Privacy, Security, and Health Information Management (HIPAA)
What to know
HIPAA has three main rules: Privacy (uses/disclosures of PHI), Security (administrative, physical, technical safeguards for ePHI), and Breach Notification. Know the minimum necessary standard, the TPO (treatment, payment, operations) exceptions, patient rights (access, amendment, accounting of disclosures), and Business Associate Agreements. Understand the difference between a privacy violation (improper use/disclosure) and a security incident (safeguard failure). Auditors test access controls, audit logs, workforce training, and risk analysis-the Security Rule's required risk analysis is a frequent finding.
Traps
Questions confuse 'incidental disclosure' (permitted if reasonable safeguards) with a breach. Another trap: assuming encryption is optional-it's addressable, meaning required unless a documented equivalent is in place. Watch for the breach notification timeline (60 days) and the four-factor risk assessment for determining breach. Also, auditors sometimes forget that HIPAA permits disclosures for TPO without authorization.
Rule of thumb
No authorization needed for TPO; everything else needs a basis. When in doubt, apply minimum necessary and document the legal basis.
Worked example
A laptop with unencrypted ePHI is stolen. Because encryption was not in place, the breach presumption applies unless a four-factor risk assessment shows low probability of compromise. The auditor tests whether a risk analysis, encryption policy, and workforce training were in place-common gaps.