Introduced in 1996, the Health Insurance Portability and Accountability Act (HIPAA) aimed to modernize and protect healthcare information flow. Ever since, healthcare providers of all sizes had to adapt their practices to comply with it, making sure that they followed this federal legislation or risk getting costly fines. In fact, HIPAA compliance became an essential task for everyone in the healthcare sector, especially with the increasing digitalization of the industry.
That’s because HIPAA compliance requires healthcare providers to follow a multifaceted and rather complex process to protect and secure the patients’ healthcare data (aka Protected Health Information or PHI). Given that HIPAA has five different titles that extensively cover all activities related to the management, protection, and privacy of medical records, complying with the act can sometimes be daunting.
The best way to tackle it is first to address the thornier and more critical rules and then follow from there. In that sense, two main rules form the foundation of HIPAA regulations – the Privacy Rule and the Security Rule. Of those 2, the Privacy Rule has always been the most controversial, as it governs how and when healthcare professionals or anyone accessing PHI can or can’t use that data.
Are you a healthcare professional struggling with HIPAA compliance and the Privacy Rule? Then you’ve come to the right place, as here you’ll find some of the essential considerations to comply with that rule as well as a healthcare privacy compliance checklist that can help you with the process. You must know that this checklist is necessarily incomplete because it approaches the privacy issue more broadly, without getting to the specifics of your organization.
That means that you need to customize this checklist to fit your practice to achieve accurate HIPAA compliance in terms of privacy. With that being said, let’s begin with our review of the Privacy Rule.
Some Initial Considerations About the Privacy Rule
Before getting to the healthcare privacy compliance checklist, it’s essential to know some details about the privacy rule to better understand its importance and reach. First, it{s important to understand what information this privacy rule applies to, mainly because “health information” feels like a broad term that could encompass a lot of things.
Following what’s stated in the HIPAA, the PHI is “identifiable health information” that can be further defined as individual health conditions, treatments provided for them, and payment information that can be used to identify any of the individuals contained in those records.
That means that all the data related to a patient’s visit to the doctor is covered by the Privacy Rule, including (but not limited to):
- Full names
- Dates related to patient’s illnesses and treatments
- Contact information (addresses, telephone numbers, email addresses, etc.)
- Social security numbers
- Medical records numbers
- Biometric information (fingerprints, for example)
- Credit card numbers
- Any other information that can lead to the identification of the patient
It’s worth noting that, while most of the healthcare information today is stored in electronic or digital means, the Privacy Rule governs all the instances where patient data is included. This means that, beyond digital medical records, the Rule also applies to paper documents and even oral communications (telephone calls, talks between practitioners, etc.)
The other major thing you should keep in mind about the Privacy Rule is which professionals and institutions should comply with it. This includes all people and institutions that use, store, and process PHI. It naturally extends the Privacy Rule’s reach to people and institutions that are doctors or practitioners, but who run into PHI in any part of the chain. Thus, the Privacy Rule applies (but it’s not limited) to:
- Healthcare providers (doctors, clinics, dentists, psychologists)
- Pharmacies
- Nursing homes
- Health insurance companies
- Health maintenance organizations
- Company health plans
- Government-funded health plans
Another essential aspect of the Privacy Rule is the concept of minimum necessary use and disclosure that applies to all entities covered by the rule. In layman’s terms, you have to make everything within your reach to use, disclose, and request only the minimum amount of information for any specific purpose. This prevents unnecessary information from going about or from allowing access to unnecessary people.
Finally, you must keep in mind that any individual in your medical records can demand their PHI and review how you use it and with whom you disclose it. Additionally, individuals have the right to obtain a copy of their PHI and ask for corrections. In that sense, you are obligated to notify those rights to individuals, along with a copy of all of your privacy practices, which must be accessible to anyone interested in them.
This explanation should provide you a clearer picture of whether you need to comply with the Privacy Rule in particular and the HIPAA in general. If you’re having doubts about whether you should comply with it or not, be sure to contact the U.S. Department of Health & Human Services to know for sure. You don’t want to feel exempted only to find out that you should be complying with the Act when you’re paying a costly fine.
The Healthcare Privacy Compliance Checklist
Now, let’s see some actionable steps you can take to ensure you comply with the Privacy Rule of HIPAA. Since the act is very extensive (and, let’s face it, can be somewhat confusing in certain parts), we’ve come up with this (again, somewhat incomplete) checklist that you can tick off as you go.
I’m repeating myself here, but it’s worth remembering that covering all of these items doesn’t necessarily mean you’re fully compliant with HIPAA. First, that’s because HIPAA covers other aspects that I’m not reviewing here. And second, because each strategy to become HIPAA compliant is specific to each healthcare institution or actor. There might be some unique aspects of your practice that might lead you to take further steps. Thus, you should see the following checklist as a guide for building the basics of that compliance.
- Appoint a person within your institution that will be responsible for the development and implementation of privacy policies. Since the Privacy Rule is of paramount importance, make sure that the person you designate has enough knowledge, time, and resources to properly take care of it.
- Understand the full reach of the Privacy Rule in your practice. Everyone in a healthcare organization is subject to it, but you need to have a clear understanding of how its reach extends to your associates. Be sure that these associates understand the Privacy Rule and make sure they have a formal associate contract with you that extends the compliance obligations to them.
- Create and maintain a record of how you use and disclose PHI in your daily practices.
- Make sure your privacy policies align with patients’ rights. Provide notifications about your privacy practices, give access to your full policy, and understand the reach and limitations of PHI use, especially in regards to those that can be done without written consent. For that, keep the concept of “minimum necessary” in mind.
- Adjust your workflow to better adhere to the minimum necessary principle. Only people allowed to access PHI should have permission to interact with it. Also, all uses should be safeguarded to prevent intentional or unintentional use or disclosure of sensitive patient data.
- Create ongoing training programs to ensure all your collaborators are up to date with your privacy policies and procedures. It’s key that the training is a recurrent effort, as practices related to privacy might change over time, and everyone should be aware of those modifications.
- Create comprehensive documentation surrounding all your privacy policies and practices that cover all of the above. This document should clarify how you use PHI, with whom you’re disclosing it, the patients’ rights, the person in charge for keeping the document updated, and any other information needed to keep the privacy procedures sharp.
Moving Forward
The best course of action from here is for you to go over this checklist to define the foundations of your healthcare privacy efforts. After that, you should move forward with a more detailed implementation informed by the Privacy Rule. In that sense, you should review the 45 CFR Part 160 and Subparts A and E of 45 CFR Part 164 and complement it with the HHS Privacy Rule summary to fully understand the privacy considerations in the healthcare industry.
Additionally, you should pay special attention to extending your privacy efforts to all of your associates. This implies revisiting your privacy policies when starting a new partnership, even in cases when you imagine it might not affect it (the chances are that the compliance will impact most of your partnerships, even when it isn’t immediately apparent).
Remember that violations of HIPAA can lead to civil fines of up to $50,000 per violation per day. What’s more, they can also mean criminal penalties for the people responsible. As you can see, HIPAA compliance is extremely important for all healthcare actors, and the Privacy Rule is one of its most crucial parts. Don’t skimp your efforts in enforcing and developing it.
