8.3 Patient Privacy (HIPAA) & Massachusetts Privacy Rules

Patient Privacy (HIPAA) & Massachusetts Privacy Rules

Pharmacy practice involves handling extensive sensitive medical and personal data. Pharmacists must navigate both federal law—the Health Insurance Portability and Accountability Act (HIPAA)—and stringent Massachusetts state privacy statutes, notably MGL Chapter 93H and 201 CMR 17.00.

Federal HIPAA Privacy & Security Rules (45 CFR Parts 160 & 164)

Enacted in 1996, federal HIPAA regulations establish national standards to protect individuals' medical records and personal health information.

Covered Entities and Business Associates

• Covered Entities: Community retail pharmacies, hospital pharmacies, mail-order pharmacies, healthcare providers, and health plans are designated covered entities under HIPAA.
• Business Associates (BAs): Third-party entities that create, receive, maintain, or transmit PHI on behalf of a covered entity (e.g., pharmacy software vendors, claims processing clearinghouses, PBMs, paper shredding services, collection agencies). Covered entities must execute a formal Business Associate Agreement (BAA) binding the BA to strict HIPAA security and confidentiality standards before disclosing PHI.

Protected Health Information (PHI) Definition

PHI encompasses any individually identifiable health information created, received, or maintained by a covered entity or business associate in any form (electronic, paper, or oral). It includes information relating to:

• The past, present, or future physical or mental health condition of an individual.
• The provision of healthcare to an individual (e.g., prescription history, clinical notes).
• The past, present, or future payment for the provision of healthcare.
• Any common identifiers combined with health data (e.g., name, address, DOB, Social Security number, medical record number, phone number).

Notice of Privacy Practices (NPP) & Permitted Disclosures (TPO)

Notice of Privacy Practices (NPP)

Pharmacies must draft and distribute an NPP outlining how PHI is used, disclosed, and protected, as well as patient rights under HIPAA.

• Distribution Mandate: Pharmacies must provide the NPP to every patient no later than the date of first service delivery (e.g., when a patient fills their first prescription).
• Acknowledgment Requirement: The pharmacy must make a good-faith effort to obtain a signed written acknowledgment from the patient confirming receipt of the NPP. If the patient refuses to sign, the pharmacist must document the good-faith effort and the reason acknowledgment was not obtained.
• Posting Requirements: The NPP must be prominently posted inside the pharmacy retail area and made available on the pharmacy's public website.

Permitted Disclosures: Treatment, Payment, and Health Care Operations (TPO)

HIPAA permits covered entities to use and disclose PHI without patient written authorization for three core purposes, known as TPO:

1. Treatment: Dispensing medications, consulting with prescribers regarding drug interactions, performing medication therapy management (MTM), or transferring prescriptions between pharmacies.
2. Payment: Submitting electronic claims to insurance plans/PBMs, verifying patient coverage, billing secondary plans, or collecting copayments.
3. Health Care Operations: Conducting quality assurance audits, internal compliance reviews, pharmacist performance evaluations, or pharmacy accreditation audits.

Disclosures Requiring Explicit Written Authorization

Any use or disclosure outside TPO generally requires signed patient authorization. Key examples include:

• Marketing Communications: Refill reminders or disease management communications where the pharmacy receives financial remuneration from a third party (e.g., a drug manufacturer) above reasonable cost reimbursement require prior written authorization.
• Sale of PHI: Disclosing PHI in exchange for direct or indirect remuneration.

Minimum Necessary Standard & Safeguards

Under 45 CFR § 164.502(b), when using or disclosing PHI or requesting PHI from another covered entity, a pharmacy must make reasonable efforts to limit PHI to the minimum necessary to accomplish the intended purpose.

Exceptions to Minimum Necessary

The minimum necessary standard does NOT apply to:

• Disclosures to or requests by a healthcare provider for treatment purposes (e.g., a pharmacist calling a doctor about a prescription order needs full clinical context).
• Disclosures made directly to the patient regarding their own record.
• Disclosures made pursuant to a signed patient authorization.
• Disclosures required by law (e.g., responding to a court order, FDA safety audit, or Board inspection).

Physical, Technical, and Administrative Safeguards

Pharmacies must implement safeguards to prevent incidental disclosures:

• Physical: Opaque prescription pickup bags, speaking softly when discussing medications at the counter, physical barriers around the pharmacy counter, locked document shredding bins.
• Technical: Unique user IDs and passwords, automated log-off after inactivity, end-to-end data encryption for electronic prescriptions and MassPAT transmissions.
• Administrative: Employee HIPAA training upon hire and annually, designated Privacy Officer, written policies and procedures.

Breach Notification Rules (Federal HITECH & MGL c. 93H)

When an unauthorized acquisition, access, use, or disclosure of unencrypted PHI occurs, it is presumed to be a breach unless a low probability of compromise is demonstrated through a 4-factor risk assessment.

Federal HIPAA/HITECH Breach Notification Timelines

• Affected Individuals: Written notification must be sent via first-class mail (or email if consented) without unreasonable delay and no later than 60 calendar days after discovery of the breach.
• U.S. Department of Health & Human Services (HHS) Office for Civil Rights (OCR):
  • Small Breaches (< 500 individuals): Must log and report to HHS electronically within 60 calendar days after the end of the calendar year in which the breach was discovered.
  • Large Breaches (≥ 500 individuals): Must notify HHS OCR and prominent media outlets in the state/jurisdiction no later than 60 calendar days after discovery.

Massachusetts Data Privacy Statute (MGL c. 93H & 201 CMR 17.00)

Massachusetts maintains strict state-level data privacy laws that apply alongside federal HIPAA rules. Under MGL c. 93H, a breach of Personal Information (PI)—defined as a resident's first name/initial and last name in combination with a Social Security number, driver's license number, or financial account/credit card number—requires mandatory notifications:

• State Agency Notifications: The pharmacy must notify the Massachusetts Attorney General (AG) and the Director of the Office of Consumer Affairs and Business Regulation (OCABR) without unreasonable delay.
• WISP Requirement (201 CMR 17.00): All businesses in Massachusetts that handle personal data must establish, implement, and maintain a comprehensive Written Information Security Program (WISP) detailing technical and administrative data protections.