Privacy, Security, and Regulatory Compliance
Privacy, security, and regulatory compliance tests HIPAA and related rules as they apply to health IT. Expect questions on permitted uses and disclosures, safeguards, breach assessment, patient rights, and special regimes such as 42 CFR Part 2.
HIPAA core rules
- The Privacy Rule governs PHI use and disclosure, including treatment, payment, and operations (TPO), minimum necessary, authorization, and patient rights to access, amend, and receive an accounting of disclosures.
- The Security Rule requires administrative, physical, and technical safeguards for ePHI and a risk analysis and risk management program. Encryption is addressable, not optional in practice; it supports breach safe harbor.
- The Breach Notification Rule uses a four-factor risk assessment: nature and extent of PHI, unauthorized recipient, whether PHI was actually acquired or viewed, and mitigation.
Related requirements
- HITECH extended obligations to business associates and strengthened enforcement.
- 42 CFR Part 2 imposes stricter consent and redisclosure limits on substance use disorder records.
- FDA and ONC rules address device software and health IT certification.
Worked example
An unencrypted laptop with 500 patients' records is lost. Reasoning: confirm PHI, encryption status, and any evidence of access. Apply the four factors: data elements, recipient, acquisition, and mitigation such as remote wipe. Document the assessment. State law may require notification even when the HIPAA risk is low.
Traps
Saying encryption is optional; forgetting the treatment exception to minimum necessary; treating every incident as a reportable breach; omitting business associate agreements.