Privacy, Security, and HIPAA
Privacy, Security, and HIPAA
This domain tests the HIPAA Privacy, Security, and Breach Notification Rules, plus related federal and state obligations. Questions often turn on whether a use or disclosure is permitted, what safeguards are required, and when notification is triggered.
Core rules
- The Privacy Rule governs uses and disclosures of protected health information. Treatment, payment, and health care operations generally do not require authorization; other uses require a valid authorization unless an exception applies. Minimum necessary applies to most uses and disclosures.
- Patients have rights to access, amendment, accounting of disclosures, restriction requests, confidential communications, and a notice of privacy practices.
- The Security Rule applies to electronic PHI and requires administrative, physical, and technical safeguards, including access controls, audit controls, integrity, transmission security, contingency planning, and incident response. Encryption is addressable: assess it, implement it if reasonable, or document why not and use an equivalent safeguard.
- Business associates must have a written BAA and comply with applicable Security Rule provisions. A covered entity remains responsible for oversight.
- Breach notification: presume a breach unless a four-factor risk assessment demonstrates low probability of compromise. Notify individuals without unreasonable delay and no later than 60 days after discovery; notify HHS/OCR; notify media if more than 500 residents of a state or jurisdiction are affected. Business associates notify the covered entity without unreasonable delay and no later than 60 days after discovery.
- De-identification uses Safe Harbor removal of 18 identifiers or Expert Determination. State laws and 42 CFR Part 2 may impose stricter requirements for substance use disorder records.
Worked example
An unencrypted laptop containing ePHI for 1,200 patients is stolen. Reasoning: encryption would have provided a safe harbor, but it was not used. The organization performs a documented four-factor risk assessment; absent low probability, the incident is a breach. It notifies individuals, HHS, and media if the 500-resident threshold is met, and documents the assessment and remediation.
Traps that cost marks
- Treating encryption as optional without a documented risk decision.
- Missing the 60-day outer notification deadline.
- Failing to execute business associate agreements.
- Ignoring paper records, verbal disclosures, and minimum necessary.
- Assuming HIPAA preempts stricter state law.