CHPC cheat sheet

Covered entity = a health plan, a health care clearinghouse, or a health care provider that transmits health information electronically in connection with a HIPAA standard transaction.

Statutorily required program elements: designated privacy official, workforce training, reasonable safeguards, complaint process, sanctions policy, non-retaliation, and six-year documentation retention.

Governance structure: privacy official holds operational accountability, a compliance/privacy committee provides oversight, and the governing board receives periodic privacy risk reporting.

Three lines of defense model: operational staff own privacy risk (first line), the privacy/compliance function monitors and advises (second line), internal audit provides independent assurance (third line).

Program scope covers PHI in every medium - paper, electronic, oral, and visual - regardless of where it is stored or who created it.

Hybrid entity status is established by written designation of health care components; non-designated components fall outside HIPAA's application to that legal entity.

Documentation retention is six years from the date of creation or the date last in effect, whichever is later, and applies to policies, training logs, complaints, BAAs, and breach files.

Program risk assessment is refreshed on a defined cycle and on trigger events such as new regulation, new technology, acquisition or merger, and confirmed breach.

Distinguishing line: the Privacy Rule governs permitted uses and disclosures of PHI; the Security Rule governs confidentiality, integrity, and availability of electronic PHI.

HIPAA administrative simplification sits at 45 CFR Parts 160 and 164: Subpart A general provisions, Subpart C Security Rule, Subpart D breach notification, Subpart E Privacy Rule.

HITECH Act (2009) extended direct HIPAA obligations to business associates, created breach notification, mandated EHR accounting of disclosures, and added the self-pay restriction right.

Preemption rule: HIPAA is a federal floor; a contrary state law that is more stringent - grants greater privacy protection or greater individual rights - prevails over HIPAA.

42 CFR Part 2 protects records of federally assisted substance use disorder programs, generally requires patient consent for disclosure, and mandates a redisclosure prohibition notice.

GINA Title II bars health plans and health insurers from using genetic information for eligibility or underwriting; HIPAA separately bars genetic information use for underwriting.

FERPA governs education records held by educational institutions; HIPAA does not apply to those records even when the institution also operates as a covered entity.

State laws commonly impose shorter access timelines, specific minor-consent rules, and heightened protections for HIV, mental health, and substance use disorder information.

Accreditation standards and conditions of participation may impose privacy requirements, but they are contractual or programmatic obligations rather than the statutory source of authority.

Treatment, payment, and health care operations are permitted without authorization; all other uses and disclosures require an authorization, a specific permission, or a legal mandate.

Authorization core elements: description of PHI, identity of authorizer, recipient, purpose, expiration date or event, signature and date, right to revoke, right to refuse or condition treatment, and redisclosure statement.

Minimum necessary applies to routine uses and disclosures but not to treatment disclosures, disclosures to the individual, authorized disclosures, disclosures required by law, or disclosures to HHS for enforcement.

Psychotherapy notes require a separate, specific authorization and are excluded from the designated record set, from accounting of disclosures, and from routine release.

Marketing communications require authorization except face-to-face encounters and gifts of nominal value; sale of PHI and most fundraising communications carry their own consent or opt-out rules.

Disclosures to family and friends are permitted when the individual is present and agrees, or when a professional determines it is consistent with the individual's prior expressed preferences.

Verification is required before disclosing: confirm identity and authority of public officials, personal representatives, and business associates requesting PHI.

Facility directories may release name, location, general condition, and religious affiliation to callers who ask for the individual, unless the individual objects.

Access requests must be acted on within 30 days; one 30-day extension is available with written notice and a stated reason.

Format rule: provide access in the form and format requested if readily producible; electronic records must be provided electronically when that is the individual's request.

Fee rule: only reasonable, cost-based fees for labor, supplies, postage, and preparation of an agreed summary; no fee for searching or retrieving in most circumstances.

Denials fall into two categories - unreviewable (e.g., psychotherapy notes, information compiled for legal proceedings) and reviewable (e.g., safety-based denials) with a designated reviewer.

Amendment: act within 60 days, one 30-day extension permitted; if denied, the individual may submit a statement of disagreement that must accompany future disclosures.

Accounting of disclosures covers the six years before the request, is due in 30 days with one extension, and excludes treatment, payment, and operations disclosures except EHR disclosures for those purposes in the prior three years.

Self-pay restriction: if the individual pays in full out of pocket, the covered entity must honor a request not to disclose that service's PHI to the health plan.

Confidential communications: reasonable requests to receive PHI by alternative means or at an alternative location must be accommodated, and must be honored when the individual states disclosure would endanger them.

Notice of privacy practices is provided at first service delivery, posted prominently, available on request, and reissued after material changes within 60 days.

Business associate = a person or entity, other than a workforce member, that creates, receives, maintains, or transmits PHI to perform a function or service for a covered entity.

Conduit exception: entities that only transmit PHI - internet service providers, the postal service, couriers - are not business associates because they do not access the content.

Required BAA content includes permitted and required uses, safeguards obligation, breach reporting, subcontractor flow-down, individual rights assistance, return or destruction, HHS access to practices, and termination.

HITECH made business associates directly liable for Security Rule compliance, breach notification, and specified Privacy Rule provisions.

Subcontractor rule: any downstream subcontractor that touches PHI must sign a BAA imposing the same restrictions as the prime agreement.

Return-or-destroy clause: on termination the business associate returns or destroys PHI; if destruction is infeasible, protections are extended and the reason is documented.

Fully insured group health plans: the insurer is generally not a business associate when it only provides insurance, though other vendor relationships may still qualify.

Due diligence evidence typically includes completed security questionnaires, SOC 2 or equivalent reports, subcontractor lists, breach history, insurance, and a right-to-audit clause.

Covered entities remain exposed for business associate conduct, so vendor risk is reviewed periodically and at renewal, not only at contracting.

Breach definition: an acquisition, access, use, or disclosure of PHI not permitted by the Privacy Rule; it is presumed a breach unless a risk assessment shows low probability of compromise.

Four risk assessment factors: nature and extent of PHI involved, the unauthorized person who used or received it, whether PHI was actually acquired or viewed, and the extent of mitigation.

Three breach exceptions: unintentional good-faith access by a workforce member within scope of duties, inadvertent disclosure between two authorized persons at the same entity, and good-faith belief the recipient could not retain the information.

Individual notice: written notice by first-class mail (or email if agreed) without unreasonable delay and no later than 60 days after discovery; substitute notice applies when contact information is insufficient.

HHS notice: breaches affecting 500 or more individuals are reported contemporaneously with individual notice; smaller breaches are logged and submitted within 60 days of the end of the calendar year.

Media notice: required for breaches affecting 500 or more residents of a state or jurisdiction, without unreasonable delay and within 60 days.

Law enforcement may delay notice if a written statement explains that notice would impede a criminal investigation or damage national security.

Security Rule safeguards are administrative, physical, and technical, with implementation specifications classified as required or addressable, plus documented risk analysis and risk management.

Incident response sequence: detect, contain, assess risk, notify as required, mitigate harm, document decisions, and implement corrective action.

Training is required at onboarding and whenever privacy policies or procedures materially change; completion records must capture content, date, and attendee.

Role-based curricula differentiate high-risk groups such as clinical staff, researchers, front desk and registration, health information management, IT, and management.

Communication vehicles include the notice of privacy practices, signage, intranet pages, team huddles, newsletters, and translated or accessible formats for limited-English-proficiency populations.

Non-retaliation is a legal requirement: no intimidation or retaliatory action against a person who files a complaint or exercises a privacy right.

Sanctions policy is graduated and applied consistently regardless of seniority, with documented outcomes for each substantiated violation.

Culture indicators include executive sponsorship, visible code of conduct, workforce confidentiality attestations, and consistent messaging from managers.

Effectiveness is measured through training completion rates, assessment scores, phishing simulation results, incident trends, and audit findings rather than attendance alone.

Just culture framing separates human error from at-risk or reckless behavior so that staff self-report mistakes instead of concealing them.

Monitoring is continuous and near real-time (access alerts, log review); auditing is periodic and retrospective (chart audits, access reconciliation samples).

Access auditing compares workforce system activity against assigned patients, units, or job role to detect snooping, VIP record access, and access to co-workers' or family members' records.

Audit triggers include complaints, confirmed breaches, new systems or interfaces, high-risk user flags, random sampling, and workforce separations.

Investigation sequence: intake and logging, evidence preservation, interviews, factual findings, harm mitigation, sanction determination, and documented closure.

Mitigation duty requires the covered entity to reduce harmful effects of an impermissible use or disclosure to the extent practicable and to record what was done.

Privacy metrics typically tracked: incidents per 1,000 workforce members, median time to close, training completion, access exceptions, and corrective actions past due.

Repeat findings require root cause analysis and a corrective action plan with an owner and due date, tracked to verified closure.

Investigation files, risk assessments, and sanction records are retained for six years; privileged review is coordinated with counsel where legal advice is involved.