Public Health Law Map - Beta 5 - Medical and Public Health Law Site

medical information for patient care without requiring as much formal process. The
following discussion deals with the revised final rule in effect in fall 2003.
G. HIPAA Regulations for Medical Care
The HIPAA privacy regulation is based on four key concepts:
the covered entity;
protected health information (PHI);
the patient's control over the release of PHI; and
minimal necessary disclosure.
HIPAA preempts many state law governing access to medical records unless these
laws provide more protection for the patient's medical information than HIPAA. As
discussed later, HIPAA does not preempt state laws that require the release of
information for legal and public health and safety purposes.
1. What is a Covered Entity?
"Covered entities" are defined in the HIPAA rules as (1) health plans, (2) health care
clearinghouses, and (3) medical care providers who electronically transmit any health
information in connection with transactions for which HHS has adopted standards.
Generally, these transactions concern billing and payment for services or insurance
coverage. For example, hospitals, academic medical centers, physicians, and other
medical care providers who electronically transmit claims transaction information
directly or through an intermediary to a health plan are covered entities.
Covered entities can be institutions, organizations, or persons. Researchers are
covered entities if they are also medical care providers who electronically transmit
health information in connection with any transaction for which HHS has adopted a
standard. For example, physicians who conduct clinical studies or administer
experimental therapeutics to participants during the course of a study must comply
with the Privacy Rule if they meet the HIPAA definition of a covered
entity."[Protecting Personal Health Information in Research: Understanding the
HIPAA Privacy Rule, NIH Publication Number 03-5388 (HIPAA Research)]
If a person is are not dealing with a covered entity, HIPAA does not apply, even for
medical treatment. For example, if a person goes a physician who only takes cash
payment and does not deal with any health plans or medical care clearinghouses, that
physician is not bound by HIPAA. An alternative medicine provider who only deals
in cash is unlikely to be covered by HIPAA. Internet medical information
questionnaires and online doctors who write prescriptions for drugs like Viagra based
on a WWW site questionnaire are probably not protected by HIPAA. In these cases,
state law still applies, but it is a very limited protection in the Internet world.
Medical research may or may not be covered by HIPAA. If it is clinical research
351