4.2 HIPAA Privacy Rule

What the Privacy Rule Protects

The HIPAA Privacy Rule sets national standards for protecting protected health information (PHI). PHI is individually identifiable health information — covering a person's past, present, or future physical or mental health, the care provided, or payment for that care — that is created or held by a Covered Entity or Business Associate, in any form: paper, electronic, or spoken. Notice the breadth: a billing question shouted across an open office is just as much PHI as the 837 claim file.

Health information is considered identifiable when it includes one or more of 18 specific identifiers. Removing all 18 — and confirming there is no remaining reasonable way to re-identify the person — produces de-identified data, which is no longer PHI and falls outside the Privacy Rule. A limited data set strips most identifiers but keeps dates and some geographic data; it still requires a data use agreement.

The 18 HIPAA Identifiers

A frequent exam trap: a date of service, an SSN, and a member ID on a claim are all identifiers — you cannot strip just the name and call data anonymous. ZIP codes count as geography; under safe harbor de-identification, even the first three ZIP digits must be generalized when the population is small.

TPO: Treatment, Payment, and Healthcare Operations

The Privacy Rule permits a Covered Entity to use and disclose PHI without patient authorization for three core purposes, abbreviated TPO:

• Treatment — providing and coordinating patient care among providers
• Payment — billing and collecting for care, including submitting claims, verifying eligibility, obtaining prior authorization, and pursuing reimbursement
• Healthcare Operations — quality improvement, audits, business management, training, and credentialing

Billing is squarely a payment activity, so a biller does not need a signed authorization to submit a claim to a payer or to call about a denial.

Minimum Necessary Standard

When using or disclosing PHI, a Covered Entity must make reasonable efforts to limit it to the minimum necessary to accomplish the purpose. A claim should carry only the diagnoses, procedures, and demographics the payer needs to adjudicate — not the entire chart. The important exceptions where minimum necessary does not apply:

• Disclosures to or requests by a provider for treatment
• Disclosures to the patient about their own information
• Disclosures the patient has specifically authorized
• Disclosures required by law or to HHS for compliance

Notice of Privacy Practices and Patient Rights

A Covered Entity must give patients a Notice of Privacy Practices (NPP) describing how PHI is used and the rights patients hold, and must make a good-faith effort to obtain a written acknowledgment of receipt. Key patient rights:

Authorization vs. Consent

A HIPAA authorization is a specific, signed document required before PHI may be used or disclosed for non-TPO purposes such as marketing, the sale of PHI, or release of psychotherapy notes. A general consent for routine TPO is permitted but not required. Billers should never treat a signed authorization as optional for non-TPO releases — those uses are prohibited without it, and improperly disclosing PHI to, say, a marketing firm without authorization is a Privacy Rule violation.

Incidental Disclosures and Common Billing Pitfalls

The Privacy Rule tolerates incidental disclosures — minor, unavoidable exposures that occur as a byproduct of an otherwise permitted use — as long as the entity applies reasonable safeguards and minimum necessary. A patient overhearing a name at a busy front desk is incidental and not a violation; posting that patient's full diagnosis on a whiteboard visible to the waiting room is not. For billers, the everyday risks are predictable: faxing an explanation of benefits to the wrong number, mailing a statement to an old address, discussing a balance with a relative who is not a personal representative, or leaving detailed voicemails.

Best practice is to leave only minimal callback information and to verify identity before releasing account details.

A Covered Entity may disclose PHI to a patient's personal representative — someone with legal authority such as a parent of a minor or a healthcare power of attorney — but not to a spouse or adult child by default. When a payer, attorney, or family member requests records for a non-TPO purpose, route the request through a valid HIPAA authorization rather than releasing on a verbal say-so.