HIPAA/HITECH and Texas Privacy Laws Comparison Tool ... - TMLT

SALE OF PHI
FEDERAL
HIPAA/HITECH
Prohibits the sale of PHI without patient authorization except for public
health activities, cost and preparation of research activities, treatment
and payment, health care operations — pursuant to BA activity — for
the patient access to his/her PHI, and if the Secretary of HHS
determines it is necessary and appropriate by regulation
Omnibus Rule
Prohibits CE or BA from receiving direct or indirect payment from the
recipient of the PHI in exchange for the PHI without authorization from
the individual.
The authorization requirement does NOT apply for disclosures of PHI
for:
o public health purposes;
o for research purposes where the only renumeration is a
reasonable cost-based fee to cover the cost to prepare and
transmit the PHI;
o for treatment, payment, or health care operations;
o to or by a BA for activies that the BA undertakes on behalf of
the CE, and the only renumeration is for the performace of
such activities;
o to an individual, when requested under the access and
accounting of disclosures provisions of the Privacy Rule;
o for disclosures required by law; or
o for any other purpose permitted by and in accordance with the
applicable requirements of the Privacy Rule, where the only
renumeration is a reasonable cost-based fee to cover the cost
to prepare and transmit the PHI or a fee otherwise expressly
permitted by other law.
Ongoing research studies will be grandfathered.
CE may continue to use a limited data set in accordance with an existing
data agreement up to one year or until it is renewed or modified,
whichever is earlier
Texas Medical Records Privacy Act
NA
ITEP
HB 300
NA
TEXAS
Prohibits sale of PHI except for treatment, health care operations, performing
insurance or health maintenance organization function, or as otherwise
authorized by state or federal law.
8