Earn CEU credit Cathy Garrey, Connect with your - Health Care ...

Complying with the HIPAA Privacy Rule – What you need to know
...continued from page 59
demographic information) that is created or received by a health care provider,
health plan, employer, or health care clearinghouse that relates to:
n The past, present, or future health of an individual;
n The provision of health care to an individual; or
n The past, present, or future payment for health care to an individual AND
that either
o identifies the individual, or
o there is a reasonable basis to be believe that the information could be
used to identify the individual.
In contrast, information that has been de-identified is not protected under
the Privacy Rule. De-identification, however, is not simply removing the
individual’s name from the information. In fact, in order for information
to be truly “de-identified” for purposes of the Privacy Rule (and therefore
outside of the Privacy Rule’s scope), either all eighteen identifiers enumerated
in the Privacy Rule must be removed from the information or a person
with “appropriate knowledge of and experience with” accepted principles
and methods must determine that the risk is very small that the information
could be used alone or in combination with other available information to
identify the individual to whom the PHI relates.
What uses and disclosures are permitted
A covered entity may not use or disclose PHI unless that use or disclosure is
permitted by the Privacy Rule. A covered entity may disclose, and in fact, is
required to disclose PHI to the individual or the individual’s representative
and to the Secretary of HHS for purposes of determining compliance with
the Privacy Rule.
Uses and disclosures that are “incident to” an otherwise permitted use or
disclosure are also permitted under the Privacy Rule. For example, the Privacy
Rule does not prohibit a physician from discussing a patient’s medical condition
with that patient in a hospital room that is shared with another patient.
Any PHI that the other patient may hear is an incidental disclosure of PHI
and is permissible under the Privacy Rule.
Perhaps most important in terms of most day-to-day uses and disclosures of
PHI, the Privacy Rule permits covered entities to use and disclose PHI for purposes
of treatment, payment, and health care operations (commonly referred
to as TPO). Treatment includes the provision, coordination, or management of
health care, the consultation between health care providers, and the referral of
patients to other health care providers. Payment includes activities undertaken
by a health plan to obtain premiums or to determine or fulfill obligations
related to coverage and the provision of benefits. Payment also includes activities
undertaken by a health care provider or health plan to obtain or provide
reimbursement for health care. In defining payment, the Privacy Rule includes
October 2008
62
Health Care Compliance Association • 888-580-8373 • www.hcca-info.org