Now let’s cover HIPAA Privacy and Security Rules.
The HIPAA Security rule covers the electronic use of sharing ePHI as long as safeguards
are in place.
The HIPAA privacy rule sets standards for how protected health information should be
controlled by setting forth what usage and disclosures are authorized or required and
what rights patients have with respect to their health information.
The Privacy and Security Rules allows covered health care providers to share PHI electronically
for treatment purposes, as long as they apply reasonable safeguards when doing so.
Thus, for example, a physician may consult with another physician by secure e-mail about
a patient's condition, or a health care provider may electronically exchange PHI through Electronic
Medical Records for patient care.
A covered entity needs to engage administrative, physical, and technical safeguards to protect
information.
A covered entity needs to perform a risk analysis to determine what measures need to be taken
to reduce risks and vulnerabilities to a reasonable and appropriate level.
Administrative safeguards include office rules and procedures that keep data secure.
Covered entities should designate a security official who is responsible for developing
and implementing its security policies and procedures.
They should also determine who should be authorized to access PHI.
They should also train all staff in security policies and procedures, and apply appropriate
sanctions against workforce members who violate the policies and procedures.
They should also perform a periodic assessment of how well the security policies and procedures
meet the requirements of the Security Rule.
An example of administrative security would be allowing only the office manager to send
PHI in electronic form.
Physical safeguards include: Limiting physical access to facilities while ensuring that authorized
access is allowed.
Implementing policies and procedures to specify proper use of and access to computers or the
position of screens in patient areas.
They must also have in place policies and procedures regarding the physical transfer,
removal, disposal, and reuse of electronic media, like computer hard drives.
An example of a physical safeguard would be keeping all patient files in a locked room
that only specific authorized personnel may have access to.
Some technical safeguards include: Implementing hardware, software, and/or procedural mechanisms
to record and examine access and other activity in information systems that contain or use
protected health information.
You must implement policies and procedures to ensure that electronic measures are put
in place to confirm protected health information is not improperly altered or destroyed.
In addition, you will need to implement technical security measures that guard against unauthorized access
to protected health information that is being transmitted over an electronic network.
An example of a technical safeguard would be data encryption and using strong passwords
to protect files from unauthorized access.
The Privacy Rule gives needed flexibility for providers and plans to create their own
privacy procedures, tailored to fit their size and needs.
However, no matter the size of a covered entity, whether a small optometrist office or a large
hospital with thousands of staff, the covered entity must have written privacy procedures.
In general, a covered entity must secure patient records containing personally identifiable
health information so that the information is not readily available to those who do not
need it.
The covered entity must always release only as much information as necessary to address
the specific need of the entity requesting the information.
This is what the regulation refers to as the "minimum amount necessary" to satisfy the
inquiry.