Refresh your memory with some of the Privacy Rule points below.
• HIPAA’s Privacy Rule goal is to protect the confidentiality of patient/resident healthcare information.
• Protected Health Information (PHI) is individually identifiable health information collected from an individual and created or received by a health care provider, health plan, or health care clearing house relating to past, present, or future physical or mental health conditions of an individual.
• Information is “individually identifiable” when any one or more of 18 types of identifiers can be used to identify an individual (e.g. name, address, dates such as birth date, account number etc.)
• The HIPAA Privacy Rule applies to healthcare organizations, healthcare plans, healthcare clearinghouses, and Business Associates with access to Protected Health Information (PHI).
• PHI can be in paper form, electronic as well as in verbal communications.
• Photos and videos of patients/residents are PHI and require documented authorization to take and use. • Access to PHI must be restricted to the minimum access needed to accomplish the intended objective.
• PHI cannot be used or disclosed without documented patient authorization unless it is for any of the following purposes or situations:
o Use or disclosure to the patient
o Use or disclosure for treatment, payment, or general healthcare operations
o Use or disclosure if the individual has the opportunity to agree or object to a disclosure such as a patient bringing a family with them when discussing care with a physician
• Covered Entities (CE) are required to provide residents/patients with a Notice of Privacy Practices (NPP) to tell how the CE may use and share their health information.
• Disposal of documents containing PHI must be rendered unreadable. Shredding is the most common method of disposal. Before disposal, be sure to follow your organization’s data retention policies.
For more information regarding HIPAA Privacy, visit www.hhs.gov.
