Healthcare Privacy Fundamentals and Legal Framework
The Core Rules
HIPAA's Privacy Rule governs how covered entities and their business associates handle protected health information (PHI). PHI is individually identifiable health information transmitted or maintained in any form or medium, relating to past, present, or future physical or mental health, care provided, or payment for care. The Security Rule applies specifically to electronic PHI (ePHI) and sets administrative, physical, and technical safeguard standards. The Breach Notification Rule imposes reporting duties when unsecured PHI is compromised.
Who Is Covered
Covered entities are health plans, healthcare clearinghouses, and healthcare providers who transmit health information electronically in connection with certain transactions. Business associates are separate entities performing functions on behalf of covered entities that involve PHI. Knowing which category an actor falls into determines which obligations attach.
Traps Candidates Miss
- De-identified data is not PHI. The two recognized methods are the Safe Harbor method (removal of 18 specified identifiers) and the Expert Determination method. A common trap is treating pseudonymized or coded data as de-identified when a key still exists.
- State law can be stricter. HIPAA sets a floor, not a ceiling; where state law is more protective, it generally controls.
- The Privacy Rule covers paper and oral PHI, not just electronic records.
- Minimum necessary does not apply to disclosures to the individual or for treatment.
Rule of Thumb
Ask three questions in order: (1) Is this PHI? (2) Is the actor a covered entity or business associate? (3) Which rule (Privacy, Security, or Breach Notification) governs the activity? Answering in sequence prevents conflating the Security Rule's ePHI focus with the Privacy Rule's broader scope.
Worked Example
A clinic emails a patient's lab results to a specialist for treatment. This is PHI, the clinic is a covered entity, and the disclosure is for treatment, so minimum necessary does not constrain it-but reasonable safeguards still apply.