7.1 HIPAA Privacy Rule & Protected Health Information (PHI)

7.1 HIPAA Privacy Rule & Protected Health Information (PHI)

1. Historical & Legislative Foundations of HIPAA

The Health Insurance Portability and Accountability Act (HIPAA) was enacted by Congress in 1996 (Public Law 104-191) to modernize healthcare administration, ensure health insurance portability for workers transitioning between jobs, and combat healthcare fraud. Recognizing that the digitization of administrative transactions would expose sensitive patient records to privacy risks, Congress included Administrative Simplification provisions within Title II of the statute. This mandated the Department of Health and Human Services (HHS) to promulgate national standards governing privacy, security, and electronic transactions.

In December 2000, HHS issued the landmark HIPAA Privacy Rule (45 CFR Part 160 and Part 164, Subparts A and E), which became fully enforceable in April 2003. The primary objective of the Privacy Rule is to establish robust federal protections for personal health information while enabling the necessary flow of health data required to provide high-quality healthcare, protect public health, and execute complex billing operations. The rule balances individual privacy rights with legitimate clinical and operational information needs.

---

2. Protected Health Information (PHI) Defined

At the core of the Privacy Rule lies Protected Health Information (PHI). PHI is legally defined as individually identifiable health information transmitted or maintained in any medium (electronic, paper, or oral) by a Covered Entity or its Business Associate. To qualify as PHI, information must satisfy two criteria:

1. It must relate to the past, present, or future physical or mental health condition of an individual, the provision of healthcare, or the past, present, or future payment for healthcare.
2. It must identify the individual or provide a reasonable basis to believe that the information can be used to identify the individual.

Information properly de-identified according to HIPAA standards—either through the Safe Harbor method (removing all 18 statutory identifiers) or the Expert Determination method (statistical validation by a qualified expert)—is no longer considered PHI and falls outside HIPAA regulation.

---

3. The 18 Statutory PHI Identifiers

Under the Safe Harbor de-identification standard (45 CFR § 164.514(b)(2)), health data is considered individually identifiable if it contains any of the following 18 statutory identifiers belonging to the individual, relatives, employers, or household members:

---

4. Regulated Entities: Covered Entities & Business Associates

The Privacy Rule directly regulates specific classes of organizations divided into Covered Entities (CEs) and Business Associates (BAs).

Covered Entities (CEs)

Covered entities comprise three distinct categories:

• Healthcare Providers: Any physician, clinic, hospital, pharmacy, dentist, or allied health professional transmitting health data electronically for covered administrative transactions.
• Health Plans: Individual and group plans paying for medical care, including commercial health insurers, HMOs, Medicare, Medicaid, and self-insured employer plans.
• Healthcare Clearinghouses: Entities processing nonstandard health data into standard electronic formats, such as billing clearinghouses and value-added networks.

Business Associates (BAs)

A Business Associate is an individual or enterprise that creates, receives, maintains, or transmits PHI on behalf of a covered entity. Examples include billing vendors, EHR software developers, cloud hosting providers (e.g., AWS, Azure hosting PHI), legal counsel, external auditors, and data destruction vendors. Before sharing PHI, Covered Entities must execute a legally binding Business Associate Agreement (BAA) mandating appropriate safeguards and breach reporting.

---

5. Permitted Uses & Disclosures: The TPO Exception Framework

As a foundational rule, Covered Entities may not disclose PHI without a signed patient authorization. However, to maintain healthcare operations, the Privacy Rule establishes a statutory exception for Treatment, Payment, and Healthcare Operations (TPO).

Treatment

Treatment encompasses the provision, coordination, or management of healthcare by providers. It includes consultations between providers, referring a patient to a specialist, emergency care coordination, and pharmacy dispensing. Patient authorization is not required for treatment disclosures.

Payment

Payment encompasses activities undertaken to obtain reimbursement for care, as well as health plan eligibility and premium determinations. Examples include submitting claims to insurance carriers, utilization review, medical necessity evaluations, and billing collection services. Patient authorization is not required for payment disclosures.

Healthcare Operations

Operations encompass administrative, financial, legal, and quality improvement activities necessary to run a healthcare organization. Examples include clinical quality assessment, accreditation reviews, medical resident training, peer review, legal auditing, and fraud detection. Patient authorization is not required for healthcare operations.

Non-TPO Mandatory Authorizations

Disclosures outside TPO require explicit patient authorization, including marketing activities, sale of PHI, psychotherapy notes, and unapproved research disclosures.

---

6. The Minimum Necessary Standard & Role-Based Access Control

The Minimum Necessary Standard (45 CFR § 164.502(b)) requires Covered Entities and Business Associates to limit PHI use, disclosure, or requests to the minimum amount necessary to accomplish the intended purpose.

Organizations operationalize this standard using Role-Based Access Control (RBAC) within electronic health records. Under RBAC, access profiles are assigned based on job roles:

• A bedside registered nurse receives full access to clinical flowsheets, lab results, and progress notes.
• A hospital billing clerk receives access strictly to demographic identifiers, diagnostic codes (ICD-10), procedural codes (CPT), and insurance details, but is restricted from reading progress notes.

The Minimum Necessary standard does not apply to treatment disclosures among providers, disclosures to the patient, disclosures made pursuant to signed authorizations, or disclosures required by law.

---

7. Patient Statutory Rights Under the Privacy Rule

The Privacy Rule grants individuals enforceable statutory rights regarding their health records:

• Right to Access (45 CFR § 164.524): Patients have the right to inspect and obtain a copy of their PHI stored within a Designated Record Set within 30 calendar days (with one allowable 30-day extension if written justification is provided).
• Right to Amend (45 CFR § 164.526): Patients may request corrections to inaccurate or incomplete PHI. Entities must respond within 60 days.
• Right to an Accounting of Disclosures (45 CFR § 164.528): Patients can request an accounting list of non-TPO disclosures made during the preceding six years.
• Right to Request Restrictions (45 CFR § 164.522(a)): Patients may request restrictions on TPO disclosures. Entities must agree if the patient pays out-of-pocket in full and requests that the claim not be submitted to their health plan.
• Right to Confidential Communications (45 CFR § 164.522(b)): Patients can request health communications via alternative means or locations.

---

8. Notice of Privacy Practices (NPP) Requirements

Covered entities must produce and distribute a plain-language Notice of Privacy Practices (NPP) detailing how PHI is used, outlining patient rights, and stating legal duties. Providers must present the NPP no later than the date of first service delivery and make a good faith effort to obtain written acknowledgment of receipt.