13.1 HIPAA Privacy Rule: PHI, Notice of Privacy Practices & Minimum Necessary

HIPAA Privacy Rule: PHI, Notice of Privacy Practices & Minimum Necessary

Quick Summary: The Health Insurance Portability and Accountability Act of 1996 (HIPAA) Title II Administrative Simplification statute established the first national baseline for protecting sensitive patient medical information. The HIPAA Privacy Rule (45 C.F.R. Part 160 and Part 164, Subparts A and E) balances patient privacy protections with the operational necessity of sharing clinical data for legitimate healthcare delivery. Practice managers must master the statutory definitions of Covered Entities (CEs) and Business Associates (BAs), the 18 identifiers that constitute Protected Health Information (PHI), the operational boundaries of Treatment, Payment, and Health Care Operations (TPO), the strict constraints governing the Minimum Necessary rule, and the execution of patient rights including record access within 30 calendar days.

---

Statutory Framework & Covered Entity Architecture

Enacted under Public Law 104-191, HIPAA was designed to improve health insurance portability, combat healthcare fraud, standardize electronic healthcare transactions, and safeguard individual medical privacy. The Privacy Rule standards apply to two primary statutory classifications:

                         HIPAA PRIVACY RULE ECOSYSTEM
                                      │
         ┌────────────────────────────┴────────────────────────────┐
         ▼                                                         ▼
  COVERED ENTITIES (CEs)                                 BUSINESS ASSOCIATES (BAs)
  ├─ Healthcare Providers (transmitting EDI)             ├─ Billing & Revenue Cycle Companies
  ├─ Health Plans (commercial, Medicare, Medicaid)       ├─ EHR & Cloud Hosting Vendors
  └─ Healthcare Clearinghouses                           ├─ Practice Management Consultants
                                                         └─ Shredding & Document Storage Vendors
                                                                   │
                                                                   ▼
                                                         SUBCONTRACTORS OF BAs
                                                         (Direct statutory liability!)

1. Covered Entities (45 C.F.R. § 160.103)

A Covered Entity (CE) is statutorily defined as:

• Healthcare Providers: Any provider of medical or health services, physicians, group practices, clinics, hospitals, pharmacies, dentists, psychologists, or chiropractors who transmit any health information in electronic form in connection with a HIPAA standard transaction (such as electronic claims submission, eligibility inquiries, or referral authorizations).
• Health Plans: Individual and group plans that provide or pay the cost of medical care, including commercial health insurers, Health Maintenance Organizations (HMOs), Medicare Parts A, B, C, and D, Medicaid, TRICARE, veterans' health programs, and employer-sponsored group health plans.
• Healthcare Clearinghouses: Public or private entities that process nonstandard health information received from another entity into standard data elements or electronic transactions (e.g., billing clearinghouses, repricing companies, community health information systems).

2. Business Associates (BAs) & Subcontractors

A Business Associate (BA) is an individual or corporate entity that creates, receives, maintains, or transmits PHI on behalf of a covered entity to perform a function or activity regulated by HIPAA, or provides legal, actuarial, accounting, consulting, management, administrative, accreditation, or financial services where PHI disclosure is involved.

• Examples of BAs: Third-party billing companies, EHR vendors with data access, cloud storage hosts, transcriptionists, collection agencies, independent compliance auditors, answering services, and legal counsel.
• Direct Liability under HITECH: Prior to 2009, business associates were bound only by private contract with covered entities. Under the Health Information Technology for Economic and Clinical Health (HITECH) Act, business associates and their subcontractors are directly liable under federal law for compliance with the HIPAA Security Rule and the privacy provisions outlined in their Business Associate Agreements (BAAs).

3. Hybrid and Affiliated Entities

• Hybrid Entity: A single legal entity that performs both covered and non-covered functions (e.g., a university with an academic medical center or a municipal government operating a public health clinic). To qualify as a hybrid entity, the organization must formally designate its health care components in writing, segregating PHI within the covered component.
• Affiliated Covered Entity (ACE): Legally separate covered entities that are under common ownership or control may designate themselves as a single affiliated covered entity for HIPAA compliance purposes.

---

Protected Health Information (PHI) & Safe Harbor De-Identification

Defining PHI (45 C.F.R. § 160.103)

Protected Health Information (PHI) is defined as individually identifiable health information held or transmitted by a covered entity or business associate in any form or media, whether electronic (ePHI), paper, or oral. To be classified as PHI, information must satisfy three cumulative statutory criteria:

1. It is created or received by a healthcare provider, health plan, employer, or healthcare clearinghouse;
2. It relates to the past, present, or future physical or mental health or condition of an individual, the provision of health care to an individual, or the past, present, or future payment for the provision of health care; and
3. It identifies the individual, or there is a reasonable basis to believe the information can be used to identify the individual.

The 18 Safe Harbor Identifiers (45 C.F.R. § 164.514(b))

Under the Privacy Rule, health information is not subject to HIPAA restrictions if it has been fully de-identified. Covered entities may achieve de-identification through one of two methods: the Expert Determination Method (formal statistical analysis) or the widely utilized Safe Harbor Method.

Under Safe Harbor, health information is considered de-identified only if all 18 specific individual identifiers of the patient, relatives, employers, or household members are permanently removed, and the covered entity has no actual knowledge that the remaining information could be used alone or in combination with other data to identify the individual:

---

Permitted Uses & Disclosures Without Authorization: TPO & Public Interest

A central operational principle of the Privacy Rule is that covered entities may use and disclose PHI without obtaining prior written patient authorization for Treatment, Payment, and Health Care Operations (TPO) under 45 C.F.R. § 164.506.

                    TPO: CORE PERMITTED USES & DISCLOSURES
                                       │
         ┌─────────────────────────────┼─────────────────────────────┐
         ▼                             ▼                             ▼
     TREATMENT                      PAYMENT                   OPERATIONS
  ├─ Direct patient care        ├─ Billing & claims           ├─ Clinical quality review
  ├─ Specialist referrals       ├─ Eligibility verification   ├─ Provider credentialing
  ├─ Lab & imaging orders       ├─ Prior authorization        ├─ Accreditation audits
  └─ Hospital coordination      └─ Utilization review         └─ Medical staff training

1. Treatment

The provision, coordination, or management of healthcare and related services by one or more healthcare providers, including coordination with a third party, consultations between providers regarding a patient, and patient referrals from one provider to another.

• Operational Example: A primary care physician faxes clinical notes, medication lists, and lab panels to an endocrinologist for a referred patient without needing a signed release form.

2. Payment

The activities undertaken by a covered healthcare provider or health plan to obtain or provide reimbursement for the provision of healthcare.

• Operational Scope: Determining eligibility or coverage; billing, claims management, collection activities, medical necessity review, utilization review, and pre-authorization of clinical services.
• Operational Example: The practice billing department submits an electronic 837P claim containing diagnostic and procedural codes to Medicare Part B.

3. Health Care Operations

Certain administrative, financial, legal, and quality improvement activities of a covered entity necessary to run its business and support treatment and payment functions:

• Conducting quality assessment and improvement activities, clinical outcomes evaluations, and case management.
• Reviewing the competence or qualifications of healthcare professionals, evaluating practitioner performance, conducting training programs for medical students and residents, and accreditation, certification, or credentialing activities.
• Underwriting, premium rating, and other activities relating to the creation or renewal of a health insurance contract.
• Conducting or arranging for medical reviews, legal services, and auditing functions, including fraud and abuse detection and compliance programs.
• Business planning, development, and general administrative activities (e.g., customer service, grievance resolution, internal restructuring).

4. Permitted Public Interest Disclosures (45 C.F.R. § 164.512)

The Privacy Rule recognizes 12 national priority exceptions where public safety outweighs individual privacy, permitting disclosures without patient consent or authorization:

1. Required by Law: Federal, state, or local statutory mandates (e.g., mandatory reporting of gunshot wounds, stabbings, or communicable diseases).
2. Public Health Activities: Disclosures to public health authorities authorized by law to collect data for preventing or controlling disease, injury, or disability (e.g., reporting COVID-19 or tuberculosis cases to the CDC or local department of health; FDA adverse event reporting).
3. Victims of Abuse, Neglect, or Domestic Violence: Mandatory reporting of suspected child abuse to child welfare agencies, or adult elder abuse to protective service agencies.
4. Health Oversight Activities: Audits, civil or criminal investigations, licensure inspections, and administrative enforcement by agencies like the HHS Office of Inspector General (OIG), Centers for Medicare & Medicaid Services (CMS), or state medical licensing boards.
5. Judicial and Administrative Proceedings: In response to an order of a court or administrative tribunal, or in response to a subpoena, discovery request, or other lawful process if accompanied by satisfactory assurances of notice to the patient or a qualified protective order.
6. Law Enforcement Purposes: Specific, limited inquiries: identifying or locating a suspect, fugitive, material witness, or missing person; reporting crimes occurring on clinic premises; or responding to a court-issued warrant.
7. Decedents: Disclosures to coroners, medical examiners, and funeral directors to identify a deceased person or determine cause of death.
8. Cadaveric Organ Donation: Facilitating organ, eye, or tissue donation and transplantation to organ procurement organizations.
9. Research: When an Institutional Review Board (IRB) or Privacy Board has formally reviewed the research protocol and approved a waiver of patient authorization.
10. Serious Threat to Health or Safety: Preventing or lessening an imminent and serious threat to the health or safety of a person or the public (the duty to warn / Tarasoff doctrine).
11. Essential Government Functions: Military command authorities, national security and intelligence activities, and protective services for the President.
12. Workers' Compensation: Disclosures authorized by and to the extent necessary to comply with state workers' compensation statutes governing workplace injuries.

---

Mandatory Written Patient Authorization (45 C.F.R. § 164.508)

When a proposed use or disclosure of PHI falls outside TPO and statutory public interest exceptions, covered entities must obtain a valid written HIPAA authorization before releasing the information. Authorizations are strictly required in the following scenarios:

1. Marketing Communications

Marketing is defined as any communication about a product or service that encourages recipients to purchase or use the product or service. If the covered entity receives financial remuneration (direct or indirect payment) from a third party whose product or service is being promoted, the communication is marketing, and a specific written authorization is required.

• Exceptions: Communications describing refill reminders, generic equivalents, or general treatment recommendations delivered face-to-face by a clinician do not constitute marketing.

2. Sale of PHI

A covered entity or business associate may not directly or indirectly receive financial or non-financial remuneration in exchange for disclosing PHI unless the patient signs a valid authorization specifically stating that the disclosure will result in remuneration to the entity.

3. Psychotherapy Notes

Psychotherapy notes are notes recorded by a mental health professional documenting or analyzing the contents of a private counseling session, which are maintained separately from the rest of the individual's medical record. Disclosing psychotherapy notes almost universally requires separate, specific written authorization, even for treatment by another provider or payment purposes.

4. Core Elements of a Valid Authorization

An authorization is legally defective if it lacks any of the required core statutory elements:

• A meaningful, specific description of the information to be used or disclosed.
• The name or specific identification of the person(s) or class of persons authorized to make the disclosure.
• The name or specific identification of the person(s) or class of persons to whom the disclosure will be made.
• A description of each purpose of the requested use or disclosure (or "at the request of the individual").
• An explicit expiration date or expiration event relating to the individual or the purpose of the use (e.g., "one year from date of signature" or "upon completion of litigation").
• Signature of the individual (or personal representative) and date.
• Required Mandatory Statements:
  • The individual's right to revoke the authorization in writing at any time, with instructions on how to revoke.
  • The ability or inability to condition treatment, payment, enrollment, or eligibility on signing the authorization (as a rule, providers cannot condition treatment on signing).
  • The potential for information disclosed pursuant to the authorization to be subject to redisclosure by the recipient and no longer protected by the HIPAA Privacy Rule.

---

The Minimum Necessary Standard & Statutory Exceptions

Under 45 C.F.R. § 164.502(b) and § 164.514(d), covered entities and business associates must make reasonable efforts to limit the request, use, and disclosure of PHI to the minimum necessary to accomplish the intended purpose.

Role-Based Access Controls (RBAC)

Practice managers must operationalize the minimum necessary standard internally by establishing documented Role-Based Access Controls (RBAC). The practice must categorize workforce members into functional groups and define the specific categories of PHI each group needs to perform their assigned duties:

                      ROLE-BASED ACCESS CONTROL (RBAC) MATRIX

   Workforce Role       Permitted PHI Access Level          Justification
   ─────────────────────────────────────────────────────────────────────────────
   Front-Desk Staff     Demographics, Insurance, Appts      Check-in, scheduling
   Billing Specialists  Demographics, ICD/CPT Codes, EOBs   Claim creation & appeals
   Medical Assistants   Vitals, Allergies, Chief Complaint  Rooming, clinical prep
   Physicians & NPPs    Full Longitudinal Medical Record    Diagnosis & treatment
   Practice Manager     Financial, Operational, Audit Logs  Practice administration

The Six Critical Statutory Exceptions to Minimum Necessary

Medical practice administrators must recognize that the Minimum Necessary standard does not apply in six specific legal circumstances (45 C.F.R. § 164.502(b)(2)):

1. Disclosures to or requests by a healthcare provider for Treatment: Physicians and treating providers need unimpeded access to full clinical records to make accurate diagnoses and avoid life-threatening medication errors.
2. Disclosures made directly to the Individual Patient: When an individual exercises their statutory right of access to inspect or copy their own record.
3. Uses or disclosures made pursuant to an Authorization: The patient has explicitly authorized the release of specified records (e.g., complete medical history to life insurance underwriters).
4. Disclosures required by Law: Compliance with mandatory reporting statutes (e.g., subpoena issued by a court, gunshot wound reports).
5. Disclosures required for HIPAA Compliance Investigations: Disclosures to the Department of Health and Human Services (HHS) Office for Civil Rights (OCR) for investigating privacy violations.
6. Disclosures required for Standard EDI Transactions: Electronic transactions conforming to HIPAA transaction standards.

---

Notice of Privacy Practices (NPP - 45 C.F.R. § 164.520)

Covered entities must produce and distribute a comprehensive Notice of Privacy Practices (NPP) informing patients of how their medical data is utilized and their individual legal rights.

Mandatory Header Language

The Privacy Rule statutorily mandates that the NPP display the following exact capitalized header prominently on the first page:

"THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY."

Mandatory Elements of the NPP

• Descriptions and examples of how the practice uses and discloses PHI for Treatment, Payment, and Healthcare Operations.
• Descriptions of each purpose for which the covered entity is permitted or required to disclose PHI without authorization.
• A statement that other uses and disclosures (e.g., marketing, sale of PHI, psychotherapy notes) will be made only with the individual's written authorization, and that the individual may revoke such authorization.
• A description of individual rights: right to access, right to amend, right to an accounting of disclosures, right to request restrictions, and right to request confidential communications.
• The practice's legal duties: statutory duty to maintain privacy of PHI, provide the NPP, and notify affected individuals following a breach of unsecured PHI.
• Instructions on how to file a privacy complaint with the medical practice's Privacy Officer and with the Secretary of HHS, accompanied by an explicit assurance that the practice will never retaliate against any patient for filing a complaint.
• Contact person name or title, telephone number, and the effective date of the notice.

Distribution & Good Faith Acknowledgment Protocol

• Delivery Timing: The practice must provide the NPP to the patient no later than the date of the first service delivery (intake).
• Written Acknowledgment: The practice must make a good faith effort to obtain a signed, written acknowledgment of receipt from the patient.
• Handling Refusal or Inability to Sign: If the patient refuses to sign or cannot sign (due to medical emergency, cognitive impairment, or acute distress), the practice is legally permitted to treat the patient! The front-desk staff must document the good faith effort made to obtain the acknowledgment and state the clear reason why the signature was not obtained.
• Physical & Electronic Availability: The NPP must be posted prominently in the clinical waiting room and posted on the practice website with direct accessibility.

---

Individual Patient Rights Under the Privacy Rule

Congress granted individuals five fundamental statutory rights regarding their health information:

1. Right of Access and Inspection (45 C.F.R. § 164.524)

• Scope: Patients have an enforceable right to inspect and obtain a copy of their PHI maintained in a Designated Record Set (medical records, billing records, and any records used to make healthcare decisions).
• Exclusions: Psychotherapy notes and information compiled in reasonable anticipation of civil, criminal, or administrative litigation.
• Statutory Deadline: The practice must fulfill the request within 30 calendar days. If the records are archived offsite or technically delayed, a single 30-calendar-day extension is permitted, provided the practice issues a written explanation to the patient before the original 30 days expire.
• Format: The practice must provide records in the format requested by the patient (e.g., electronic PDF, patient portal export) if readily producible.
• Fee Limitations: The practice may charge only a reasonable, cost-based fee that includes actual labor costs for copying/exporting, supplies (paper or physical electronic media like USB drives), and postage. Charging retrieval fees, search fees, or data maintenance fees is strictly illegal under HIPAA!

2. Right to Request Amendment (45 C.F.R. § 164.526)

• Patients have the right to request that a covered entity amend inaccurate or incomplete PHI in their designated record set.
• Response Deadline: The practice must act within 60 calendar days (with one 30-day extension permitted).
• Permissible Grounds for Denial: The practice may deny the amendment if the record: (1) was not created by the practice (unless the original creator is unavailable), (2) is not part of the designated record set, (3) is not available for patient inspection (e.g., psychotherapy notes), or (4) is accurate and complete.
• Patient Recourse: If denied, the practice must issue a written denial. The patient has the right to submit a formal Statement of Disagreement, which must be appended to the disputed record and transmitted with all future disclosures.

3. Right to an Accounting of Disclosures (45 C.F.R. § 164.528)

• Patients have the right to receive an itemized accounting of disclosures of their PHI made by the covered entity during the six (6) years prior to the request date.
• Statutory Exceptions: The accounting does not include disclosures made: for Treatment, Payment, or Operations; to the individual themselves; pursuant to a signed patient authorization; for facility directories; for national security purposes; or incidental to an otherwise permitted disclosure.
• Frequency and Fees: The practice must provide one free accounting per 12-month period; subsequent requests within 12 months may incur a reasonable cost-based fee.

4. Right to Request Confidential Communications (45 C.F.R. § 164.522(b))

• Patients have the right to request that healthcare providers communicate with them regarding PHI by alternative means or at alternative locations (e.g., calling a cell phone instead of a home landline, sending mail to a P.O. Box rather than a home address, or sending secure emails).
• Mandatory Accommodation: Healthcare providers must accommodate reasonable requests. Providers cannot demand an explanation or require the patient to justify why the accommodation is needed!

5. Right to Request Restrictions (45 C.F.R. § 164.522(a))

• General Rule: Patients may request that a covered entity restrict the use or disclosure of PHI for TPO. As a general rule, the practice is not required to agree to requested restrictions.
• The Mandatory HITECH Exception: Under Section 13405(a) of the HITECH Act, a covered entity must agree to a requested restriction if:
  1. The disclosure is to a health plan for purposes of carrying out payment or health care operations (not treatment); and
  2. The PHI pertains solely to a healthcare item or service for which the healthcare provider has been paid in full out-of-pocket by the patient or another person on behalf of the patient.

---

Realistic Management Scenario: Handling a Third-Party Subpoena vs. Court Order

The Situation: A process server arrives at a private six-physician pediatric orthopedic practice and hands the front-desk receptionist a formal legal document commanding the immediate production of the complete medical and psychiatric records of a 14-year-old patient involved in a personal injury lawsuit. The document is titled "Subpoena Duces Tecum" and is signed by an attorney representing an automobile insurance company. The receptionist prepares to scan and email the complete electronic health record to the attorney immediately to avoid being held in contempt of court.

                  SUBPOENA DUCES TECUM RESPONSE WORKFLOW

   [ Subpoena Received ] ──► [ Check Signer: Judge or Attorney? ]
                                         │
                  ┌──────────────────────┴──────────────────────┐
                  ▼                                             ▼
        [ Signed by a Judge ]                         [ Signed by an Attorney ]
        (Court Order)                                 (Attorney-Issued Subpoena)
                  │                                             │
                  ▼                                             ▼
        Comply with order;                            Do NOT release immediately!
        Disclose exact scope                          Verify 1 of 2 criteria:
        under 45 CFR 164.512(e)(1)(i)                 ├─ Written patient authorization, OR
                                                      ├─ Satisfactory Assurances:
                                                         • Notice to patient, and the    
                                                           time to object has passed, OR
                                                         • Qualified Protective Order (QPO)

The Manager's Action Plan:

1. Immediate Halt & Document Review: The practice manager intercepts the transaction. The manager explains that an attorney-signed subpoena is not a court order. Under 45 C.F.R. § 164.512(e), disclosing PHI solely in response to an attorney's subpoena without satisfying specific procedural safeguards constitutes an illegal HIPAA privacy breach.
2. Evaluating the Legal Authority:
   • Court Order: If the document were signed directly by a judge or magistrate, the practice could disclose the specific records ordered.
   • Attorney Subpoena: Because this subpoena is signed by an attorney, the practice can only disclose records if the attorney provides written documentation showing "satisfactory assurances" that either: (a) a good faith effort was made to give the patient written notice with adequate time to object, and no objections were filed, or (b) the parties agreed on a Qualified Protective Order (QPO) prohibiting disclosure outside the litigation.
3. Minimum Necessary Review & State Law Preemption: The manager observes that the subpoena requests psychiatric records. Psychotherapy notes are protected under § 164.508 and require explicit written patient authorization. Furthermore, the state's minor consent laws restrict parental release of sensitive adolescent health data.
4. Operational Outcome: The manager contacts the patient's legal guardian, secures a fully compliant, signed HIPAA Authorization specifying exactly which orthopedic records may be released, redacts all unrelated psychiatric and adolescent notes, and securely transmits only the minimum necessary clinical files to the requesting attorney.

---

Exam Traps & Regulatory Best Practices