Privacy, Security, and Regulatory Compliance
Frameworks to know
HIPAA Privacy Rule governs use and disclosure of protected health information (PHI); the Security Rule covers administrative, physical, and technical safeguards for electronic PHI; the Breach Notification Rule sets notification duties. HITECH strengthened enforcement and extended obligations to business associates. Know the 18 HIPAA identifiers and the two de-identification paths: the Safe Harbor removal of all 18 identifiers, and the Expert Determination method.
Concepts to master
- Minimum necessary standard and treatment/payment/operations exceptions.
- Authorization vs. permitted disclosure without authorization.
- Role-based access control, least privilege, and break-the-glass access with audit.
- Encryption and its role in breach safe harbor (encrypted data generally not a reportable breach if keys are uncompromised).
- Business associate agreements and the covered entity/business associate distinction.
- Security triad (confidentiality, integrity, availability) and risk analysis as a Security Rule requirement.
- State laws and consent rules that may be stricter than HIPAA.
Traps
Questions often test whether a scenario is a use or a disclosure, whether an entity is a business associate, and whether de-identification was done correctly-removing names but leaving dates of service or ZIP codes fails Safe Harbor. Another trap: assuming HIPAA preempts stricter state law; it sets a floor, not a ceiling.
Rule of thumb
Ask three questions: Is it PHI? Is the recipient permitted (treatment, payment, operations, or authorization)? Is only the minimum necessary being shared? If any answer is no, stop.
Worked example
A vendor hosts a portal containing PHI: that vendor is a business associate and needs a BAA. If a laptop with unencrypted PHI is stolen, presume a breach unless a risk assessment shows low probability of compromise.