9.3 HIPAA Privacy, Security & Protected Health Information

9.3 HIPAA Privacy, Security & Protected Health Information

The Health Insurance Portability and Accountability Act of 1996 (HIPAA), codified in 45 CFR Parts 160 and 164, established nationwide standards to protect sensitive patient health information from unauthorized disclosure. Enforced by the Department of Health and Human Services (HHS) Office for Civil Rights (OCR) and the Department of Justice (DOJ), HIPAA compliance is a cornerstone of professional pharmacy practice and a heavily tested domain on the MPJE.

1. Covered Entities, Business Associates & Protected Health Information (PHI)

To apply HIPAA regulations correctly, candidates must master the fundamental definitions governing regulatory scope:

┌─────────────────────────────────────────────────────────────────────────────┐
│                     HIPAA JURISDICTIONAL ARCHITECTURE                       │
├─────────────────────────────────────────────────────────────────────────────┤
│ COVERED ENTITIES (CE):                                                      │
│ • Pharmacies (retail, institutional, mail-order, compounding)               │
│ • Healthcare Providers (physicians, dentists, APRNs, PAs, hospitals)        │
│ • Health Plans (health insurance issuers, HMOs, Medicare/Medicaid programs) │
│ • Healthcare Clearinghouses (billing billing intermediaries, claim routers) │
│                                                                             │
│ BUSINESS ASSOCIATES (BA):                                                   │
│ • Third-party vendors performing services involving PHI on behalf of a CE   │
│ • Examples: Pharmacy software vendors, PBM claims processors, document      │
│   shredding services, cloud hosting platforms, collection agencies          │
│ • MUST execute a written Business Associate Agreement (BAA) binding the    │
│   BA to direct statutory HIPAA liability and security standards             │
│                                                                             │
│ PROTECTED HEALTH INFORMATION (PHI):                                         │
│ • Individually identifiable health information transmitted or maintained in │
│   any form (electronic, paper, or oral) created or received by a CE/BA     │
│ • Relates to past, present, or future physical/mental health condition,     │
│   the provision of healthcare, or the payment for healthcare services      │
└─────────────────────────────────────────────────────────────────────────────┘

The 18 HIPAA Identifiers

Health information is deemed "individually identifiable" if it contains any of the 18 statutory HIPAA identifiers, including: 1) Names; 2) Geographic subdivisions smaller than a state (street address, city, county, ZIP code); 3) All dates (DOB, admission, discharge, death, exact age if $\ge 90$); 4) Telephone numbers; 5) Fax numbers; 6) Email addresses; 7) Social Security numbers; 8) Medical record numbers (MRNs); 9) Health plan beneficiary numbers; 10) Account numbers; 11) Certificate/license numbers; 12) Vehicle identifiers and serial numbers (VINs, license plates); 13) Device identifiers and serial numbers; 14) Web URLs; 15) IP addresses; 16) Biometric identifiers (fingerprints, voiceprints); 17) Full-face photographic images; 18) Any other unique identifying number, characteristic, or code.

De-Identification Standards

Information is exempt from HIPAA restrictions only if it is de-identified via: (1) Safe Harbor Method (complete removal of all 18 identifiers with no actual knowledge of re-identification capability), or (2) Expert Statistical Determination (formal mathematical certification of very small risk of re-identification).

2. Notice of Privacy Practices (NPP) & Good Faith Acknowledgment

Under 45 CFR § 164.520, covered pharmacies must develop and distribute a comprehensive Notice of Privacy Practices (NPP) detailing how PHI is used, disclosed, and protected, as well as outlining individual patient rights.

Core NPP Operational Requirements

1. First Date of Service: The pharmacy must provide the NPP to the patient no later than the date of the first service delivery (in-person dispensing or electronic transmission).
2. Good Faith Effort for Acknowledgment: The pharmacy must make a good faith effort to obtain a signed, written acknowledgment from the patient confirming receipt of the NPP.
3. Patient Refusal to Sign: If the patient refuses or is unable to sign the acknowledgment (e.g., emergency situation, acute distress, active refusal), the pharmacy must document the good faith effort and the specific reason why acknowledgment was not obtained. A patient's refusal to sign the NPP acknowledgment does NOT prevent the pharmacy from dispensing prescriptions or providing care.
4. Physical & Digital Posting: The pharmacy must prominently display the complete NPP in a clear and prominent location within the physical pharmacy where patients can readily read it, and post the NPP prominently on the pharmacy's public website.
5. Record Retention: All written acknowledgments, documented good faith efforts, and copies of historical NPP revisions must be retained for six (6) years from the date created under 45 CFR § 164.530(j).

3. Permitted vs. Mandatory Disclosures & The TPO Framework

HIPAA categorizes disclosures into three distinct regulatory tiers: Permitted without authorization, Mandatory, and Prohibited without authorization.

Permitted Disclosures: Treatment, Payment & Operations (TPO)

Under 45 CFR § 164.506, a covered entity may use or disclose PHI without patient consent or authorization for:

• Treatment: The provision, coordination, or management of healthcare services. Examples include: a pharmacist consulting with a prescriber about dosage adjustments, discussing drug interactions with another treating specialist, sharing records with a hospital upon transfer, or calling a patient regarding refills.
• Payment: Activities undertaken to obtain reimbursement for healthcare services. Examples include: submitting electronic claims to PBMs or commercial insurance plans, adjudicating billing disputes, verifying insurance eligibility, and transmitting accounts to collection agencies.
• Health Care Operations (HCO): Administrative, financial, legal, and quality improvement activities necessary to run a covered entity. Examples include: conducting internal quality assurance and medication error audits, training pharmacy students/interns, undergoing Board of Pharmacy or accreditation inspections, and legal defense consultations.

Mandatory Disclosures (Must Disclose)

A covered pharmacy is legally required to disclose PHI in only two specific circumstances:

1. To the Individual Patient: When an individual (or their personal representative) requests access to inspect or obtain a copy of their own PHI.
2. To the Secretary of HHS / OCR: When requested during a compliance review, complaint investigation, or enforcement action.

Disclosures Requiring Explicit Written Authorization

Specific uses of PHI require a signed, formal HIPAA Authorization containing an expiration date and explicit purpose. Crucially, authorizations are required for:

• Marketing Communications: Using PHI to encourage the purchase or use of a third-party commercial product or service (except face-to-face communications or refill reminders where remuneration received is reasonably related to the pharmacy's cost).
• Sale of PHI: Any disclosure where the covered entity receives direct or indirect financial remuneration in exchange for PHI.
• Employment Determinations & Pre-employment Screenings.

4. The Minimum Necessary Standard & Key Statutory Exemptions

Under 45 CFR § 164.502(b), covered entities and business associates must make reasonable efforts to use, disclose, or request only the minimum amount of Protected Health Information necessary to accomplish the intended clinical or administrative purpose.

┌─────────────────────────────────────────────────────────────────────────────┐
│               MINIMUM NECESSARY: THE FIVE STATUTORY EXEMPTIONS              │
├─────────────────────────────────────────────────────────────────────────────┤
│ The Minimum Necessary rule applies to Payment, Healthcare Operations, and   │
│ third-party non-treatment disclosures. However, it STRICTLY DOES NOT APPLY  │
│ to the following five situations:                                           │
│                                                                             │
│ 1. Treatment Disclosures: Disclosures to or requests by healthcare         │
│    providers for treatment purposes (e.g., sending full clinical profile).  │
│                                                                             │
│ 2. Patient Requests: Disclosures made directly to the individual patient    │
│    requesting their own medical records.                                    │
│                                                                             │
│ 3. Explicit Authorizations: Disclosures made pursuant to a signed patient   │
│    HIPAA authorization.                                                     │
│                                                                             │
│ 4. Required by Law: Disclosures mandated by statute (e.g., KASPER reporting,│
│    mandatory child/elder abuse reports, DEA compliance audits).             │
│                                                                             │
│ 5. HHS Compliance Investigations: Disclosures to HHS/OCR investigators.     │
└─────────────────────────────────────────────────────────────────────────────┘

Incidental Disclosures & Reasonable Safeguards

• HIPAA recognizes that accidental overhearing or viewing of PHI may occur in busy healthcare environments.
• An incidental disclosure (e.g., a customer in line overhearing a pharmacist speak quietly at the counseling window) is not a HIPAA violation, provided the pharmacy implemented reasonable physical, technical, and administrative safeguards (e.g., speaking in lowered voices, maintaining privacy lines away from the counter, positioning computer screens away from customer view, and locking physical records).

5. Individual Patient Rights under HIPAA

HIPAA grants patients several enforceable legal rights regarding their health information:

1. Right to Inspect and Copy PHI (45 CFR § 164.524): Patients have the right to inspect and obtain a paper or electronic copy of their PHI. The pharmacy must respond within thirty (30) calendar days. A single 30-day extension is permitted if the pharmacy provides a written explanation to the patient. The pharmacy may charge a reasonable, cost-based fee covering labor, supplies, and postage.
2. Right to Request Amendments (45 CFR § 164.526): Patients may request corrections to inaccurate records. The pharmacy must act within sixty (60) days. The pharmacy may deny the request if the record is accurate, complete, or not created by the pharmacy.
3. Right to an Accounting of Disclosures (45 CFR § 164.528): Patients may request a log of non-routine disclosures made during the six (6) years prior to the request. Disclosures for TPO (Treatment, Payment, Operations), disclosures to the patient, and disclosures pursuant to written authorizations are exempt from the accounting log.
4. Right to Request Restrictions & Confidential Communications (45 CFR § 164.522): Patients may request confidential communications (e.g., call cell phone only). While pharmacies generally need not agree to disclosure restrictions, a pharmacy MUST agree to restrict disclosure to a health plan if the disclosure is for payment or operations, and the patient has paid out-of-pocket in full (cash) for the healthcare item or service.

6. HIPAA Breach Notification Rule & Penalty Framework

A breach is defined under 45 CFR § 164.402 as the unauthorized acquisition, access, use, or disclosure of unencrypted PHI that compromises the security or privacy of the data. An impermissible disclosure is legally presumed to be a breach unless the covered entity demonstrates through a formal 4-factor risk assessment that there is a low probability the data was compromised:

1. The nature and extent of the PHI involved (types of identifiers, clinical sensitivity);
2. The unauthorized person who used the PHI or to whom the disclosure was made;
3. Whether the PHI was actually acquired or viewed; and
4. The extent to which the risk has been mitigated.

Comprehensive Breach Notification Timelines & Civil / Criminal Penalty Tiers