Health Law and Compliance
Rules that constrain how information and money move
This domain rewards precise distinctions. HIPAA Privacy Rule governs use and disclosure of protected health information; the Security Rule addresses administrative, physical, and technical safeguards for electronic PHI; the Breach Notification Rule sets notification duties. Know the permitted disclosures without authorization (treatment, payment, operations), the minimum necessary standard, and the patient rights: access, amendment, accounting of disclosures, restriction requests, and confidential communications. Psychotherapy notes and certain records carry special protections.
The 21st Century Cures Act information blocking rules prohibit practices that interfere with access, exchange, or use of electronic health information, with defined exceptions. Part 2 of Title 42 governs substance use disorder records and is stricter than HIPAA.
Other statutes to recognize: the HITECH Act (expanded enforcement and breach notification), the False Claims Act (fraud, qui tam relators), the Anti-Kickback Statute (remuneration for referrals in federal programs), Stark law (physician self-referral, strict liability), the Civil Monetary Penalties Law, and the Emergency Medical Treatment and Labor Act for emergency screening and stabilization.
Compliance programs follow the seven elements framework: standards and policies, compliance leadership, training and education, communication, monitoring and auditing, enforcement and discipline, and response and prevention.
Worked example: A clinician emails a patient's record to the patient's personal address at the patient's written request. That is a permitted disclosure with authorization; the minimum necessary standard does not bar the patient from receiving their own record. If the same email went to the wrong patient, that is a potential breach requiring a risk assessment.
Trap: Assuming any unauthorized access is automatically a reportable breach; a risk assessment determines whether notification is required.