8.5 Patient Confidentiality, HIPAA Privacy & Health-Record Protection

8.5 Patient Confidentiality, HIPAA Privacy & Health-Record Protection

Why this is tested: NABP Competency Statement 2.5 ("Regulations and agencies regarding pharmacy practice") lists "protecting patient and health record confidentiality" as an explicit sub-topic inside the 33% Pharmacist Practice area. Confidentiality questions on the Oklahoma MPJE are rarely pure HIPAA trivia — they usually ask which of three overlapping regimes governs a specific disclosure.

---

1. The Three Overlapping Regimes

+---------------------------------------------------------------------------+
|  1. HIPAA (federal)          Protected Health Information (PHI) held by    |
|     45 CFR Parts 160/164     a covered entity; floor, not a ceiling        |
+---------------------------------------------------------------------------+
|  2. OK PMP confidentiality   Central repository CDS dispensing data;       |
|     63 O.S. 2-309D           statutorily confidential; criminal penalties  |
+---------------------------------------------------------------------------+
|  3. Oklahoma Board rules     Patient records (OAC 535:15-3-14), pharmacy   |
|     OAC Title 535            security, and prescription ownership (354)    |
+---------------------------------------------------------------------------+

HIPAA sets a federal floor. Where Oklahoma law is more protective — as it is for PMP data — the stricter standard governs, exactly as the Stricter Standard Rule from section 1.2 predicts.

---

2. HIPAA: What a Pharmacy Actually Must Do

A community pharmacy is a covered entity because it transmits health information electronically in connection with a HIPAA standard transaction (electronic claims adjudication). That triggers a discrete set of obligations:

Disclosures permitted without patient authorization

• Treatment, Payment, and Health care Operations (TPO). Faxing a profile to the prescriber, adjudicating a claim, and internal quality review all proceed without authorization.
• To the individual who is the subject of the PHI.
• Public health activities, including reporting adverse events to VAERS and vaccine doses to the Oklahoma State Immunization Information System (OSIIS).
• Required by law — including a subpoena that satisfies the Privacy Rule's conditions, a Board of Pharmacy inspection, and PMP reporting.
• Health oversight activities by the OSBP, OBNDD, and DEA.

Disclosures that require authorization

• Marketing communications and any sale of PHI.
• Psychotherapy notes (rarely relevant in a pharmacy, but tested).
• Most disclosures to an employer, a life insurer, or a family member acting outside the patient's expressed or inferred agreement.

The minimum-necessary trap

The minimum necessary standard requires a covered entity to limit PHI to the least amount needed to accomplish the purpose — but it has express carve-outs. Minimum necessary does NOT apply to:

1. Disclosures to or requests by a health care provider for treatment purposes;
2. Disclosures to the individual;
3. Uses or disclosures made pursuant to a valid authorization;
4. Disclosures to HHS for compliance investigations;
5. Uses or disclosures required by law.

A pharmacist who sends a full medication profile to a treating physician has not violated minimum necessary, because treatment disclosures are exempt.

Breach notification

Under the Breach Notification Rule, an impermissible use or disclosure is presumed to be a breach unless the covered entity demonstrates a low probability that PHI was compromised through a four-factor risk assessment (nature and extent of the PHI, the unauthorized person, whether PHI was actually acquired or viewed, and the extent of mitigation). Notification obligations:

Classic pharmacy scenario. A technician hands a completed prescription bag to the wrong patient at the register, who opens it and reads the label before returning it. That is an impermissible disclosure. The pharmacy must run the four-factor assessment — the PHI was actually viewed, so the presumption of breach is difficult to rebut, and individual notification is likely required.

---

3. Oklahoma PMP Data: Stricter Than HIPAA

63 O.S. § 2-309D governs the central repository and it is materially more restrictive than the HIPAA baseline:

• Repository information is confidential and is not subject to open-records disclosure.
• Access is limited to enumerated categories of authorized users — the practitioner or dispenser treating the patient, designated staff acting for them, licensing boards, and law enforcement pursuant to an active investigation.
• Unauthorized access, disclosure, or misuse is a criminal offense and independent grounds for Board discipline.
• A registrant who checks the repository must note the check in the patient file.
• OBNDD may make an unsolicited notification to a pharmacist's or practitioner's licensing board when a patient has received controlled substances in quantities or with a frequency inconsistent with generally recognized standards of safe practice. That notification is itself confidential and may not disclose information protected by the section.

The practical rule for a pharmacist: you may query the PMP for a patient you are dispensing to. You may not query it out of curiosity, for a family member, for an employee, or for a co-worker. "I looked up my neighbour" is the fact pattern that ends careers.

---

4. Oklahoma Board Rules Touching Confidentiality

• Prescription ownership (59 O.S. § 354): "A prescription is the property of the patient for whom it is prescribed." No pharmacist may refuse, on the patient's request in person or through an authorized pharmacist, to transfer the prescription or to supply a reference copy in writing or by telephone. No prescriber may refuse a patient's request to have a prescription transmitted to the pharmacy of the patient's choice. A pharmacy cannot use "we don't release records" to hold a patient hostage.
• Patient records (OAC 535:15-3-14): the pharmacy must obtain, record, and maintain the patient profile that makes prospective DUR possible — and must keep it secure and readily retrievable for Board review.
• Personnel identification (OAC 535:15-3-2(e)): technicians, auxiliary personnel, and interns must wear tags reading "Rx Tech," "Tech," "Clerk," or "Intern," and must identify themselves as such on any phone call. This is a confidentiality-adjacent rule: a caller must be able to tell whether the person receiving clinical information is a pharmacist.
• Impaired-pharmacist program confidentiality: participation records in the peer-assistance program are handled confidentially, which is what makes voluntary self-referral viable (see section 2.3).

---

5. Exam Decision Path

When a question asks whether a disclosure is permitted:

1. Is it PMP data? If yes, apply 63 O.S. § 2-309D — authorized users only, for a patient of record. Stop.
2. Is the recipient the patient, or a provider for treatment? If yes, permitted, and minimum necessary does not apply.
3. Is it payment or health care operations? Permitted, but minimum necessary does apply.
4. Is it required by law, public health, or health oversight (OSBP/OBNDD/DEA)? Permitted.
5. Anything else — marketing, sale, employer, curiosity — requires a valid written authorization.
6. If the disclosure already happened impermissibly, run the four-factor breach assessment and apply the 60-day notification clock.