Hot answers tagged

38

As a short answer, guidance from the Department of Health and Human Services has clarified that HIPAA does not require hospitals to provide separate rooms. As a longer answer, HIPAA is very deeply misunderstood. It does not prohibit "leaking" patient information; it prohibits unreasonable and unpermitted disclosures of protected health information (PHI). ...


5

HIPPA applies only to specified entities(see https://www.cms.gov/Regulations-and-Guidance/Administrative-Simplification/HIPAA-ACA/AreYouaCoveredEntity.html); including Health Plans, Health Care Providers, Clearinghouses, and "Business Associates". Autopsy and toxicology records are the output not of a medical practice but of the coroner's office. The ...


4

HIPAA does not legally protect physicians from disclosing PHI to another party, although there are a few exceptions: HHS provides an excellent resource on these, but the regulation most relevant to your question is Permitted Uses and Disclosures (5) Public Interest and Benefit Activities, which includes "Required by Law. Covered entities may use and disclose ...


4

Aside from all else, it's a matter of practicality. For instance ADA requires government facilities to be wheelchair accessible, but many stations in the NYC subway are not because it's impossible - or to be more precise, impracticable. Your thesis that HIPAA requires separate rooms would require either require a) that hospitals instantly slash their ...


4

Is It Legally Binding? While their customer service sucks, your oral authorization of the charge is legally binding (I take payments that way almost every day in my own business, it isn't an unusual business practice in small professional businesses). You authorize oral authorization of payments over the phone in the credit card agreement that your credit ...


4

It is not legal to give false responses on such a declaration. The point of anti-discrimination laws is that they say when it is legal vs. not legal to discriminate against an employee, and Alex is expected to have faith in the legal system to protect his legal rights. Dissatisfaction with the outcome of the law may be understandable, but still does not ...


3

This is not a HIPAA violation. HIPAA requires that personal information not be revealed to people lacking a statutorily-defined interest, without the patient's consent. A password itself is not "personal information", though having it could lead to such information. An example of personal information would be the fact that you personally had a certain tooth ...


3

Gossiping about a patients medical information is a clear violation of the privacy rule, and significant enough that various HIPAA-compliance websites list this in their "10 things for medical professional not to do".


3

It's probably not unlawful to ask, but an answer cannot be required immediately. Per the Department of Labor, Susan has 60 days to elect COBRA coverage (the qualifying event here being the termination of Susan's employment): Your plan must give you at least 60 days to choose whether or not to elect COBRA coverage, beginning from the date the election notice ...


3

No. This is governed by the HIPAA Security Rule which was a regulation that the HIPAA statute required the Department of Health and Human Services to adopt. The Rule does require someone covered by HIPAA to have a "Business Associate Agreement" (BAA) and a Service Level Agreement (SLA) with any cloud storage provider (which would be the usual way that a U.S....


3

The "logbook" is required by federal law, part of the Combat Methamphetamine Epidemic Act of 2005. See 21 USC 830 (e) (1) (A): Each regulated seller shall ensure that, subject to subparagraph (F), sales by such seller of a scheduled listed chemical product at retail are made in accordance with the following [...] (ii) The seller maintains, in accordance ...


3

Sharur's answer is the correct one, but I wanted to chime in to note that even when records are covered by HIPAA, they may still be public records nonetheless, because HIPAA includes an exception (45 C.F.R. § 164.512) for uses "required by law": A covered entity may use or disclose protected health information to the extent that such use or ...


3

The regulations known as HIPAA are here. A good place to start is with who the regulations apply to. §160.10 lays that out: a health plan, health care clearinghouse, care provider, their business associates, and the Inspector General. Family members are not regulated entities. Subpart E regulates individually identifiable health information (such as "person ...


3

Under 45 CFR 164.402 a "breach" is the acquisition, access, use, or disclosure of protected health information in a manner not permitted under subpart E of this part which compromises the security or privacy of the protected health information. Disclosing PHI to random people is not permitted under subpart E. Then then allow that it can be deemed ...


2

You could offer to sell your own consent to use your records to a healthcare provider, and collect if the provider agreed. But that wouldn't make you a "broker" as I see it, only a one-tiem seller. To be a broker you would somehow have to convincew many others to let you act as their agent in selling such consent to various providers,at some sort of ...


2

HIPPA applies only to particular kinds of entities(see https://www.cms.gov/Regulations-and-Guidance/Administrative-Simplification/HIPAA-ACA/AreYouaCoveredEntity.html); such as Health Plans, Health Care Providers, Clearinghouses, and their Business Associates. If you are talking about a person storing his or her own health information and sharing it with ...


2

HHS answers FAQ 481: Does the HIPAA Privacy Rule permit doctors, nurses, and other health care providers to share patient health information for treatment purposes without the patient’s authorization? with: Yes. The Privacy Rule allows those doctors, nurses, hospitals, laboratory technicians, and other health care providers that are covered entities ...


2

HIPAA does not apply to aggregated data or data that has been stripped of personally-identifiable information. What is personally-identifiable to the government, you ask? Your name. Anything more specific about your physical location than the first three digits of your five-digit zip code. Month and day portions of dates attributed to individuals. It's ...


2

According to this HHS.gov web page: Under the HIPAA Privacy Rule, a covered entity must act on an individual’s request for access no later than 30 calendar days after receipt of the request. If the covered entity is not able to act within this timeframe, the entity may have up to an additional 30 calendar days, as long as it provides the individual – within ...


2

Yes it is PHI. What is PHI doesn't change because the name or other info is on a check instead of a chart. The goal is to stop patients from being identified without consent. Here is a list of items commonly covered as PHI. If I had to use that list to classify the check, I would consider it payment history. Those are not the only things that could be ...


2

This is not Legal Under HIPAA, a patient has a right to prompt access to all PHI, including medical records, maintained by a provider, with some very limited exceptions, none of which seem to apply based on the statements in the question. Access must be provided within 30 days at most, and the provider is encouraged to provide it as quickly as possible. If ...


1

The requirements are imposed on "the covered entity". You personally may not be required to do anything, apart from whatever your employer requires of you, but §164.404(a) says: A covered entity shall, following the discovery of a breach of unsecured protected health information, notify each individual whose unsecured protected health information has ...


1

Under 45 CFR 164.502, A covered entity or business associate may not use or disclose protected health information, except as permitted or required by this subpart or by subpart C of part 160 of this subchapter PHI is defined in 45 CFR 160.103: Protected health information means individually identifiable health information: (1) Except as ...


1

The rule prohibits public disclosure of protected health information which is individually identifiable health information that is stored, and individually identifiable health information is health information that is identifiably about a specific individual. The term health information means any information, including genetic information, whether oral ...


1

Technically, HIPPA regulates the ways in which health information is disseminated, not the ways in which it is used only by the doctor and his staff as long as it's not transmitted. Therefore it would not cover the logs if they are only accessible to the doctor and his staff. However, just as a smart way of doing things, you should use encryption, whether ...


1

I tried hard to make the doctor subject to the rules, but really couldn't. He would have to be (3) A health care provider who transmits any health information in electronic form in connection with a transaction covered by this subchapter. or, for some purposes, a "business associate". The law does not define transmiting in electronic form, but it ...


1

An independent contractor can be treated as an employee of the covered entity (note that you are not actually an employee, just treated as such for HIPAA purposes). I got this from a conversation with someone at Accountable HQ who said this is a question they get asked frequently as this is a very common scenario and source of confusion. And this is what ...


Only top voted, non community-wiki answers of a minimum length are eligible