HIPAA & Privacy Act

The Health Insurance Portability and Accountability Act (HIPAA) of 1996 and the Privacy Act of 1974.

Individually identifiable health information that relates to the past, present, or future physical or mental health condition of an individual; the provision of health care to an individual; or the past, present, or future payment for the provision of health care to an individual.

PHI that is transmitted by or maintained in electronic media. This does NOT include PHI transmitted orally or in paper form — only electronic.

National standards for the protection of individually identifiable health information, including standards for individuals' rights to understand and control how their health information is used.

Appropriate administrative, physical, and technical safeguards to ensure the confidentiality, integrity, and availability of electronic protected health information (ePHI).

Administrative safeguards, physical safeguards, and technical safeguards.

Covered entities must make reasonable efforts to use, disclose, and request only the minimum amount of PHI needed to accomplish the intended purpose of the use, disclosure, or request.

No. The minimum necessary standard does NOT apply to disclosures to or requests by a health care provider for treatment purposes.

A federal law that balances the government's need to maintain information about individuals with the rights of individuals to be protected against unwarranted invasions of their privacy. It regulates how federal agencies solicit, collect, maintain, use, and disseminate personally identifiable information (PII).

Personally Identifiable Information — information that can be used to distinguish or trace an individual's identity, such as name, SSN, date and place of birth, mother's maiden name, biometric records, or any information linkable to an individual.

A formal notice published in the Federal Register that describes a system of records — a group of records under the control of a federal agency from which information is retrieved by an individual's name or other personal identifier.

An analysis of how information is handled to ensure handling conforms to applicable legal, regulatory, and policy requirements regarding privacy; to determine the risks and effects of collecting, maintaining, and disseminating PII; and to evaluate protections and alternative processes.

Before PHI directly relevant to a person's involvement with the individual's care or payment of health care is shared with that person, and before their information is included in a facility directory.

Health plans, health care clearinghouses, and health care providers who transmit health information in electronic form in connection with a covered transaction.

Yes. The MHS, including military treatment facilities (MTFs), TRICARE, and the Defense Health Agency (DHA), functions as a covered entity under HIPAA.

A person or organization, other than a member of a covered entity's workforce, that performs certain functions or activities on behalf of, or provides certain services to, a covered entity that involve the use or disclosure of PHI.

A Business Associate Agreement (BAA) — a written contract or arrangement that requires the business associate to appropriately safeguard the PHI it receives or creates on behalf of the covered entity.

Treatment, payment, and health care operations (TPO); disclosures required by law; public health activities; victims of abuse, neglect, or domestic violence; health oversight activities; judicial and administrative proceedings; law enforcement purposes; and several other specific situations.

Use or disclosure of psychotherapy notes, use of PHI for marketing purposes, and sale of PHI.

It requires covered entities to notify affected individuals, the Secretary of HHS, and in certain circumstances the media, following a breach of unsecured PHI.

An impermissible use or disclosure under the Privacy Rule that compromises the security or privacy of PHI.

Without unreasonable delay and no later than 60 calendar days from the discovery of the breach.

When a breach affects more than 500 residents of a single state or jurisdiction.

DoD 6025.18-R, DoD Health Information Privacy Regulation.

Right to access their PHI, request amendments, receive an accounting of disclosures, request restrictions on uses/disclosures, request confidential communications, and receive a Notice of Privacy Practices.

A document that describes how a covered entity may use and disclose an individual's PHI, the individual's rights regarding their PHI, and the covered entity's legal duties to protect PHI.

Report it immediately to your Privacy Officer, supervisor, or the chain of command. Do not attempt to investigate the breach yourself.

Penalties range from $100 to $50,000 per violation for civil penalties. Criminal penalties include fines up to $250,000 and imprisonment up to 10 years for offenses committed with intent to sell, transfer, or use PHI for commercial advantage, personal gain, or malicious harm.

Names; geographic data smaller than state; all dates (except year) related to an individual; phone numbers; fax numbers; email addresses; SSNs; medical record numbers; health plan beneficiary numbers; account numbers; certificate/license numbers; vehicle identifiers; device identifiers; web URLs; IP addresses; biometric identifiers; full-face photographs; and any other unique identifying number, characteristic, or code.

Health information that does not identify an individual and with respect to which there is no reasonable basis to believe that the information can be used to identify an individual. De-identified data is not subject to HIPAA protections.

Expert determination (a qualified statistical expert certifies the risk of identification is very small) and Safe Harbor (removal of all 18 specified identifiers).

No. Commanders may receive limited health information necessary for fitness-for-duty determinations, safety concerns, or mission requirements, but generally cannot access the full medical record without proper authorization.

The designated individual responsible for developing and implementing the covered entity's privacy policies and procedures, handling privacy complaints, and ensuring HIPAA Privacy Rule compliance.

The designated individual responsible for developing and implementing the security policies and procedures required by the HIPAA Security Rule to protect ePHI.

All workforce members must receive training on the covered entity's HIPAA policies and procedures. Training must be provided to new members within a reasonable period after joining and when material changes are made to policies or procedures.

Annually. All DoD personnel who access, use, or disclose PHI must complete annual HIPAA and Privacy Act training.

Health Insurance Reform — it protects health insurance coverage for workers and their families when they change or lose their jobs (portability).

Administrative Simplification — it includes the Privacy Rule, Security Rule, and Breach Notification Rule, and establishes standards for electronic health care transactions.

Administrative actions, policies, and procedures to manage the selection, development, implementation, and maintenance of security measures to protect ePHI and manage the conduct of the covered entity's workforce. Examples include risk assessments, workforce training, and contingency planning.

Physical measures, policies, and procedures to protect a covered entity's electronic information systems and related buildings and equipment from natural and environmental hazards and unauthorized intrusion. Examples include facility access controls, workstation security, and device and media controls.

The technology and the policies and procedures for its use that protect ePHI and control access to it. Examples include access controls (unique user IDs, automatic logoff), audit controls, integrity controls, and transmission security (encryption).

Individuals have the right to receive a list of certain disclosures of their PHI made by the covered entity during the six years prior to the request (excluding disclosures for TPO, to the individual, pursuant to authorization, and certain other exceptions).

A group of records maintained by or for a covered entity that includes medical records, billing records, enrollment/payment/claims records, and any other records used to make decisions about individuals.

If the PHI was not created by the covered entity, is not part of the designated record set, is not available for access, or is accurate and complete.

A disclosure of a record for a purpose compatible with the purpose for which it was collected, as published in the SORN. It is the most commonly used exception allowing disclosure of Privacy Act records.

Verify the recipient's identity and need to know, ensure the email is encrypted if sent outside the organization's secure network, use the minimum necessary amount of PHI, and consider whether an alternative method of communication would be more secure.

Use refers to sharing, employing, applying, utilizing, examining, or analyzing PHI within the entity that maintains it. Disclosure refers to the release, transfer, provision of access to, or divulging of PHI outside the covered entity.

Yes, in specific circumstances including: in response to a court order or subpoena, to identify or locate a suspect/fugitive/witness, about a victim of crime (with individual's agreement in most cases), about a death that may have resulted from criminal conduct, and about criminal conduct occurring on the premises.

The Health Information Technology for Economic and Clinical Health Act (2009) expanded HIPAA enforcement, increased penalty amounts, extended breach notification requirements, and made business associates directly liable for HIPAA compliance.

Notify the sender immediately, do not further use or disclose the information, and follow your facility's procedures for reporting the incident to your Privacy Officer.

Health information created or received by a military treatment facility (MTF), TRICARE, or other MHS component that relates to an individual's health condition, provision of health care, or payment for health care, and that identifies the individual or could reasonably be used to identify the individual.

Any person who believes that a covered entity or its business associate has violated HIPAA can file a complaint with the Office for Civil Rights (OCR) at HHS.

Six years from the date of creation or the date when the document was last in effect, whichever is later.

PHI that has not been rendered unusable, unreadable, or indecipherable to unauthorized individuals through the use of a technology or methodology specified by the Secretary of HHS (such as encryption or destruction).

(1) The nature and extent of PHI involved, including types of identifiers and likelihood of re-identification; (2) The unauthorized person who used the PHI or to whom the disclosure was made; (3) Whether the PHI was actually acquired or viewed; (4) The extent to which the risk to the PHI has been mitigated.

Yes, under limited circumstances — if an Institutional Review Board (IRB) or Privacy Board grants a waiver of authorization, if the PHI is de-identified, or if it is part of a limited data set with a data use agreement.

Both laws apply simultaneously to DoD health care records. The Privacy Act covers all federal records about individuals, while HIPAA specifically covers health information. DoD must comply with both, applying whichever provides greater protection to the individual.

Administrative actions (reprimand, suspension, removal), UCMJ action for military members, civil monetary penalties, and potential criminal prosecution.