Access, Disclosure, Privacy, and Security
Privacy framework
HIPAA governs use and disclosure of protected health information (PHI). Treatment, payment, and health care operations (TPO) permit use or disclosure without authorization, subject to the minimum-necessary standard for non-treatment uses. A valid authorization must contain core elements and required statements; psychotherapy notes require a separate authorization. Patients have rights to access, amendment, accounting of disclosures, restrictions, confidential communications, and notice of privacy practices.
Disclosures
Know the public-policy exceptions: public health reporting, abuse or neglect, law enforcement, coroner or medical examiner, organ donation, research with IRB approval or waiver, and certain judicial or administrative proceedings. A subpoena generally requires satisfactory assurance that other legal requirements are met, while a court order may compel disclosure. State law may be stricter than HIPAA and then preempts it.
Security and breach
The Security Rule safeguards are administrative, physical, and technical. The 18 identifiers define Safe Harbor de-identification; expert determination is the alternative. Breach notification to individuals is generally within 60 days, and business associates must notify covered entities.
Trap
Accounting of disclosures excludes TPO, most disclosures directly to the individual, and several other exceptions, so do not count routine treatment disclosures.
Rule of thumb
Before releasing PHI, confirm purpose, legal authority, minimum necessary, and documentation. If any element is missing, do not release.