Privacy, Security, and Regulatory Compliance
Regulatory framework
In the United States, HIPAA has Privacy, Security, and Breach Notification Rules. Covered entities and business associates may use or disclose protected health information (PHI) for treatment, payment, and operations; other uses need authorization or an exception. The Security Rule requires administrative, physical, and technical safeguards, including risk analysis, access control, audit logs, encryption, and contingency planning. HITECH strengthened breach notification and enforcement; information blocking rules affect health information exchange. Know 42 CFR Part 2 for substance use disorder records and GDPR for EU personal data.
De-identification and operations
HIPAA offers Safe Harbor, which removes 18 identifiers, and expert determination. De-identification reduces risk but is not a guarantee against re-identification. Minimum necessary applies to many uses and disclosures but not to treatment disclosures. Research may require IRB review and authorization or waiver. Quality improvement versus research is a common boundary question.
Traps
Questions often test whether a vendor is a business associate, whether an email contains PHI, and whether encryption is required or addressable. Addressable does not mean optional; it means assess and implement or document why not. Another trap is assuming de-identified data are always outside privacy law.
Worked example / rule of thumb
A quality team wants to email a spreadsheet with names, medical record numbers, and lab results. That is PHI; use an encrypted, access-controlled channel and the minimum necessary data. Rule of thumb: start with a risk analysis, then apply least privilege, audit, and encryption; document decisions.