family member.

Examples of HIPAA Violations by Healthcare Employees

Snooping on healthcare records is a fairly obvious HIPAA violation and one that all healthcare employees who have received HIPAA training should know is a violation of their employer’s policies and HIPAA Rules.

Other examples of HIPAA violations often come about as a result of misunderstandings about HIPAA requirements. While each of these common HIPAA violations affect far fewer numbers of patients than the above violations, they can still cause a significant amount of harm to the patient(s) involved and their employer. They can also result in disciplinary action against the employee responsible – including termination.

Listed below are some of the common HIPAA violations committed by healthcare employees. These common HIPAA violations should be covered as part of the HIPAA training given to employees to raise awareness of these frequent areas of noncompliance.

Emailing ePHI to Personal Email Accounts and Removing PHI from a Healthcare Facility

It can be difficult to find the time to complete all the necessary tasks within working hours and it can be tempting to take work home to complete. Removing protected health information from a healthcare facility places that information at risk of exposure. This is a common employee HIPAA violation and may even be routine practice at a healthcare facility that is understaffed. That does not mean it is an acceptable practice.

The same applies to emailing ePHI to personal email accounts. Regardless of the intentions, whether it is to get help with spreadsheets, complete work at home to get ahead for the next day, or to catch up on a backlog, it is a violation of HIPAA Rules. Further, any emailing of ePHI to a personal email account could be considered theft – the repercussions of which could be far more severe than the termination of an employment contract.

Leaving Portable Electronic Devices and Paperwork Unattended

The HIPAA Security Rule requires PHI and ePHI to be secured at all times. If paperwork is left unattended it could be viewed by an unauthorized individual, be that a member of staff, patient, or visitor to the healthcare facility. Were that to happen it would be considered an impermissible disclosure of PHI.

Electronic devices that contain ePHI must similarly be secured at all times. Electronic devices are portable and valuable. Opportunistic thieves could easily steal an unattended device and gain access to ePHI. There have been many cases of healthcare employees removing unencrypted devices from healthcare facilities, only for them to be stolen from vehicles or homes. Theft can also easily occur within a healthcare facility if devices are not secured. Healthcare employees must ensure that their employer’s policies are followed, and HIPAA Rules are not violated by leaving devices and paperwork unattended.

Releasing Patient Information to an Unauthorized Individual

An authorization form must be obtained from a patient before any of their PHI can be disclosed to a third party for a purpose other than one expressly permitted by the HIPAA Privacy Rule. Disclosing PHI for purposes other than treatment, payment for healthcare, or healthcare operations (and limited other cases) is a HIPAA violation if authorization has not been received from the patient in advance.

Healthcare employees must ensure that, prior to disclosing PHI to a third party, authorization has been obtained from the patient, and information is not disclosed to any individual or company not included on the authorization form. Authorization forms are only valid if they have been signed by the patient or their nominated representative.

Releasing Patient Information Without Authorization

In a similar vein to the previous point, healthcare employees must also exercise caution about the types of information that are released to third parties, even if an authorization form has been received allowing a specific individual, company, or organization to receive PHI.

The authorization form should include what types of information have been authorized to be released. Any information not detailed on the authorization form must remain private and confidential and should not be shared. The disclosure of additional information would violate the HIPAA Privacy Rule.

Disclosures of PHI to Third Parties After the Expiry of an Authorization

All HIPAA authorization forms must include the names or classes of individuals who are being authorized to receive PHI, the types of PHI that will be disclosed, and the reasons for the disclosures. They must also include an expiry date for the authorization.

PHI must not be disclosed to any individual listed on the authorization form after the expiry date has passed, even if authorization has previously been given to that entity to receive PHI. A new authorization form is required before any further disclosure takes place. It should also be noted that an authorization form without an expiry date is not HIPAA compliant.

Impermissible Disclosures of Patient Health Records

The HIPAA Privacy Rule permits patients to obtain a copy of their health records on request or have their records provided to a nominated third party such as a personal representative or other individual. If not collected in person by the patient, the third party must have been given authorization by the patient – on a HIPAA authorization form – to receive the records before they can be released.

Prior to providing copies of patient health records, healthcare employees must verify the identity of the patient or the person collecting the records and must ensure records are only released to an individual authorized to receive them. Care must also be taken to ensure that the correct patient records are released.

Downloading PHI onto Unauthorized Devices

It can be difficult for healthcare IT departments to keep track of all devices that connect to the network, given how many different devices have network access. Ensuring those devices are secured can be an even bigger problem, yet this is a requirement for HIPAA compliance.

Employees need to be aware that there are privacy and security risks associated with downloading ePHI to unauthorized portable electronic devices. Not only does this increase the risk of the accidental disclosure of ePHI – in the event that the device is lost or stolen – it could also be viewed as theft and a HIPAA violation.

Providing Unauthorized Access to Medical Records

It is the responsibility of the covered entity to ensure that access to patient health information and medical records is only given to authorized individuals. This is achieved by implementing access controls via unique logins.

Employees have a responsibility to ensure that they do not give access to health information to co-workers who may not have the same access rights. The sharing of login credentials could not only result in an impermissible disclosure of ePHI but any actions taken by that employee would also be attributed to the individual whose login credentials were used to gain access.

Actual Examples of HIPAA Violations by Employees

There are not very many examples of HIPAA violations by employees because most are dealt with internally according to the organization´s sanction policy. However, in a few cases, employees´ contracts are terminated and examples of HIPAA violations by employees are brought to the attention of the outside world. The following is a small selection of those we have reported on:

In May 2013, Dianna Hereford was terminated from her position as a staff nurse at the Norton Audubon Hospital for improperly disclosing the condition of a patient with Hepatitis C. Hereford claimed she was wrongfully dismissed for an incidental disclosure; but her claim was dismissed by Jefferson Circuit Court and by Kentucky´s Court of Appeals when she appealed the decision.

In March 2017, an employee of New Jersey-based BioReference Laboratories was terminated from their position for failing to securely dispose of documents containing the PHI of 1,772 patients. Rather than following the company´s policy for disposing of PHI, which involved shredding the documents before disposing of them, the employee threw the documents into a dumpster.

Also in 2017, an employee of Lowell General Hospital in Massachusetts was fired for snooping on the healthcare records of 769 patients. As mentioned above, snooping on healthcare records is one of the most common HIPAA violations; but whereas it normally impacts patients who are known to the employee, this was an extreme example of a HIPAA violation by an employee.

Uncommon HIPAA Violations

The common HIPAA violations described above are frequently cited in OCR’s enforcement actions and are common root causes of data breaches; however, there are many types of HIPAA violations. The violations listed below are less common, and in some cases, harder to detect, and do not get reported so frequently.

Uncommon HIPAA Violations	Description
Filming Patients without Consent	Filming patients without their consent is a HIPAA violation if it results in the unauthorized disclosure of protected health information, compromising patient privacy and failing to adhere to HIPAA’s requirements for patient consent and privacy protection. New York Presbyterian Hospital – $2,200,000 penalty for filming patients without consent. Massachusetts General Hospital– $515,000 penalty for filming patients without consent. Brigham and Women’s Hospital– $384,000 penalty for filming patients without consent. Boston Medical Center – $100,000 penalty for filming patients without consent.
Impermissible Data Sharing During Medical Research	Inadequate protection of patient data during collaborative medical research, potentially exposing sensitive information. Researchers must ensure that data sharing adheres to strict privacy safeguards and obtain proper patient consent, when required, to avoid HIPAA violations. Effective safeguards are essential when conducting research that involves patient data that has not been de-identified to prevent unintended exposure. Huntington Medical Research Institutes Discovers Two HIPAA Breaches Hospital Researchers Jailed for Stealing and Selling Research Data to China
Non-Secure File Sharing	Sharing patient records through non-secure methods such as personal email accounts or unencrypted file-sharing services is a HIPAA violation. This can occur if proper policies and procedures are not in place and is often the result of insufficient training. Using secure (encrypted) communications tools is necessary to prevent these breaches, and there must be a business associate agreement in place with the provider of a communication platform. 11K Dental Patients’ PHI Uploaded to File Sharing Website
Exposure of Patient Data in Home-Based Care	Lack of adequate data security measures in home-based healthcare settings can lead to unauthorized access to patient records in private residences. Ensuring patient data privacy is essential, even in non-traditional care settings. Secure practices must be used for accessing and transmitting patient information. Data Issue Arises From Home Diabetes Test
Data Exposure when Working from Home	Exposure of patient data to unauthorized individuals when working from home. When taking paperwork home or working on portable devices, PHI must be protected. While family members and other individuals in the same household may be trusted, they are not authorized to view any patient data. Care must be taken not to leave devices or paperwork unattended with patient data visible. Potential PHI Disclosure After Employee Works from Home with Hospital Data
Medical Records Sent to Incorrect Patients	Sending medical records to incorrect patients is a HIPAA violation as it constitutes an unauthorized disclosure of protected health information (PHI), compromising patient privacy and failing to safeguard their confidential medical information. Mailing Error Affects 19,570 Missouri Care Members
Mailing Correspondence with PHI Visible	When PHI is visible on the outside of an envelope or package, it can be easily seen by unauthorized individuals who handle or come into contact with the mail, leading to an unauthorized disclosure of sensitive health information. Patients have the right to expect that their health information will be kept private. Mailing correspondence with visible PHI breaches patient privacy and can cause distress and concern for patients who discover that their sensitive information is exposed. HIPAA mandates that appropriate safeguards, such as physical and administrative safeguards, be in place to protect PHI from unauthorized access or disclosure. Mailing correspondence with visible PHI demonstrates a lack of these safeguards. Amida Care Mailing Potentially Revealed HIV Status of its Members Third-Party Mailing Error Sees Aetna Plan Members’ HIV Status Disclosed
Unauthorized Photographs/Sharing of Photographs	Taking photographs of patients without authorization and unauthorized sharing of images is a HIPAA violation. It is not permitted to share photographs of patients with unauthorized individuals, even with other healthcare professionals if the file is shared for reasons other than for treatment, payment, or healthcare operations purposes. Hospital Staff Shared Photographs of Patient’s Genital Injury Scrub Nurse Fired for Photographing Employee-Patient’s Genitals
Workplace Sabotage	Deliberate sabotage of healthcare systems, data alteration, or introduction of malware by disgruntled employees is a HIPAA violation. Robust security measures must be implemented, employees should be monitored, and access to data and systems should be promptly revoked when employees are terminated or otherwise leave employment. Former IT Consultant Charged with Intentionally Causing Damage to Healthcare Company’s Server
Providing Family Members, Friends, and Partners with Access to PHI	Allowing family members, friends, and partners to access a patient’s medical records without proper authorization or accessing records on their behalf and disclosing PHI. Individuals requesting access to patient data must be authorized to access that information, and PHI may only be disclosed to individuals authorized to receive it. Employees must be made aware of their responsibilities under HIPAA. Criminal HIPAA Violation Case Sees Healthcare Worker Arraigned on 430 Counts $853,000 Awarded to Patient Whose PHI Was Impermissibly Disclosed to Former Boyfriend
Data Exposure During Telehealth Visits	Inadequate protection of patient data when conducting telehealth visits. While OCR issued a Notice of Enforcement Discretion covering the good faith provision of telehealth services during the pandemic and allowed non-public-facing communication tools for telehealth, the period of enforcement discretion is over. Only HIPAA-compliant communications tools can be used, that encrypt or otherwise secure communications, and there must be a business associate agreement in place. OCR’s COVID-19 Telehealth Enforcement Discretion Transition Period Ends
Unauthorized Use of Medical Illustrations	Unauthorized use of medical illustrations or images containing patient information in presentations, publications, or websites. Consent must be obtained before any images that have not been de-identified according to HIPAA standards can be used in presentations, publications, or for training purposes. Student Sues Hospital for Unauthorized Use of PHI as Teaching Tool Radiology Groups Issue Warning About PHI Exposure in Online Medical Presentations
Medical Students Tracking Patients on EHRs	Medical students tracking former patients on EHRs to view outcomes and progress is a HIPAA violation unless patient consent has been obtained. Accessing the medical records of former patients on EHRs out of curiosity violates patient privacy. Med Students Violating HIPAA by Tracking Patients on EHRs

Examples of Unintentional HIPAA Violations

Unintentional HIPAA violations can occur when healthcare professionals or organizations inadvertently access or disclose protected health information (PHI) without proper authorization, or when the HIPAA Rules are violated due to a lack of training.

Unintentional HIPAA Violation	Description of HIPAA Violation
Accidental Disclosure in Conversation	Healthcare professionals may inadvertently discuss patient information in public areas, like elevators or cafeterias, without realizing that others can overhear, potentially violating HIPAA confidentiality rules. Such disclosures may occur due to a lack of awareness or caution in maintaining patient privacy. Careless Talk Sees University of Iowa Worker Fired for HIPAA Privacy Violation
Email Errors	Sending an email containing protected health information (PHI) to the wrong recipient due to an email address autocomplete mistake or selecting the incorrect recipient. This can lead to unauthorized access to sensitive patient data when the email recipient is not authorized to view the information. Email Error Exposed the PHI of 8,000 Members of FirstCare Health Plans Email Error Results in Impermissible Disclosure of the PHI of 900 Campbell County Health Patients Email Error Impacts 6,500 Saliba’s Extended Care Pharmacy Patients Dermatologist Email Error Exposes 14,910 Patients’ SSNs University of Cincinnati Email Errors Result in 1,064-Patient Data Breach Email Error Exposed the PHI of 8,000 Members of FirstCare Health Plans
Faxing Errors	Mistakenly sending a fax with PHI to the wrong fax number or faxing PHI when it may be viewed by unauthorized individuals. Such errors can result in unintended access to patient information by individuals who should not have access to it. Even HHS Involvement Did Not Stop Months of Fax Privacy Breaches Faxing Error Sees PHI Sent to Local Media Outlet Protected Health Information Sent to Incorrect Fax Recipient Over Several Months New York Hospital Sued for Disclosing Patient’s HIV Status to Employer
Lost or Stolen Devices	Losing electronic devices, such as laptops, smartphones, or tablets, that contain unencrypted patient data, or leaving them in areas where they can easily be stolen. If these devices are lost or stolen, it can inadvertently expose PHI to unauthorized individuals who may gain access to the device’s contents. Lost Blackberry Device Results in $3.2 Million HIPAA Civil Monetary Penalty for Children’s Medical Center of Dallas CardioNet Fined $2.5 Million for Laptop Theft and Data Breach Lack of Encryption Leads to $3 Million HIPAA Penalty for New York Medical Center Conn. OIG Reaches $90K Settlement with Hartford Hospital and BA Over 2012 Laptop Theft Lifespan Laptop Theft Exposes ePHI of 20,000 Patients
Improper Disposal of Records	Incorrectly disposing of paper records, like medical charts or billing documents, by placing them in regular trash bins without shredding or using other secure methods to render PHI unreadable, or disposing of electronic devices without securely wiping them. This can lead to unauthorized individuals accessing patient data by retrieving discarded records. Kaiser Pays $49 Million to Settle Improper Disposal Investigation Improper Disposal of PHI Results in $300,640 HIPAA Penalty Improper Disposal Nets Small Pharmacy $125K OCR HIPAA Penalty HealthReach Community Health Centers Reports Improper Disposal Incident Affecting Almost 117,000 Patients Improper Disposal Incident at Smith’s Food & Drug Affects Almost 58,000 Patients
Misdirected Mail	Mailing patient records or billing statements to the wrong address due to clerical errors or inaccuracies in patient information. Such mistakes can inadvertently share sensitive patient information with individuals who should not have access to it. Kaiser Permanente Fined $450,000 for Mailing Error Mailing Error Sees Inmediata Breach Notification Letters Sent to Incorrect Addresses Email Error Exposed the PHI of 8,000 Members of FirstCare Health Plans Mailing Error at CMS Vendor Affects 10,000 Medicare Beneficiaries Mailing Error by State of Colorado Affects 12,230 Individuals St. Vincent Breast Center Breaches HIPAA with 63K-Patient Mailing
Access by Unauthorized Personnel	Allowing healthcare employees without the necessary access permissions to view or handle patient records, and failing to terminate access rights when employees are terminated or leave the company. This oversight can result in unintentional breaches of patient confidentiality. Failure to Terminate Former Employee’s Access Rights Results in $202,400 HIPAA Fine for New Haven, CT Failure to Terminate Former Employee’s PHI Access Costs Colorado Hospital $111,400 Pharma Sales Rep Pleads Guilty to Healthcare Fraud and Criminal HIPAA Violations Survey Reveals Sharing EHR Passwords is Commonplace
Accessing PHI Out of Curiosity	Healthcare professionals accessing patient records out of curiosity or without a legitimate medical reason. This action violates patient privacy and confidentiality unintentionally when healthcare workers access PHI without a valid need for patient care or treatment. $240,000 HIPAA Penalty After Security Guards Access Medical Records Med Students Violating HIPAA by Tracking Patients on EHRs Ohio Hospital Worker Snooped on 7,300 Patient Records over 12 Years Medical Center FacingLegal Action Over Snooping on George Floyd’s Medical Records Dozens of Northwestern Memorial Hospital Employees Fired for Accessing Jussie Smollett’s Medical Records Henry Mayo Newhall Hospital Fires Employees for Snooping on Medical Records Hawaii Pacific Health Discovers 5-Year Insider Data Breach

Are Data Breaches HIPAA Violations?

Data breaches are now a fact of life. Even with multi-layered cybersecurity defenses, data breaches are still likely to occur from time to time. OCR understands that healthcare organizations are being targeted by cybercriminals and that it is not possible to implement impregnable security defenses.

Being HIPAA compliant is not about making sure that data breaches never happen. HIPAA compliance is about reducing risk to an appropriate and acceptable level. Just because an organization experiences a data breach, it does not mean the breach was the result of a HIPAA violation.

The OCR breach portal now reflects this more clearly. Many data breaches are investigated by OCR and are found not to involve any violations of HIPAA Rules. When this happens, the investigations are closed without any action being taken.

How are Common HIPAA Violations Discovered?

Common HIPAA violations can continue for many months, or even years before they are discovered. The longer they are allowed to persist, the greater the penalty will be when they are eventually discovered. It is important for HIPAA-covered entities to conduct regular HIPAA compliance reviews (this is required by the HIPAA law) to make sure common HIPAA violations are discovered and corrected before they are identified by regulators.

There are three main ways that common HIPAA violations are discovered:

Investigations into a data breach by OCR (or state attorneys general)
Investigations into complaints about covered entities and business associates
HIPAA compliance audits

Even when a data breach does not involve a HIPAA violation, or a complaint proves to be unfounded, OCR may uncover unrelated HIPAA violations that could warrant a financial penalty.

FAQs

What does it mean to “reduce risk to an appropriate and acceptable level”?

What reducing risk to an appropriate and acceptable level means is that, when potential risks and vulnerabilities are identified, Covered Entities and Business Associates have to decide what measures are reasonable to implement according to the size, complexity, and capabilities of the organization, the existing measures already in place, and the cost of implementing further measures in relation to the likelihood of a data breach and the scale of injury it could cause.

How is it possible to prevent employees from snooping on healthcare records?

To prevent employees from snooping on healthcare records, Covered Entities should implement a program of training, ensure access privileges comply with the Minimum Necessary Standard, activate audit logs, and enforce sanctions. It is also important that employees are made aware during HIPAA training that, although many cases of healthcare snooping are attributable to curiosity rather than malicious intent, all cases of healthcare snooping are HIPAA violations.

If encryption is not mandatory, how can it be a HIPAA violation if records are unencrypted?

Although encryption is not mandatory, it can be a HIPAA violation if records are unencrypted and no other measure that is equally as effective has been implemented. Encryption is an addressable implementation specification of the Security Rule. This means organizations can only avoid implementing the requirement if it is not reasonable and appropriate in the circumstances, or if an alternative security measure is equally as effective. If organizations fail to encrypt records, they have to document the reasons why.

Why was the fine for denying patients access to health records so high?

The fine for denying patients access to health records was so high in the event mentioned in the article because, in this particular case, the non-cooperation of the Covered Entity contributed to the size of the fine (you can read about the case here). Since this case, the CMS´ Meaningful Use program has evolved into the Promoting Interoperability program, and – in addition to being sanctioned for a HIPAA violation – any covered entity failing to provide health records in a timely manner could now also lose a percentage of their Medicare payments.

What are the consequences of accessing a patient chart without reason?

The consequences of accessing a patient chart without reason vary depending on the reason for the impermissible access and the organization´s sanctions policy. If it was an employee’s first violation and no harm was caused by the violation, it is likely the employee will receive a warning and have to undergo additional training. If the violation was a repeat offense, caused harm to the patient or organization, and was done with malicious intent, the likely consequences are termination of contract, a report to a licensing authority, and the possible involvement of law enforcement.

Are HIPAA violations common?

Nobody knows if HIPAA violations are common because, although HHS´ Office for Civil Rights publishes an “Enforcement Highlights” webpage, the statistics on this page only relate to reports and complaints received by the agency. HIPAA violations can also be reported to the Centers for Medicare and Medicaid (CMS), the Federal Trade Commission (FTC), State Attorneys General, the Covered Entity at which the HIPAA violation occurred, or not reported at all.

How do HIPAA violations affect patients?

HIPAA violations affect patients in different ways depending on the nature of the violation. If a hospital has failed to enter into a Business Associate Agreement with a company that provides data analysis services, the violation will not affect patients at all. Conversely, if a HIPAA violation results in the exposure of patients’ personal information, which is then used to conduct identity theft, this will significantly affect patients. For these reasons, there is no one-size-fits-all answer to this question.

What are examples of HIPAA violations?

In addition to the examples of HIPAA violations listed above, Covered Entities can violate HIPAA by failing to comply with the Administrative Requirements of HIPAA. These include the Transaction, Code Sets, and Identifier Standards published by the Department of Health and Human Services; and although Covered Entities are not fined for violations of this nature, they can be excluded from the Medicare program by CMS – which will substantially affect their income.

What is considered a HIPAA violation by the Federal Trade Commission?

An event considered a HIPAA violation by the Federal Trade Commission (FTC) is a failure to comply with the Breach Notification Rule by an organization that has access to PHI, but which does not qualify as a Covered Entity or Business Associate – for example, vendors of Personal Health Records.

Organizations that are not Covered Entities or Business Associates do not have to comply with the Privacy or Security Rule, but they do have to comply with the Breach Notification Rule, and the failure to notify individuals and the FTC of a data breach is considered a HIPAA violation by the FTC – which has the authority to issue substantial fines for non-compliance.

What counts as a HIPAA violation by employees?

What counts as a HIPAA violation by employees is the failure to comply with employers’ HIPAA-related policies and procedures – provided employees have received adequate training on the policies and procedures. In such cases, the employee will be subject to the sanctions listed in their employer’s sanctions policy (verbal warning, written warning, suspension, termination, etc.).

Employees can also violate HIPAA by knowingly and wrongfully disclosing PHI. In such cases, employers are required to notify HHS´ Office for Civil Rights, who will refer the case to the Department of Justice. If there is evidence of criminal wrongdoing, the Department of Justice can pursue fines of up to $250,000 for HIPAA violations by employees and custodial sentences of up to ten years.

What constitutes a HIPAA violation by Business Associates?

What constitutes a HIPAA violation by Business Associates is the failure to comply with any parts of the Security Rule, the requirement to notify Covered Entities of any security incident (not only breaches of unsecured ePHI), or any other requirement stipulated in a Business Associate Agreement.

Generally, Business Associates are required to comply with all provisions of the HIPAA Security Rule and several sections of the Breach Notification Rule. Additionally, depending on the service they provide for or on behalf of a Covered Entity – and the content of Business Associate Agreements – Business Associates may also be required to comply with parts of the Administrative Requirements and the Privacy Rule.

What are the 3 types of HIPAA violations?

There are many “3 types of HIPAA violations”. For example, there are criminal, civil, and accidental violations of HIPAA; Privacy Rule, Security Rule, and Breach Notification Rule violations of HIPAA; and violations of HIPAA reportable to the Centers for Medicare and Medicaid (CMS), HHS´ Office for Civil Rights, and the Federal Trade Commission.

Is it possible for there to be an intentional but acceptable HIPAA violation?

It is possible for there to be an intentional but acceptable HIPAA violation, but only when HHS’ Office for Civil Rights issues a Notice of Enforcement Discretion. These Notices allow Covered Entities to intentionally violate certain HIPAA provisions in certain circumstances for the period of time a Notice of Enforcement Discretion is in force.

It is important to be aware that disclosing PHI in an emergency situation to a Covered Entity with whom no treatment relationship exists is not an intentional but acceptable HIPAA violation. This scenario is permitted by §164.510 of the Privacy Rule provided that any PHI disclosed is limited and relevant to an individual´s care.

Who is responsible for the most common HIPAA violations?

It is not known who is responsible for most common HIPAA violations because it is highly likely most common HIPAA violations are reported to the organization where the violation occurred and this information is not released into the public domain. Additionally, Business Associates are required to report “security incidents” to Covered Entities who then notify affected individuals and HHS’ Office for Civil Rights if the security incident constitutes a breach of unsecured PHI.

Why are there no examples of HIPAA violations by employers?

There are no examples of HIPAA violations by employers because employers are not Covered Entities under HIPAA. Even if a healthcare organization qualifies as a Covered Entity, it is not required to comply with HIPAA in its role as an employer – just in its role as a healthcare organization.

An exception to this explanation exists if an employer administers a self-sponsored health plan. However, because this is a rare scenario – and because employers in this situation are only subject to partial compliance – there are no examples of HIPAA violations by employers publicly reported.

What are the consequences of accessing a patient chart without reason?

The consequences of accessing a patient chart without reason depend on multiple factors. If the person who accessed the chart was a member of a Covered Entity’s workforce, if they did not have the authorization to access the chart, and if they had received training on the Covered Entity’s policies, the event is a violation of the Covered Entity’s policies.

Therefore, the consequences of accessing a patient chart without reason depend on the content of the Covered Entity’s sanctions policy. This may mean the person is given a verbal warning and required to undergo refresher training; or, if the person has received previous verbal warnings, the consequences could be a written warning, final warning, or termination of a contract.

What are HIPAA violations?

HIPAA violations are the failure to comply with the provisions and implementation specifications of the HIPAA Administrative Simplification provisions (45 CFR Parts 160,162, and 164). Most HIPAA violations are civil incidents committed by Covered Entities and Business Associates. It is rare that an individual violates HIPAA because individuals are most often members of a Covered Entity’s or Business Associate’s workforce and subject to their employer’s policies.

Are all violations of HIPAA resolved by financial penalties?

Very few violations of HIPAA are resolved by financial penalties. In most cases, violations of HIPAA are resolved by voluntary compliance, technical assistance, or corrective action plans. However, these “secondary” resolutions also have a financial cost in terms of revising policies and procedures, implementing safeguards, retraining members of the workforce, and other business disruptions.

Are lost medical records a HIPAA violation?

Lost medical records are a HIPAA violation – even if the records are subsequently found – because there has been a failure to ensure the availability of PHI when the records were lost. Additionally, while the medical records were lost, they may have been viewed or altered by an unauthorized person, so there has also been a failure to ensure the confidentiality and integrity of PHI.

What is considered a HIPAA violation punishable by a custodial sentence?

A HIPAA violation punishable by a custodial sentence is considered to be when a person knowingly and wrongfully obtains or discloses individually identifiable health information without authorization. Depending on the motive and whether the act was committed under false pretenses, the person can be fined up to $250,000 and given a custodial sentence of up to ten years.

Who can violate HIPAA?

Who can violate HIPAA is limited to Covered Entities, Business Associates, and members of their workforces. If an organization is not a Covered Entity or Business Associate, or an individual is not a member of either’s workforce, it is not possible to violate HIPAA because HIPAA will not apply to the organization/individual.

What is a HIPAA violation of the Breach Notification Rule?

A HIPAA violation of the Breach Notification Rule is the failure to comply with any provision of 45 CFR 164 Subpart D when Protected Health Information has been acquired, accessed, used, or disclosed in a manner not permitted by the Privacy Rule, and the impermissible acquisition, access, use, or disclosure compromises the security or privacy of the Protected Health Information.

Is it a HIPAA violation to say someone is in the hospital?

It can be a HIPAA violation to say someone is in the hospital, but only in a limited number of circumstances. For example, the person making the statement must be a member of a Covered Entity’s workforce, the statement must be made to somebody with whom there is no direct treatment or familial relationship, and when the subject of the statement has not been given an opportunity to object to the statement being made.

Is inappropriate access to medical records a HIPAA violation example or a HIPAA breach example?

Inappropriate access to medical records is certainly a HIPAA violation example regardless of who the individual accessing the medical records is. Whether or not it constitutes a HIPAA breach example depends on whether the inappropriate access compromises the security or privacy of the Protected Health Information maintained in the medical records.

Is there a list of HIPAA violations?

There is no list of HIPAA violations because many HIPAA violations are reported to the organization at which they occurred, and they never become public knowledge. What you can find a list of is a list of HIPAA data breaches affecting more than 500 individuals that have been reported to HHS’ Office for Civil Rights. This list can be found on the HHS’ Breach Report web page.

Can you sue someone for disclosing medical information?

You cannot sue someone for disclosing medical information under HIPAA because HIPAA has no private right of action. However, if you believe someone has disclosed your medical information – and because of the disclosure you have suffered harm – you may be able to file a civil action under a state law. Because some states have privacy and security laws that include a private right or action and others don´t, it is best to seek legal advice from a local attorney.

How can I find out who has accessed my medical records?

You can find out who has accessed your medical records by requesting an Accounting of Disclosures from your healthcare provider. The healthcare provider has to reply to your request within 30 days and provide you with a list of every time you’re your medical records have been accessed for uses other than those permitted by the Privacy Rule (i.e., treatments, payments, etc.).

Who can access my medical records without my permission?

Your medical records can be accessed without your permission by any member of a Covered Entity’s or Business Associate’s workforce provided they have the authority to access your records and the reason why they are accessing your medical records is permitted by the Privacy Rule. If your medical records are accessed by somebody without the authority to do so, or for a reason not permitted by the Privacy Rule, this would be a violation of HIPAA.

Can a family member violate HIPAA?

A family member can violate HIPAA if, for example, they are also your dentist and they disclose your health information impermissibly. However, if the family member is not a member of the medical profession – or a member of a Covered Entity´s or Business Associate’s workforce – it is not possible for them to violate HIPAA because only Covered Entities, Business Associates, and members of their workforces are required to comply with HIPAA

HIPAA Compliance Infographics

Have You Mitigated Your Mobile Security Risks?

Milestones of the Health Insurance Portability and Accountability Act

The Cost of HIPAA Non-Compliance

How to Spot a Phishing Email

How to Respond to a Healthcare Data Breach

10 HIPAA Breach Costs You Should Be Aware Of

The post The 10 Most Common HIPAA Violations You Should Avoid appeared first on HIPAA Journal.

De-identification of Protected Health Information: How to Anonymize PHI

Posted October 18, 2017 by HIPAA Journal

Healthcare organizations and their business associates that want to share protected health information (PHI) in a HIPAA-compliant way must do so in accordance with the HIPAA Privacy Rule, which limits the possible uses and disclosures of PHI, whereas de-identification of PHI means HIPAA Privacy Rule restrictions no longer apply.

You can use our free Protected Health Information Guide to learn how to de-identify and anonymize PHI. If you de-identify PHI so that the identity of individuals cannot be determined, and re-identification of individuals is not possible, PHI can be freely shared.

HIPAA Privacy Rule restrictions only covers individually identifiable protected health information. The de-identification of protected health information enables HIPAA covered entities to share health data for large-scale medical research studies, policy assessments, comparative effectiveness studies, and other studies and assessments without violating the privacy of patients or requiring authorizations to be obtained from each patient prior to data being disclosed.

HIPAA-Compliant De-identification of Protected Health Information

HIPAA-compliant de-identification of protected health information is possible using two methods: Safe Harbor and Expert Determination.

Neither method of de-identification of protected health information will remove all risk of re-identification of patients, but both methods will reduce risk to a very low and acceptable level.

Use either of the two methods below and PHI will no longer be considered ‘protected health information’ and not be subject to HIPAA Privacy Rule restrictions.

1. Safe Harbor – The Removal of Specific Identifiers

How to de-identify protected health information The first HIPAA compliant way to de-identify protected health information is to remove specific identifiers from the data set. The identifiable data that must be removed according to 45 CFR §164.514(b)(2) are:

Names
Geographic subdivisions smaller than a state
All elements of dates (except year) related to an individual (including admission and discharge dates, birthdate, date of death, all ages over 89 years old, and elements of dates (including year) that are indicative of age)
Telephone, cellphone, and fax numbers
Email addresses
IP addresses
Social Security numbers
Medical record numbers
Health plan beneficiary numbers
Device identifiers and serial numbers
Certificate/license numbers
Account numbers
Vehicle identifiers and serial numbers including license plates
Website URLs
Full face photos and comparable images
Biometric identifiers (including finger and voice prints)
Any unique identifying numbers, characteristics or codes

In the case of zip codes, covered entities are permitted to use the first three digits provided the geographic unit formed by combining those first three digits contains more than 20,000 individuals. When that geographical unit contains fewer than 20,000 individuals it should be changed to 000. According to the Bureau of the Census, that means 17 zip codes must have the first three digits changed to zero:

036, 692, 878, 059, 790, 879, 063, 821, 884, 102, 823, 890, 203, 830, 893, 556, 831

Covered entities should not that the above list of zip codes may change after future censuses. The list is based on 5-digit zip codes from the 2000 census.

IMPORTANT NOTE: The list of HIPAA identifiers was compiled in 1999 and is now out-of-date. Additional identifiers that must be removed from a designated record set before it can be considered de-identified include social media aliases, Medicare Beneficiary Numbers, and details relating to an emotional support animal if the animal could be used to identify the subject of the PHI.

2. Expert Determination

De-identify Protected Health Information The expert determination method carries a small risk that an individual could be identified, although the risk is so low that it meets HIPAA Privacy Rule requirements.

This method of de-identification of protected health information requires a HIPAA covered entity or business associate to obtain an opinion from a qualified statistical expert that the risk of re-identifying an individual from the data set is very small. In such cases, the methods used to make that determination and justification of the expert’s opinion must be documented and retained by the covered entity or business associate and made available to regulators in the event of an audit or investigation.

The expert must be a person with appropriate knowledge and experience of using generally accepted statistical and scientific principles and methods for removing or altering information to ensure that it is no longer individually identifiable.

When those methods and principles have been applied, the expert must determine that the risk of reidentification of an individual is very small. In such cases, the risk of reidentification must be very small when the information is used alone, and must remain very small should the data be combined with other reasonably available information by an anticipated recipient to identify an individual who is a subject of the information.

HIPAA does not define the level of risk of re-identification other than to say it should be ‘very small’. The expert should define ‘very small’ in relation to the context of the data set, the specific environment, and the ability of an anticipated recipient to be able to reidentify individuals.

Experts may come from a number of different fields and do not require any specific qualifications. What is important is experts have experience of deidentifying data. It is that experience that regulators will look at in the event of an audit, not specific qualifications or certifications.

For further information on de-identification of protected health information by expert determination see 45 CFR § 164.514(b)(1).

The U.S. Department of Health and Human Services’ Office for Civil Rights has issued guidance on de-identification of protected health information which can be viewed on this link.

De-identification of Protected Health Information FAQs

Why is the list of Safe Harbor identifiers the same as many definitions of PHI?

The list of Safe Harbor identifiers is the same as many definitions of PHI because some sources have mistakenly used the list to answer the question “what is PHI?” It is important to be aware this is not the case.

PHI – or Protected Health Information – is individually identifiable health information that relates to an individual’s past, present, or future health condition, treatment for the condition, or payment for the treatment. Only when identifiers are maintained in the same designated record set as PHI do the identifiers assume protected status.

The list of Safe Harbor identifiers is a (now incomplete) list of possible identifiers that could be maintained in the same designated record set as PHI. If so, they (and any other identifiers not included on the list) must be removed from the designated record set before any remaining PHI is considered de-identified.

Do doctors´ names have to be removed from a data set for PHI to be de-identified?

Doctors’ names have to be removed from a data set for PHI to be de-identified if the name of a doctor – individually or with other information – could be used to identify the subject of the data set. If there is very little chance of a patient being identified by a doctor´s name, then the name can remain in the de-identified data set subject to any state laws or confidentiality concerns.

Generally, with regards to the removal of names from designated data sets, the name of the patient (including nicknames, pet names, and any other names they may be known by) have to be removed, along with the names of relatives, employers, and household members. There is no requirement in HIPAA to remove the names of healthcare providers or any workforce members.

Must a Business Associate Agreement or Data Use Agreement be in place before disclosing de-identified health data to a business partner?

A Business Associate Agreement or Data Use Agreement does not have to be in place before disclosing de-identified health data to a business partner. However, covered entities can, if they wish, enter into a Data Use Agreement with the recipient of the data to specify how the recipient can use the data and prohibit its re-identification.

What is considered “appropriate knowledge and experience” for expert determination?

There is no definition of appropriate knowledge and experience for expert determination in HIPAA. However, in the event of a HIPAA compliance audit, the Department of Health & Human Services´ Office for Civil Rights would review the expert´s professional experience and academic training of the expert, and the processes used in the de-identification of the data set to assess their capabilities.

Is there an expiration date for de-identified health data?

There is no expiration date for de-identified health data stipulated in the Privacy Rule. However, the Department for Health & Human Services recognizes that “technology, social conditions, and the availability of information changes over time” and has suggested that covered entities periodically review the chosen de-identification method to ensure it meets the very low risk requirement.

Why is the list of Safe Harbor identifiers incomplete?

The list of Safe Harbor identifiers is incomplete because it was published quarter of a century ago in a time before (for example) social media and emotional support animals. If a patient has a social media handle maintained with PHI in a designated record set – or information relating to an emotional support animal – that information also needs to be removed from a designated record set before it can be considered de-identified.

What is the benefit of de-identifying Protected Health Information?

The benefit of de-identifying Protected Health Information is that the de-identified data can be used for medical research studies, policy assessments, comparative effectiveness studies, and other studies and assessments without violating patient privacy or requiring individual authorizations. Effectively, one PHI is de-identified, the restrictions of the Privacy Rule no longer apply.

What are the two HIPAA-compliant methods for de-identifying PHI?

The two HIPAA-compliant methods of de-identifying PHI are the Safe Harbor method and the Expert Determination method. It is important to be aware that the list of identifiers listed in the Safe Harbor method is out of date, and organizations considering this method of de-identification are advised to seek professional compliance advice before relying on the content of §164.514 to de-identify PHI.

How does the Expert Determination method of de-identifying PHI work?

The Expert Determination method of de-identifying PHI works by obtaining an opinion from a qualified statistical expert indicating that the risk of re-identifying an individual from the de-identified data set is very small. The methods used for this determination and justification of the expert’s opinion must be documented and retained by the covered entity or business associate.

Does the Privacy Rule define the level of risk of re-identification in the Expert Determination method?

The Privacy Rule does not define the level of risk of re-identification in the Expert Determination method other that stating it should be “very small”. This means the expert is required to define “very small” in relation to the context of the data set, the specific environment, what the data set will be used for, and the recipient’s reasonably anticipated ability to reidentify individuals.

The post De-identification of Protected Health Information: How to Anonymize PHI appeared first on HIPAA Journal.

How Employees Can Help Prevent HIPAA Violations

Posted October 3, 2017 by HIPAA Journal

Employees can help prevent HIPAA violations by fully understanding what PHI is, knowing when PHI can permissibly be used and disclosed, and by following their employers’ policies on the compliant use of healthcare technologies and communication devices. Employees can also help prevent HIPAA violations by reporting ongoing poor practices to a manager or compliance officer.

One of the key goals of compliance officers is to prevent HIPAA compliance violations whenever possible. To achieve this goal, many compliance officers rely on technological solutions or sanctions policies to deter employees from noncompliant behaviors. However, by taking a more positive approach, employees can help prevent HIPAA violations.
Ten Most Common HIPAA Violations

Use the article in conjunction with our free HIPAA Violations Checklist to understand what is required to ensure full compliance. Please use the form on this page to arrange for your copy.

Most Frequent Complaints

According to the Department of Health and Human Services´ Enforcement Highlights web page, the most frequent complaint received by HHS´ Office for Civil Rights relates to impermissible uses and disclosure of PHI. This is not surprising considering the variety of scenarios in which an authorization to use or disclose PHI is required, when individuals may or may not have the right to object to a use or disclosure, or when permissible uses or disclosures are subject to “other requirements”.

However, it is not only the variety of scenarios that can result in HIPAA violations. Many impermissible uses and disclosures occur due to a lack of understanding of what PHI is. The failure to understand what PHI is – and what it isn´t – can result in the next four most frequent violations occurring:

Lack of Privacy Rule safeguards for PHI
Lack of patient access to PHI
Lack of Security Rule safeguards for ePHI
Use or disclosure of more than the minimum necessary PHI

How to Prevent HIPAA Violations of this Nature

The obvious way to prevent HIPAA violations of this nature is to train all members of the workforce – not just employees – on what is considered PHI under HIPAA. Many HIPAA training courses fail to include this fundamental basic of HIPAA compliance in their curriculum – focusing on the HIPAA training requirements of §164.530 and §164.308 to tick the box of compliance, rather than putting policy and procedure training and security and awareness training into context.

However, if members of the workforce do not fully understand what PHI is, it is not hard to imagine why it may be used or disclosed impermissibly, why patients allege access requests are not being acted on, and why more than the minimum necessary PHI is being disclosed. It may also explain why those with a responsibility for the privacy and security of PHI fail to implement reasonable and appropriate Privacy Rule policies or Security Rule safeguards.

How to Prevent Other Types of HIPAA Violations

In addition to providing training on what PHI is, it can help prevent HIPAA violations to highlight the most common violations by members of the workforce and explain how to follow HIPAA guidelines in order to send the message “we know this happens – we don´t want it happening here”. The most common violations of HIPAA by members of the workforce include (but are not limited to).

Sharing passwords to systems containing PHI

Healthcare workers often share passwords to EHRs and other health IT systems – not out of malice, but “to get the job done” when their credentials are not sufficient to access required information. This is a violation of §164.312; and while it is the responsibility of the IT team to ensure each member of the workforce has “unique user identification”, employees should not share passwords, but rather pester the IT team to provide them with the credentials they need.

Leaving devices unsecured and unattended

Devices that can access PHI must have security features such as automatic logoff and PIN-lock (or other device locking process) enabled. All PHI on the device – or accessible by the device – should be encrypted. If a device or workstation used by a member of the workforce does not have these security features enabled, the risk of a data breach exists if a device or workstation is left unattended. This is a risk that is easy to prevent with the right technology.

Using unsecure channels of communication

There are two potential HIPAA violations here. The first relates to transmission security when communicating PHI, while the second relates to an individual´s right to request how they are contacted. HIPAA allows for Covered Entities to use unsecure channels of communication to contact individuals, but individuals should be warned of the risks, and both the warning and the individual´s consent to use the channel of communication should be documented.

Disposing of PHI improperly

While most healthcare organizations have now transitioned to electronic health records, paper documents are still widely used. Any document containing PHI must be kept secure while in use and disposed of properly at end of life. The rules relating to the disposal of PHI also apply to electronic PHI – particularly when systems on which PHI is stored are decommissioned or when removable media and backup tapes are purged for re-use.

Accessing PHI out of curiosity

The accessing of patient health records by employees, without any legitimate reason for doing so, is a serious violation of HIPAA. While most healthcare employees respect the privacy of patients, there have been numerous cases over the years of patients snooping on the records of patients. It is important for all members of the workforce to be made aware that audit logs are implemented to protect patient health information in the workplace and can identify when employees have access PHI without good reason.

Sharing PHI on social media without authorization

One of the reasons it is important that all members of the workforce know what is considered PHI under HIPAA is so that they do not inadvertently or deliberately share PHI on social media without authorization. Even something as apparently innocuous as commenting on a personality being seen at a medical center is a HIPAA violation that could lead to a sanction being applied or a complaint by the personality being made to HHS´ Office for Civil Rights.

The Benefits of Training Employees How to Avoid HIPAA Violations

Training employees how to avoid HIPAA violations not only reduces the number of violations but can also help reduce the number of unjustified complaints made to the organization and to HHS´ Office for Civil Rights. A significant statistic on HHS´ Enforcement Highlights web page, is that many reported violations are not violations at all. Of more than 300,000 complaints received since 2003, more than 200,000 have been rejected because “they did not present an eligible case for enforcement”. Among the reasons given by HHS for rejecting two-thirds of complaints were:

The complaint was made against an organization not subject to HIPAA
The activity described in the complaint did not violate any HIPAA Rules
The complaint was withdrawn by the individual on review.

Training employees to avoid HIPAA violations so they understand what PHI is can be beneficial in reducing unjustified complaints made by individuals who themselves do not know what PHI is. Employees can pass their knowledge on to patients and plan members to reduce the number of complaints made about impermissible uses and disclosures or disclosing more than the minimum necessary PHI – saving compliance officers valuable time replying to unjustified complaints or responding to HHS enquiries in the complaints review process.

How Employees Can Help Prevent HIPAA Violations: FAQs

Where does the Privacy Rule state the permissible uses and disclosures of PHI?

The Privacy Rule states the permissible uses and disclosures of PHI – including those requiring an authorization or in circumstances when an individual has the right to object – in sections §164.502 to §164.514 of the Administrative Simplification Regulations. Many of the standards apply to infrequent events, but it is important members of the workforce know what to do when these infrequent events occur.

How might somebody with a responsibility for security fail to implement safeguards?

The reason why somebody with a responsibility for security might fail to implement safeguards is that a lot of misinformation exists on the Internet. For example, if a Security Officer safeguards the so-called 18 HIPAA identifiers, but no other identifiers, details such as Medicare Beneficiaries Identifiers, social media handles, and emotional support animals (that could be used to identify an individual) could remain unsecured.

What is the problem with sharing passwords to systems containing PHI?

The problem with sharing passwords to systems containing PHI is that if an employee shares their login credentials with a colleague, and the colleague misuses PHI or disclosures PHI impermissibly, the HIPAA violation will be attributed to the owner of the login credentials rather than the colleague who was using them.

Does a personal mobile device have to have HIPAA security features enabled?

A personal mobile device must have HIPAA security features enabled if it is used to access systems containing PHI or communicate PHI with a colleague or patient. In such cases, the device has to be configured to meet the standards of the Security Rule. While applying the standards may seem like an imposition on the owner of the device, they are a best practice for personal data security even if the device is not used to access or communicate PHI.

Is it possible to share PHI on social media with authorization?

It is possible to share PHI on social media with authorization; but, in order to do so, the authorization form must state why PHI is being shared. It also has to be documented that the individual has been made aware that it may not be possible to revoke the authorization. This is because once content is posted on a social media platform, any further use or disclosure is out of the control of the person who posted it.

What is the best way to prevent HIPAA violations?

The best way to prevent HIPAA violations is to ensure HIPAA-compliant policies and procedures are developed, Security Rule safeguards are implemented, and all members of the workforce are thoroughly trained on HIPAA compliance. In addition, Covered Entities and Business Associates need to keep on top of monitoring compliance with the policies and procedures and ensure sanctions are applied consistently and fairly whenever necessary.

How can a healthcare organization avoid HIPAA violations?

A healthcare organization can avoid HIPAA violations by empowering members of the workforce to be the eyes and ears of HIPAA compliance. This can be achieved by implementing an anonymous communication channel through which members of the workforce can raise concerns about non-compliant practices and risks to the privacy of individually identifiable health information.

How is it possible to protect patient health information in the workplace?

There are several ways it is possible to protect patient health information in the workplace. One of the best ways is to minimize the number of designated record sets per patient. This makes it easier to identify where PHI is created, used, and maintained, so appropriate safeguards can be implemented to prevent impermissible disclosures and breaches of unsecure PHI.

What are the top five HIPAA tips for staff?

The five top HIPAA tips for staff can vary according to the role of the individual and the operations of their employer. For example, a nurse working in an ED will have very different compliance challenges than a claims processor working as a business associate. However, there are some common HIPAA tips that apply to all staff:

Pay attention to HIPAA training; and, if there is something you don´t understand, ask.
Ensure you are aware what PHI is and your employer´s policies for disclosing PHI.
If you identify a HIPAA violation in the workplace, report it and document your report.
Never share login credentials without first checking with a member of the IT team.
Don´t rely on colleagues if you are unsure about HIPAA compliance. Check with a manager or your Privacy/Security Officer.

What advice should a new member of the workforce be given on how to not violate HIPAA?

The advice a new member of the workforce should be given on how to not violate HIPAA is to follow the policies developed by your employer. This is because a member of the workforce cannot be held liable for a violation of HIPAA if their employer´s policies are not HIPAA compliant. It is important to be aware that an employer´s sanctions policy only applies to the policies the employer has developed – which are not necessarily the same as the HIPAA standards.

What are the key HIPAA do’s and don’ts for employees?

The key HIPAA do’s and don’ts for employees are to comply with your employer´s HIPAA policies and – if you feel they contradict HIPAA – don´t assume you know better. In addition, if you see a HIPAA violation in the workplace, do report it – don’t be afraid of alienating work colleagues. Finally, do make sure you participate in security and awareness training and don´t share login credentials.

Why is protecting PHI in the workplace important?

Protecting PHI in the workplace is important because impermissible uses and disclosures of PHI and breaches of unsecured PHI can result in loss, fraud, and reputational damage. This not only applies to the subject(s) of the PHI, but also to healthcare organizations and health plans who could end up providing – and paying for – expensive treatments to criminals in possession of stolen PHI.

How does reporting HIPAA violations in the workplace support HIPAA compliance?

Reporting HIPAA violations in the workplace supports HIPAA compliance in a number of ways. For example, reporting HIPAA violations can alert Privacy Officers to the need for more training, the need to fill gaps in HIPAA policies, and/or the need to better monitor workplace compliance. Once these needs are identified and resolved, the workplace will likely become more HIPAA compliant.

What are HIPAA reminders for staff?

HIPAA reminders for staff can take various forms. They can be verbal reminders from a supervisor who has observed a member of staff taking a compliance shortcut, they can be refresher training provided periodically by a conscientious employer, or they can be the HIPAA security reminders required by the Administrative Safeguards of the Security Rule (45 CFR §164.308(5)(ii)(A)).

What strategies are used to prevent HIPAA privacy violations?

The strategies used to prevent HIPAA privacy violations can vary from organization to organization, but generally they consist of education, supervision, and enforcement – Education being the HIPAA training all new members of the workforce are required to undergo, supervision being the monitoring of staff compliance and security technologies, and enforcement being the fair and consistent application of a HIPAA sanctions policy.

What is the HIPAA policy for healthcare employees?

There is no single HIPAA policy for healthcare employees. In many cases, there are hundreds of HIPAA policies for healthcare employees – although most employees will not be aware of them all. This is because the Privacy Rule only requires covered entities to train healthcare employees “on the policies and procedures […] necessary and appropriate for members of the workforce to carry out their functions with the covered entity”. Although healthcare employees are required to comply with HIPAA, they will only be trained on the HIPAA policies relevant to their roles.

What are the breach prevention best practices according to HIPAA?

HIPAA itself is technology neutral and does not provide breach prevention best practices per se. Indeed, even though the Security Rule stipulates Administrative, Physical, and Technical Safeguards must be implemented to protect the confidentiality, integrity, and confidentiality of electronic PHI, the Rule itself has a “flexibility of approach” clause in its “General Rules” (45 CFR §164.306(b)(1)).

However, since the publication of the Security Rule, the National Institute of Standards and Technology (NIST) Guide SP 800-53 has been widely acknowledged as the source of breach prevention best practices for HIPAA. In 2016, the Department of Health and Human Services published a “crosswalk” to help covered entities and business associates better comply with the Security Rule.

It is important for covered entities and business associates to be aware that adopting the measures in the crosswalk or in NIST´s latest guidance (SP 800-66r2) does not guarantee compliance with the Security Rule. However, the two publications contain what many experts believe to be the most comprehensive breach prevention best practices for HIPAA.

What HIPAA laws do healthcare providers have to comply with?

The HIPAA laws healthcare providers have to comply with are the Privacy Rule, the Security Rule, and the Breach Notification Rule if they qualify as a HIPAA covered entity. Not all healthcare providers qualify as a covered entity; however, if a non-qualifying healthcare provider provides a service to or on behalf of a covered entity as a “business associate”, they may also have to comply with the Privacy Rule (or parts thereof) as well as the Security Rule, and the Breach Notification Rule.

All covered entities and business associates must comply where appropriate with the General Provisions of 45 CFR Parts 160 and 164, while healthcare providers that conduct electronic transactions for which the Department of Health and Human Services has published standards have to comply with all applicable provisions of 45 CFR Part 162 (mostly relating to transactions between health plans and healthcare providers for eligibility, authorization, billing, and payment).

What are the Rules of HIPAA for healthcare organizations?

The Rules of HIPAA for healthcare organizations that qualify as HIPAA covered entities are:

The Privacy Rule – the standards for the privacy of individually identifiable health information.
The Security Rule – the standards for the protection of electronic protected health information.
The Enforcement Rule – the processes for HHS investigations and imposition of sanctions by HHS.
The Breach Notification Rule – the standards for notifying individuals and HHS of a data breach.
The Final Omnibus Rule – the amendments to existing HIPAA Rules introduced by the HITECH Act.

Most healthcare organizations are required to comply with the above Rules of HIPAA, plus – where applicable – the General Provisions of 45 CFR Parts 160 and 164 of the Administrative Simplification Regulations. Healthcare organizations and business associates that conduct transactions for which the Department of Health and Human Services has published standards are also required to comply with the General Provisions and the Transactions, Identifier, and Code Set Rules in 45 CFR Part 162.

What is one good way to avoid violating HIPAA?

One good way to avoid violating HIPAA if you are a member of a covered entity´s or business associate´s workforce is to apply the information you learn in HIPAA training to your day-to-day roles – especially the information relating to permissible uses and disclosures of PHI because this is the most alleged HIPAA violation reported to HHS´ Office of Civil Rights via the Complaint Portal.

What can employees do to prevent a security breach in the workplace?

Employees can do a lot to prevent a security breach in the workplace. Possibly the most important thing employees can do is to use unique, complex passwords for each online account, never disclose or share passwords, and protect sensitive accounts and databases with 2-factor authentication – even if your employer does not require these basic security measures.

What does the mitigation of a violation of PHI mean?

The mitigation of a violation of PHI is a strange term to use because usually people talk in terms of HIPAA violations and PHI breaches – the two terms meaning different things. A HIPAA violation is any failure to comply with the standards of the Administrative Simplification Regulations (45 CFR Parts 160 – 164) and the Confidentiality of Substance Abuse Disorder Patient Records (42 CFR Part 2).

A violation of any of these standards doesn´t necessarily result in a breach of unsecured PHI; but when it does, lessening (or mitigating) the impact of the breach can reduce the amount of harm an individual suffers, the risk of compromised PHI being used to commit insurance fraud, and the amount an organization could be fined for failing to comply with the HIPAA standards.

Can an employer disclose medical information to other employees?

Whether or not an employer can disclose medical information to other employees depends on state privacy laws rather than HIPAA. Employers are exempt from HIPAA in their role as an employer, so any health information collected, maintained, or transmitted by an employer as part of an employee’s employment record is not subject to the protection of the Privacy Rule.

Can an employer request medical information?

An employer can request medical information about an employee from a healthcare provider if the information requested is required to comply with state and/or federal requirements for reporting workplace injuries and illnesses. However, the healthcare provider is only allowed to disclose the minimum necessary medical information to meet the reporting requirements.

An employer can also request medical information from an employee to justify an absence, to enroll an employee in a group health plan or wellness program, to maintain the health and safety of other members of the workforce, to comply with the Family Medical Leave Act, or to accommodate members of the workforce under the Americans with Disabilities Act.

My HIPAA rights were violated by my employer. What should I do?

It is unlikely that your HIPAA rights were violated by your employer because, except in a few circumstances, employers are exempt from HIPAA In their role as employer. However, there may be state privacy laws that limit what individually identifiable health information an employer can disclose, and you should discuss your options with your HR department or a legal professional.

The post How Employees Can Help Prevent HIPAA Violations appeared first on HIPAA Journal.