12.4 HIPAA Privacy Rule, Patient Records & Breach Notification Protocols

12.4 HIPAA Privacy Rule, Patient Records & Breach Notification Protocols

HIPAA Framework & Protected Health Information (PHI)

The Health Insurance Portability and Accountability Act of 1996 (HIPAA), enhanced by the Health Information Technology for Economic and Clinical Health (HITECH) Act of 2009 and the 2013 HIPAA Omnibus Rule, establishes national standards to protect sensitive patient health data.

Protected Health Information (PHI) Defined

Protected Health Information (PHI) includes any individually identifiable health information created, received, maintained, or transmitted by a covered entity (e.g., pharmacy, hospital, physician practice) or business associate, in any form or medium (paper, electronic, or oral). PHI covers past, present, or future physical or mental health conditions, provision of healthcare, or payment for healthcare.

PHI encompasses 18 explicit statutory identifiers when coupled with health data, including:

• Patient full name, street address, zip code, and dates (birth, admission, discharge)
• Telephone/fax numbers, email addresses, and Social Security Numbers (SSN)
• Medical record numbers, health plan beneficiary numbers, and prescription numbers
• Biometric identifiers (fingerprints), full-face photographic images, and device serial numbers

Permissible Disclosures: Treatment, Payment & Operations (TPO)

Covered entities may use and disclose PHI without prior written patient authorization for Treatment, Payment, and Health Care Operations (TPO):

• Treatment: Providing, coordinating, or managing healthcare services among providers. Examples include transferring a prescription to another pharmacy, consulting a prescriber regarding a drug interaction, or counseling a patient.
• Payment: Obtaining reimbursement for healthcare services. Examples include submitting electronic claims to third-party pharmacy benefit managers (PBMs), verifying insurance eligibility, and conducting coverage audits.
• Health Care Operations: Administrative, financial, legal, and quality-improvement activities. Examples include internal quality assurance audits, pharmacy technician training, regulatory compliance reviews, and legal defense.

Non-TPO Disclosures & Mandatory Written Authorization

Any use or disclosure of PHI outside of TPO requires a signed, explicit written authorization from the patient. Common scenarios requiring authorization include selling patient lists for commercial marketing, releasing records to life insurance companies, or providing data to prospective employers. Patients may revoke authorization in writing at any time.

The Minimum Necessary Standard & Safeguard Protocols

Under 45 CFR § 164.502(b), the Minimum Necessary Rule mandates that covered entities make reasonable efforts to limit the use, disclosure, or request of PHI to the minimum amount necessary to accomplish the intended purpose.

Security Rule Safeguards (Administrative, Physical & Technical)

Pharmacies must implement robust safeguards under the HIPAA Security Rule to protect electronic PHI (ePHI):

• Administrative Safeguards: Conducting security risk assessments, assigning a Privacy and Security Officer, and training all workforce members annually.
• Physical Safeguards: Computer screen privacy filters, locked file cabinets, restricted access to pharmacy server rooms, and secure document shredding bins.
• Technical Safeguards: Role-based system access passcodes, automatic logoff timers, 256-bit data encryption at rest and in transit, and immutable audit log trails.

Notice of Privacy Practices (NPP) & Business Associate Agreements (BAA)

Notice of Privacy Practices (NPP)

Pharmacies must provide a written Notice of Privacy Practices (NPP) to every patient on the first day of service delivery. The NPP describes how PHI is used, patient privacy rights, and contact details for filing privacy complaints. The pharmacy must make a good-faith effort to obtain a signed, written acknowledgment of receipt from the patient. If the patient refuses to sign, the pharmacist must document the good-faith effort and the reason for refusal. Signed acknowledgments and NPP revisions must be retained for 6 years.

Business Associate Agreements (BAA)

A Business Associate (BA) is any third-party individual or entity that creates, receives, maintains, or transmits PHI on behalf of a covered entity. Common pharmacy BAs include software vendors, cloud hosts, claims clearinghouses, paper shredding companies, and legal consultants. Prior to granting access to PHI, the pharmacy must execute a legally binding Business Associate Agreement (BAA). Under the HITECH Act, Business Associates are directly liable for civil and criminal penalties under HIPAA for unauthorized PHI disclosures.

Breach Notification Protocols & State Law Preemption

A breach is defined as the unauthorized acquisition, access, use, or disclosure of unencrypted PHI that compromises the security or privacy of the information. When a potential breach occurs, the pharmacy must perform a 4-Factor Risk Assessment:

1. The nature and extent of PHI involved (types of identifiers and likelihood of re-identification).
2. The unauthorized person who used the PHI or to whom disclosure was made.
3. Whether PHI was actually viewed or acquired.
4. The extent to which the risk to PHI has been mitigated (e.g., immediate destruction of misdirected mail).

Unless the assessment proves a low probability of compromise, breach notification is legally mandated:

Reporting Timelines Summary

• Individual Written Notification: Required for ALL breaches without unreasonable delay and no later than 60 calendar days following discovery.
• Breaches Affecting < 500 Individuals: Must be logged internally and reported electronically to the HHS Secretary within 60 days of the end of the calendar year.
• Breaches Affecting ≥ 500 Individuals: Must notify affected individuals, major media outlets in the state/jurisdiction, and the HHS Secretary without unreasonable delay and no later than 60 calendar days after discovery.

State Privacy Law Preemption

HIPAA acts as a federal statutory baseline. Under federal preemption rules, if a state privacy law is more stringent (i.e., affords greater privacy protection to the patient or shorter breach notification timelines, such as 15 or 30 days), the state law supersedes federal HIPAA regulations. Specialized state laws protecting sensitive records (e.g., HIV status, mental health therapy notes, substance use disorder treatment under 42 CFR Part 2) almost universally preempt federal HIPAA baselines.