HIPAA Privacy, Security, and Minimum Necessary Standards in Auditing

HIPAA Privacy, Security, and Minimum Necessary Standards in Auditing

The Health Insurance Portability and Accountability Act of 1996 (HIPAA, Public Law 104-191) and the Health Information Technology for Economic and Clinical Health (HITECH) Act of 2009 establish stringent federal protections for patient health information. For Certified Professional Medical Auditors (CPMAs), HIPAA compliance is an absolute operational requirement. Auditors routinely handle sensitive clinical documentation, billing records, and electronic health records (EHR). Understanding Privacy and Security Rules, Business Associate Agreements (BAAs), the Minimum Necessary Standard, and Breach Notification protocols is vital to conducting lawful, secure audit engagements.

---

1. Regulatory Architecture of HIPAA

HIPAA regulations are codified under 45 CFR Parts 160 and 164 and enforced by the HHS Office for Civil Rights (OCR). The legal framework consists of four primary rules:

1. The Privacy Rule (Subparts A & E): Standards for the use and disclosure of Protected Health Information (PHI) by covered entities and business associates.
2. The Security Rule (Subpart C): Administrative, physical, and technical safeguards to ensure the confidentiality, integrity, and availability of electronic PHI (ePHI).
3. The Breach Notification Rule (Subpart D): Mandates specific reporting requirements when unencrypted PHI is compromised.
4. The Enforcement Rule: Establishes civil monetary penalty structures, investigation procedures, and hearing processes for HIPAA violations.

---

2. Protected Health Information (PHI) and the 18 Identifiers

Protected Health Information (PHI) is defined as individually identifiable health information held or transmitted by a Covered Entity or Business Associate, in any form or media (electronic, paper, or oral). It relates to:

• The past, present, or future physical or mental health or condition of an individual;
• The provision of healthcare to the individual; or
• The past, present, or future payment for the provision of healthcare to the individual.

The 18 Specific HIPAA Identifiers

Information is considered PHI if it contains any of the following 18 unique identifiers combined with health data:

1. Patient names
2. Geographic subdivisions smaller than a state (street address, city, county, 5-digit ZIP code)
3. All elements of dates (except year) directly related to an individual (birth date, admission date, discharge date, date of death, age >89)
4. Telephone numbers
5. Fax numbers
6. Email addresses
7. Social Security Numbers (SSN)
8. Medical Record Numbers (MRN)
9. Health plan beneficiary numbers
10. Account numbers
11. Certificate/license numbers
12. Vehicle identifiers and serial numbers (including license plate numbers)
13. Device identifiers and serial numbers
14. Web Universal Resource Locators (URLs)
15. Internet Protocol (IP) address numbers
16. Biometric identifiers (fingerprints, voiceprints)
17. Full-face photographic images and comparable images
18. Any other unique identifying number, characteristic, or code

---

3. Covered Entities vs. Business Associates in Auditing

Covered Entities (CEs)

Under HIPAA, Covered Entities include:

• Healthcare Providers (physicians, hospitals, clinics, pharmacies submitting electronic claims);
• Health Plans (health insurance issuers, HMOs, Medicare/Medicaid programs);
• Healthcare Clearinghouses.

Business Associates (BAs) and Business Associate Agreements (BAAs)

A Business Associate (BA) is a person or entity—other than a workforce member—that creates, receives, maintains, or transmits PHI on behalf of a Covered Entity for a regulated function, including auditing, legal, billing, consulting, or data analysis services.

Internal vs. External Auditors:

• Internal Medical Auditors: Employed directly by a hospital or physician practice are classified as workforce members. They do not sign a BAA, but must adhere to internal HIPAA policies.
• External Independent CPMA Consultants: Operating as independent contractors or third-party audit firms are classified as Business Associates. They MUST execute a written Business Associate Agreement (BAA) with the Covered Entity before receiving or accessing any patient medical records or PHI.

Statutory Direct Liability under HITECH

Under the HITECH Act of 2009, Business Associates are directly liable under federal law for HIPAA Security Rule compliance and Privacy Rule violations. BAs are subject to direct OCR audits, civil monetary penalties, and enforcement actions.

---

4. The Minimum Necessary Standard in Auditing — 45 CFR § 164.502(b)

The Minimum Necessary Standard mandates that when using, disclosing, or requesting PHI, Covered Entities and Business Associates must make reasonable efforts to limit PHI to the minimum necessary to accomplish the intended purpose of the use, disclosure, or request.

Application to Audit Engagements:

• Audit Scope Design: Auditors must not request or extract entire patient databases when auditing a specific CPT code or date range. If an audit focuses on minor surgical procedures in 2024, requesting records outside that date range or specialty violates Minimum Necessary.
• Workpaper Redaction: Audit spreadsheets, findings reports, and presentation slides shared with management or external parties must utilize pseudo-identifiers (e.g., Patient A, Sample #1) or MRNs rather than full names and SSNs wherever feasible.

Statutory Exceptions to Minimum Necessary:

The Minimum Necessary Standard does NOT apply to:

1. Disclosures by or requests by a healthcare provider for treatment purposes;
2. Disclosures made directly to the individual patient;
3. Uses or disclosures made pursuant to a patient's formal signed authorization;
4. Disclosures required by law (e.g., court orders, mandatory abuse reporting);
5. Disclosures to HHS OCR for HIPAA compliance investigations.

---

5. Security Safeguards and Breach Notification

Medical auditors who store, transmit, or analyze electronic PHI (ePHI) on laptops, flash drives, or cloud storage must comply with HIPAA Security Rule safeguards.

Required Safeguards:

• Administrative Safeguards: Security management processes, mandatory employee security training, role-based access permissions, and formal risk analyses.
• Physical Safeguards: Workstation security, physical access controls, and strict media disposal protocols (shredding paper records, degaussing/destroying hard drives).
• Technical Safeguards: Unique user identification, automatic log-off, access controls, audit logs (tracking who accessed ePHI), and AES-256 encryption for ePHI at rest and in transit.

The Breach Notification Rule (45 CFR §§ 164.400–414)

A Breach is an impermissible acquisition, access, use, or disclosure of unencrypted PHI that compromises the security or privacy of the information.

• Risk Assessment: An acquisition of unencrypted PHI is presumed to be a breach unless the entity demonstrates through a 4-factor risk assessment that there is a low probability the PHI was compromised.
• Notification Timelines:
  • Individual Notification: Written notice sent without unreasonable delay and in no case later than 60 calendar days after discovery of the breach.
  • HHS OCR Notification: If a breach affects 500 or more individuals, OCR must be notified without unreasonable delay (and within 60 days). If fewer than 500 individuals, notification must be submitted within 60 days of the end of the calendar year.
  • Media Notification: If a breach affects 500 or more residents of a single state or jurisdiction, prominent media outlets must be notified within 60 days.