CHP cheat sheet

HIPAA Privacy Rule (45 CFR Part 160 and Subparts A and E of Part 164) governs use and disclosure of individually identifiable health information by covered entities.

Protected Health Information (PHI) is information created or received by a covered entity that relates to past, present, or future physical or mental health, care, or payment and identifies or could identify the individual.

Three covered entity categories: health plans, health care clearinghouses, and health care providers that transmit health information electronically in connection with a HIPAA standard transaction.

De-identification under the Privacy Rule uses either the Safe Harbor method (removal of 18 specified identifiers) or the Expert Determination method (statistical/scientific proof of very small re-identification risk).

The HIPAA Security Rule applies only to electronic PHI (ePHI); the Privacy Rule applies to PHI in any form, including paper and oral.

Preemption rule: HIPAA sets a federal floor; a contrary state law is preempted unless it is more stringent or an exception (e.g., public health reporting, controlled substances) applies.

HITECH Act (2009) extended Privacy and Security Rule obligations directly to business associates and added breach notification requirements.

The minimum necessary standard applies to most uses, disclosures, and requests for PHI, but not to disclosures to or requests by a health care provider for treatment.

A covered entity must designate a Privacy Official responsible for development and implementation of privacy policies and procedures and a Security Official responsible for security policies.

Required administrative safeguards include a risk analysis, risk management plan, sanction policy, and periodic review of information system activity records.

Workforce training must occur for each new member of the workforce within a reasonable time after joining and when functions are materially affected by a change in policies or procedures.

The Notice of Privacy Practices must be maintained, posted, and provided to new patients, with revisions posted and made available on request.

A complaint process must be documented, and the covered entity may not intimidate or retaliate against anyone for filing a complaint or exercising privacy rights.

Policies and procedures must be documented, and where required by the Security Rule, retained for six years from the date of last effective date.

Governance artifacts typically include a privacy charter, policy hierarchy, delegation of authority, and a documented privacy risk register with owners and due dates.

OCR enforces the Privacy and Security Rules and can impose civil monetary penalties tiered by culpability, from lack of knowledge to willful neglect not corrected.

Individuals have a right of access to inspect and obtain a copy of PHI in a designated record set, including in electronic form if the record is maintained electronically.

Access must generally be provided within 30 days of the request, with one 30-day extension permitted if the individual is notified in writing of the reason and date.

A reasonable, cost-based fee for access may include only labor for copying, supplies, and postage; it may not include costs of searching for or retrieving the PHI.

Denial of access is permitted in limited circumstances (e.g., psychotherapy notes, information compiled for legal proceedings); some denials are reviewable and some are not.

Individuals may request amendment of PHI; the covered entity may deny if the information was not created by it, is not part of the designated record set, or is accurate and complete.

Individuals have the right to request restrictions on uses and disclosures, and must be granted a restriction when the disclosure is to a health plan for payment or operations and the PHI pertains solely to a service paid in full out of pocket.

Individuals may request confidential communications by alternative means or at alternative locations, and the covered entity must accommodate reasonable requests.

The right to an accounting of disclosures covers most disclosures for up to six years prior, but excludes disclosures for treatment, payment, and health care operations.

A covered entity may use or disclose PHI for treatment, payment, and health care operations (TPO) without authorization.

Disclosures for public health activities, to report child abuse or neglect, to the FDA, and to public health authorities are permitted without authorization.

Disclosures for judicial and administrative proceedings require a court order, grand jury subpoena, or a valid authorization, with specific conditions for discovery requests.

Disclosures to law enforcement are limited and generally require a warrant, court order, grand jury subpoena, or specific statutory criteria such as identification and location of a suspect.

Disclosures to family and friends involved in the individual's care are permitted if the individual is present and does not object, or if the individual is incapacitated and the disclosure is in their best interest.

Disclosures for research generally require authorization, a waiver of authorization from an IRB or Privacy Board, or use of de-identified or limited data set information.

A limited data set may be disclosed for research, public health, or health care operations without authorization if a data use agreement is in place.

Disclosures to a coroner, medical examiner, or funeral director and for organ donation are permitted without authorization.

A valid authorization must be in plain language and contain a specific description of the information, the persons authorized to disclose and receive it, the purpose, an expiration date or event, and the individual's signature and date.

The authorization must include required statements: the right to revoke, the ability or inability to condition treatment on signing, the potential for redisclosure and loss of protection, and the right to a copy.

A compound authorization may condition research-related treatment on signing, but a covered entity may not condition treatment, payment, enrollment, or eligibility on an authorization except in limited circumstances.

A valid authorization must be revoked in writing; revocation is not effective to the extent the covered entity has already acted in reliance on it.

Minimum necessary applies to uses, disclosures, and requests, but not to treatment disclosures, disclosures to the individual, or disclosures made pursuant to a valid authorization.

For routine and recurring disclosures, a covered entity may establish standard protocols as the minimum necessary determination; for non-routine disclosures, an individual review is required.

Consent under HIPAA is distinct from authorization: consent is a general permission for TPO, while authorization is a specific, detailed permission for other uses and disclosures.

Psychotherapy notes require a separate authorization for use or disclosure, with narrow exceptions such as use by the originator for treatment and certain oversight activities.

A business associate is a person or entity that performs functions or activities on behalf of a covered entity involving the use or disclosure of PHI, such as claims processing, billing, data analysis, or legal services.

A written business associate agreement (BAA) must establish permitted uses and disclosures, safeguards, reporting of breaches and security incidents, and return or destruction of PHI at termination.

A covered entity is not liable for the acts of a business associate that is not its agent, but remains responsible for its own oversight and for breaches caused by its own conduct.

Business associates must comply with the Security Rule and with applicable Privacy Rule provisions, and are directly liable for impermissible uses and disclosures.

A subcontractor that creates, receives, maintains, or transmits PHI on behalf of a business associate is also a business associate and requires a downstream BAA.

A conduit exception applies to entities that only transmit PHI, such as an internet service provider or postal service, and do not access or store the information.

A group health plan and its plan sponsor may share PHI only if the plan documents are amended to restrict the sponsor's use and disclosure of the information.

Upon termination, the business associate must return or destroy PHI; if return or destruction is infeasible, protections must be extended and the condition documented.

Security Rule safeguards are organized into administrative, physical, and technical categories, each with required and addressable implementation specifications.

Required administrative safeguards include a risk analysis, risk management, sanction policy, and information system activity review; addressable specifications must be implemented or documented as not reasonable and appropriate with an equivalent alternative.

Technical safeguards include access control, audit controls, integrity controls, person or entity authentication, and transmission security.

A breach is the acquisition, access, use, or disclosure of PHI in a manner not permitted by the Privacy Rule that compromises the security or privacy of the PHI.

The breach presumption can be rebutted by demonstrating a low probability of compromise through a four-factor risk assessment: nature and extent of PHI, unauthorized recipient, whether PHI was actually acquired or viewed, and extent of mitigation.

Notification of a breach affecting 500 or more individuals must be made to affected individuals without unreasonable delay and no later than 60 days after discovery, and to HHS and the media.

Breaches affecting fewer than 500 individuals must be reported to HHS annually within 60 days after the end of the calendar year in which the breach was discovered.

Business associates must notify the covered entity of a breach without unreasonable delay and no later than 60 days after discovery, per the BAA.

A risk analysis is an ongoing process to identify and assess potential risks and vulnerabilities to the confidentiality, integrity, and availability of ePHI.

Risk analysis outputs feed a risk management plan that prioritizes remediation based on likelihood and impact and assigns owners and timelines.

Audit controls are required technical safeguards that record and examine activity in information systems that contain or use ePHI.

Monitoring programs typically include access log review, anomaly detection, privileged user monitoring, and periodic privacy rounding or walkthroughs.

A privacy gap assessment maps current practices against HIPAA requirements and organizational policy to identify control deficiencies.

Key privacy metrics include access request turnaround time, authorization completeness rates, training completion, and breach and incident volumes by category.

Audit sampling should cover high-risk areas such as minimum necessary compliance, business associate agreements, and accounting of disclosures.

Findings should be tracked through a corrective action plan with documented remediation evidence and closure verification.

Workforce training must be documented, including the date, the content, and the attendees, and must be refreshed when policies change materially.

Role-based training should differentiate content for clinical staff, front desk and access staff, IT and security staff, and business associate contacts.

A privacy incident is any suspected or actual impermissible use or disclosure of PHI; incidents are triaged to determine whether a breach occurred.

Incident response phases typically include identification, containment, risk assessment, notification determination, remediation, and post-incident review.

A four-factor breach risk assessment must be documented, including the nature and extent of PHI, the unauthorized recipient, whether the PHI was actually acquired or viewed, and the extent of mitigation.

Containment steps may include retrieving the PHI, shutting down access, re-educating the workforce, and notifying the individual and HHS when required.

A sanction policy must be applied consistently to workforce members who violate privacy policies, and the sanctions must be documented.

Post-incident reviews should identify root cause, update policies and training, and verify that corrective controls are operating effectively.