Privacy and Security in Healthcare
Domain 5 tests the substance of the Privacy and Security Rules: what you may do with PHI, what patients can demand, and which safeguards are mandatory.
Privacy Rule essentials
Treatment, payment, and health care operations (TPO) are permitted without authorization; most other uses need a valid authorization. Minimum necessary applies to uses and disclosures but not to treatment disclosures or to disclosures to the individual. Patients hold rights to access (respond within 30 days, with one 30-day extension), amend, request restrictions and confidential communications, receive a notice of privacy practices, and obtain an accounting of disclosures (six years, TPO excluded).
De-identification
Two routes: Safe Harbor, removing the 18 specified identifiers (including dates finer than year, full ZIP for small populations, and any unique identifying code), or expert determination. A limited data set plus a data use agreement is a third, narrower option.
Security Rule essentials
Administrative, physical, and technical safeguards, classified as required or addressable. Addressable means assess and implement an equivalent if the specification is not reasonable - it is never simply optional. Core items: risk analysis, access control, audit logging, integrity, transmission security, device and media controls, facility access, and workforce training.
Breach notification
A breach is an impermissible acquisition, access, use, or disclosure that compromises security or privacy; it is presumed unless a four-factor risk assessment shows low probability. Individuals must be notified without unreasonable delay and no later than 60 days; HHS is notified, and media in the affected state if more than 500 residents are involved.
Worked example
An unencrypted laptop with 3,000 patient records is stolen from a car. Reasoning: the encryption safe harbor is unmet, so breach is presumed; the four-factor analysis (nature and extent of PHI, the unauthorized recipient, whether data was actually viewed, and mitigation) is documented; individuals are notified within 60 days, HHS is notified at the same time because the count exceeds 500, and media notice is assessed.
Traps
- Believing "addressable" means optional.
- Thinking TPO appears in the accounting of disclosures.
- Applying minimum necessary to treatment.
- Counting 60 business days instead of calendar days.