Privacy, Security, and Regulatory Compliance
Core concepts
Know HIPAA Privacy and Security Rules: covered entities, business associates, minimum necessary, permitted disclosures, and the Security Rule's administrative, physical, and technical safeguards. Understand the HITECH Act's breach notification and its extension of obligations to business associates. Learn the difference between privacy (who may access) and security (how access is protected). Understand authentication factors, role-based and attribute-based access control, audit logs, encryption at rest and in transit, and risk analysis as the foundation of the Security Rule. Know the concept of de-identification (Safe Harbor vs. expert determination) and the limits of each.
Traps
Questions often confuse privacy with security, or treat encryption as sufficient without risk analysis. Another trap: assuming de-identified data is always risk-free - re-identification is possible. Also watch for confusion between breach notification timelines and internal incident response.
Rule of thumb
No risk analysis, no compliance. The Security Rule requires a documented, periodic risk analysis and a risk management plan.
Worked example
A laptop with unencrypted PHI is stolen. Under the breach notification rule, unencrypted PHI triggers a presumption of breach unless a risk assessment demonstrates low probability of compromise. Encryption would have created a safe harbor.