Regulatory Compliance, Privacy, and Ethics (HIPAA and related)
This domain tests the rules that govern how reviewer work is conducted: what may be accessed, disclosed, and retained, and what happens when protected information is mishandled. Expect items on permitted uses, patient rights, breach notification, security safeguards, and the ethical duties that run alongside them.
Privacy Rule essentials
Protected health information is individually identifiable health information held or transmitted by a covered entity or business associate. Treatment, payment, and health care operations permit use and disclosure without authorization; other purposes generally require a valid authorization with its core elements. The minimum necessary standard applies to uses and disclosures - except treatment, and except disclosures to the individual. Patients have rights to access (generally within 30 days), amendment, an accounting of disclosures, restriction requests, and a notice of privacy practices.
Security and breach
- Administrative, physical, and technical safeguards protect electronic PHI; encryption supports a safe-harbor argument if a breach occurs.
- Breach notification: individuals notified without unreasonable delay and no later than 60 days after discovery; HHS notified contemporaneously for breaches affecting 500 or more, annually for smaller ones; media notice for large local breaches.
- The four-factor risk assessment may rebut the presumption that an impermissible use is a breach.
- Business associates must have a written agreement and must notify the covered entity of breaches.
Ethics in review
Confidentiality, honest reporting, disclosure of conflicts, avoidance of scope creep, and no use of review access for curiosity or personal advantage. State preemption rules generally let the stricter law govern.
Worked example
A reviewer emails a spreadsheet with patient names, dates of birth, and diagnoses to a personal account to finish work at night. The reasoning: this is a disclosure of unencrypted PHI outside the covered entity's controls, exceeding minimum necessary, and the presumption of breach is not rebutted. The reviewer must report internally, the entity must assess and notify, and the corrective action is a secure portal plus retraining. The good intention is irrelevant to the analysis.
Traps that cost marks
- Thinking de-identified data may retain dates of service - dates are identifiers.
- Believing a business associate agreement is optional.
- Using HIPAA to refuse a patient a copy of their own record.
- Forgetting that minimum necessary does not limit treatment disclosures.