3.5 HIPAA, Patient Privacy & Confidentiality of Pharmacy Records

HIPAA, Patient Privacy & Confidentiality of Pharmacy Records

Patient confidentiality is both an ethical cornerstone and a strict legal mandate in pharmacy practice. The regulatory framework governing patient privacy comprises the federal Health Insurance Portability and Accountability Act of 1996 (HIPAA) (45 CFR Parts 160 and 164), the Health Information Technology for Economic and Clinical Health (HITECH) Act, and the Mississippi Pharmacy Practice Act (Miss. Code Ann. § 73-21-71 et seq.) along with Mississippi Board of Pharmacy regulations (Miss. Admin. Code Title 30, Part 3001).

Under these authorities, pharmacists safeguard prescription records, patient profiles, and therapeutic information while applying the specific pathways under which disclosure is permitted or required. Confidentiality is the default, not an absolute bar to every disclosure.

---

1. Protected Health Information (PHI) & Covered Entity Status

A pharmacy is a HIPAA Covered Entity when it is a health care provider that transmits health information electronically in connection with a transaction for which HHS has adopted a standard. Individual pharmacists act through the covered entity; the job title alone is not the coverage test. Any third-party vendor that creates, receives, maintains, or transmits PHI on behalf of a pharmacy (e.g., cloud dispensing software vendors, claims clearinghouses, shredding services, pharmacy management platforms) is a Business Associate and must execute a formal, legally binding Business Associate Agreement (BAA) promising HIPAA-equivalent privacy safeguards.

Scope of Protected Health Information (PHI)

PHI is defined as any individually identifiable health information created or received by a covered entity that relates to:

• The past, present, or future physical or mental health or condition of an individual;
• The provision of healthcare to an individual; or
• The past, present, or future payment for healthcare provided to an individual.

PHI is not limited to a checklist of 18 items. The familiar 18 identifier categories belong to HIPAA's safe-harbor de-identification method: removing those categories, together with the required lack of actual knowledge, can make information de-identified. Identifiable health information can be PHI even when a candidate cannot neatly assign it to one memorized category.

---

2. The TPO Framework: Permitted Disclosures Without Patient Authorization

Under the HIPAA Privacy Rule, a covered pharmacy may use and disclose PHI without obtaining a separate signed patient authorization for Treatment, Payment, and Health Care Operations (TPO) and for other pathways the rule specifically permits or requires, including appropriate public-health, health-oversight, required-by-law, law-enforcement, and serious-threat disclosures when their conditions are met.

+-----------------------------------------------------------------------------+
|                        THE HIPAA TPO DISCLOSURE FRAMEWORK                   |
|                                                                             |
|   [T - TREATMENT]                                                           |
|   - Dispensing medications, consulting with prescribers                     |
|   - Performing prospective DUR, reviewing drug interactions                 |
|   - Hospital discharge medication reconciliation, consulting specialists    |
|                                                                             |
|   [P - PAYMENT]                                                             |
|   - Submitting electronic claims to PBMs and insurance plans                |
|   - Processing prior authorizations, verifying patient insurance eligibility|
|   - Billing patients or third-party collection agencies for co-pays         |
|                                                                             |
|   [O - OPERATIONS]                                                          |
|   - Internal quality assurance audits, medication error reviews             |
|   - Training pharmacy interns, residents, and technician students           |
|   - Regulatory compliance audits, accreditation surveys, business management|
+-----------------------------------------------------------------------------+

When an Authorization Is Required

A non-TPO use is not automatically prohibited. First ask whether another Privacy Rule permission or requirement applies. If none does, a valid written HIPAA authorization is generally required. Examples that ordinarily require authorization unless a specific exception applies include:

• Disclosing records to a patient's employer, life insurance company, or legal counsel;
• Marketing communications sponsored by pharmaceutical manufacturers;
• Selling pharmacy patient lists or prescription data to third-party marketing firms;
• Research activities that do not meet formal Institutional Review Board (IRB) de-identification or waiver criteria.

---

3. The "Minimum Necessary" Standard & Key Exceptions

The Minimum Necessary Standard under 45 CFR § 164.502(b) mandates that when using, disclosing, or requesting PHI, a covered entity must make reasonable efforts to limit the information to the minimum amount necessary to accomplish the intended purpose.

+-----------------------------------------------------------------------------+
|                   THE MINIMUM NECESSARY RULE APPLICABILITY                  |
|                                                                             |
|   [MINIMUM NECESSARY APPLIES TO:]       [MINIMUM NECESSARY DOES NOT APPLY:] |
|   - Insurance payment claims            - Treatment disclosures between     |
|   - Billing / collection queries          healthcare providers (MD - RPh)   |
|   - Quality assurance operational reviews- Disclosures directly to the      |
|   - Non-routine legal disclosures         patient upon request              |
|   - Business associate service tasks    - Disclosures authorized by patient |
|                                         - Disclosures mandated by law / DEA |
+-----------------------------------------------------------------------------+

[!IMPORTANT] Critical Exam Rule — Provider-to-Provider Treatment Exemption: When a pharmacist communicates with a physician, nurse practitioner, hospital discharge coordinator, or another pharmacist for the purpose of treating a patient, the minimum necessary rule does NOT apply. Providers are legally permitted to share comprehensive medical records to ensure optimal clinical decision-making.

---

4. Notice of Privacy Practices (NPP)

A covered pharmacy that has a direct treatment relationship must provide a Notice of Privacy Practices (NPP) explaining how it uses PHI, the individual's privacy rights, and the covered entity's legal duties.

Key NPP compliance mandates:

1. First Service Encounter: The pharmacy must provide the NPP to the patient on the date of first service delivery (e.g., when the first prescription is dispensed).
2. Good-Faith Effort for Written Acknowledgment: The pharmacy must make a good-faith effort to obtain a signed, written acknowledgment of receipt from the patient. If the patient refuses or cannot sign (e.g., emergency delivery), the pharmacist must document the good-faith effort and the reason why acknowledgment was not obtained.
3. Prominent Posting: The NPP must be posted in a clear, prominent location at the service site. If the covered provider maintains a website describing its services or benefits, the notice must also be available there.
4. Retention Schedule: Copies of the NPP, revisions, and signed patient acknowledgments must be retained for at least six (6) years from the date created or last in effect.

---

5. Lawful Disclosures Without Patient Consent: Regulatory & Legal Exceptions

Under federal HIPAA regulations and Mississippi Board rules, pharmacies are permitted—and in some cases legally compelled—to disclose confidential prescription records without patient authorization under specific circumstances:

---

6. Patient Privacy Rights & Physical Safeguards

Under HIPAA, patients possess robust legal rights regarding their health information:

• Right to Inspect and Copy: Patients have the right to inspect and obtain a paper or electronic copy of their PHI. The pharmacy must fulfill the request within 30 calendar days (with one allowable 30-day extension if written explanation is provided).
• Right to Amend Records: Patients may request amendments to inaccurate or incomplete records; the pharmacy must respond within 60 days.
• Right to an Accounting of Disclosures: Patients may request an accounting of the categories of disclosures covered by 45 CFR § 164.528 during the preceding 6 years; the accounting rule has exclusions and is not shorthand for every non-TPO disclosure.
• Physical and Technical Safeguards: Pharmacies must implement reasonable safeguards to avoid impermissible disclosures: maintaining private consultation areas, turning computer monitors away from waiting counters, keeping voices lowered during counseling, and using reasonable disposal safeguards for discarded prescription labels, leaflets, and vial caps, such as secure shredding or a qualified disposal service appropriate to the risk.