Health Insurance Portability And Accountability Act Privacy Research Articles

HIPAA Compliance for Telehealth to Be Required Again on August 9

Back to table of contents Next article Government & LegalFull AccessHIPAA Compliance for Telehealth to Be Required Again on August 9Mark MoranMark MoranSearch for more papers by this authorPublished Online:31 May 2023AbstractHIPAA compliance is about more than just technology—it also means having physical or environmental and process security measures in place. A business associate agreement with a vendor may be necessary to ensure compliance with HIPAA.The federal Office of Civil Rights (OCR) in April extended the deadline for requiring telehealth compliance with the Health Insurance Portability and Accountability Act (HIPAA) by 90 days to August 9.At that time, health care professionals practicing telehealth must comply with HIPAA’s Security Rule and will no longer be able to use standard video technologies such as Zoom, Skype, or Facebook to meet with patients, as they had been allowed to do during the Public Health Emergency (PHE), which ended on May 11. Even before the new deadline, psychiatrists and other health care professionals need to pay attention to state rules about HIPAA compliance as well as the requirements of their institution, organization, or practice.“Best practices to ensure environmental privacy include clinicians connecting from a private space and letting patients know if there are others in the room with them,” said Shabana Khan, M.D. “This demonstrates to patients that their telehealth clinician values protecting their health information.”“OCR is providing this transition period to allow health care practitioners and practices to make necessary changes to ensure that their telehealth technologies are private and secure in a way that is adherent with HIPAA rules,” said Shabana Khan, M.D., chair of the APA Committee on Telepsychiatry. “Though OCR has provided this 90-day transition period through August 9, telehealth clinicians must also consider state rules and practice or organization requirements when deciding which technologies to use for telehealth services. We have this flexibility at the federal level, but an organization may require that their clinicians use approved HIPAA-adherent technologies.”HIPAA, which was signed in 1996 by President Bill Clinton, sets national standards for health information protections. The U.S. Department of Health and Human Services (HHS) established these standards to ensure protected health information (PHI) processed and utilized by “covered entities” is private and secure. OCR is responsible for implementing and enforcing this rule. HIPAA requirements cover a broad range of patient data and information, including making an appointment, conducting the appointment, and billing the patient’s insurance.HIPAA encompasses two major rules: the Privacy Rule and the Security Rule. The Privacy Rule protects all identifiable data of an individual patient; the Security Rule, a subset of the Privacy Rule, protects information that a covered entity creates, receives, maintains, or transmits in electronic form.So what does it mean to be HIPAA compliant when providing telehealth services? Importantly, it’s not just about technology. It also means having physical or environmental and process security measures in place to ensure that only those who are supposed to have access to patients’ information are able to get it.“Environmental privacy best practices include clinicians connecting from a private space and letting patients know if there are others in the room with them—for instance, a nurse or medical student who may be off screen,” Khan said. “Clinicians should also provide guidance to their patients on the importance of connecting to telehealth visits from a private space and avoiding public or semi-public settings. Clinicians can also ask patients if there is anyone in the room with them at the start of the visit. This demonstrates to patients that their telehealth clinician values protecting their health information.”Technology features that can help a HIPAA-covered entity meet compliance requirements include the following:Fully encrypted data transmission.Additional authentication and security through required passwords.Secure point-to-point connection.Private high-speed network.Administrative, physical, and technical safeguards for electronic protected health information.Audit controls.Breach notification.John Torous, M.D., chair of the APA Committee on Mental Health IT, said psychiatrists must use vendors of telehealth technology who can assure HIPAA compliance and have a signed business associate agreement (BAA).“Often you can use the same product (such as Zoom) without a BAA, but to make it HIPAA complaint, a psychiatrist needs to use the version of Zoom that requires the signature of a BAA,” he wrote in an email. “Regardless of the technology, being HIPAA complaint means the psychiatrist still has to offer reasonable physical safeguards (such as keeping computer passwords secure) and have process safeguards in place too (restricting access to patient files, creating plans for appropriate use of data).” ■ResourcesHHS Office for Civil Rights AnnouncementHIPAA & HIT: A PrimerSummary of the HIPAA Privacy RuleThe Security Rule ISSUES NewArchived

A comparative study on HIPAA technical safeguards assessment of android mHealth applications

Protecting personal health records is becoming increasingly important as more people use Mobile Health applications (mHealth apps) to improve their health outcomes. These mHealth apps enable consumers to monitor their health-related problems, store, manage, and share health records, medical conditions, treatment, and medication. With the increase of mHealth apps accessibility and usability, it is crucial to create, receive, maintain or transmit protected health information (PHI) on behalf of a covered entity or another business associate. The Health Insurance Portability and Accountability Act (HIPAA) provides guidelines to the app developers so that the apps must be compliant with required and addressable Technical Safeguards. However, most mobile app developers, including mHealth apps are not aware of HIPAA security and privacy regulations. Therefore, a research opportunity has emerged to develop an analytical framework to assist the developer to maintain a secure and HIPAA-compliant source code and raise awareness among consumers about the privacy and security of sensitive and personal health information. We proposed an Android source code analysis framework that evaluates twelve HIPAA Technical Safeguards to check whether a mHealth application is HIPAA compliant or not. The implemented meta-analysis and data-flow analysis algorithms efficiently identify the risk and safety features of mHealth apps that violate HIPAA regulations. Furthermore, we addressed API level checking for secure data communication mandated by recent CMS guidelines between third-party mobile health apps and EHR systems. Experimentally, a web-based tool has been developed for evaluating the efficacy of analysis techniques and algorithms. We have investigated 200 top popular Medical and Health & Fitness category Android apps collected from Google Play Store. We identified from the comparative analysis of the HIPAA rules assessment results that authorization to access sensitive resources, data encryption–decryption, and data transmission security is the most vulnerable features of the investigated apps. We provided recommendations to app developers about the most common mistake made at the time of app development and how to avoid these mistakes to implement secure and HIPAA-compliant apps. The proposed framework enables us to develop an IDE plugin for mHealth app developers and a web-based interface for mHealth app consumers.

Genomic Privacy: Advocating for the Convergence of Legal and Technical Solutions

Genomic Privacy:Advocating for the Convergence of Legal and Technical Solutions Can Kockan (bio), Dov Greenbaum (bio), Danielle Lee (bio), and Mark Gerstein (bio) The economy of DNA: consumer genomics and its risks Genomic data collection and analysis is an incredibly valuable sector within the information economy, yet genomic information has never been more pervasive nor publicly accessible. Just this past spring, the National Institutes of Health's "All of Us" program announced that it would make nearly one hundred thousand unique and diverse whole genome sequences available for researchers, and several other public efforts have similarly set out to collect and disseminate enormous amounts of genomic data for research.1 Beyond such institutions looking to innocuously advance their research and even beyond amateur genomic sleuths combing through our genetic information to try and crack unsolved crimes,2 there also exists reason to be concerned about matters relating to genetic privacy on the corporate side. [End Page 246] Companies such as MyHeritage and Ancestry. com collect client DNA in various degrees of quantity and quality, at times even using this data for commercial purposes and selling clients' genomic information to drug companies for hundreds of millions of dollars.3 In addition to the growing size of both public and private DNA databases, these databases have also grown increasingly more revealing as research continues to uncover additional correlations between genes and disease and hereditary conditions. For example, identical twins share 100 percent of their DNA, parents and siblings share up to 61 percent of their DNA, and even distant third cousins share up to 2.2 percent of their DNA.4 Thus, if even one of these individuals chooses to disclose their genomic information, they are in effect disclosing not only theirs but also much of the genomes of their close relatives. One study showed how the genetic information of the majority of Americans of European ancestry can be identified through their distant relatives' DNA that already exists in various public and private current databases.5 The result of such data is an ever-expanding genomic panopticon, as predicted by the late Supreme Court Justice Antonin Scalia.6 Following the COVID-19 pandemic, the genomic information consumed and produced around the world has only further contributed to expanding the realm of genomic data available to us. Genetic tests have become especially de rigueur when traversing borders, and it was even reported recently that various heads of state refused PCR testing when meeting the Russian president Putin out of fear that Russian intelligence might abuse and misuse the resulting genetic information.7 Yet, this fear is not limited to politicians, celebrities, or sports personalities whose genetic information could contain exploitable knowledge.8 In fact, given all the sunk costs for the infrastructure of pandemic genetic testing, some countries will likely continue to find excuses to collect and examine the DNA of visitors for a host of potentially actionable genetic data, including controversial correlations like propensity to violence or depression.9 As such, now would be the best time to enhance genetic data protection and privacy laws before we become too complacent with giving away our genes at the border, or anywhere else. A brief history of the technical and legal solutions for genomic privacy U.S. legislators have long assumed the primary role of protecting our genetic data, from instituting federal regulations like the Federal Genetic Information Nondiscrimination Act of 2008 (GINA) to state laws including those that target the limited use of genetic information in areas of health insurance, employment, and even direct-to-consumer genetic testing companies like 23andMe.10 However, laws are slow to change, and regulations are slow to implement. The Health Insurance Portability and Accountability Act (HIPAA) is exemplary of slowness in responding to outdated regulations. The 1996 law outlines limitations on the use of protected health information (PHI). Under HIPAA's Privacy Rule, individually identifiable health information is protected. Deidentified information is exempt from this rule, as is other data deemed unidentifiable.11 This definition is anachronistic in our world of big data, and even heretofore perceived benign data has long been shown to be as revealing as PHI.12 Practically speaking, these regulations are also...

Current Topics in Health Care Law

Current Topics in Health Care Law

Privacy as the Price of Drug Access

In response to the recent increase in FDA-approved specialty drugs and escalating specialty drug prices, drug companies now offer patient support programs (“PSPs”) for eligible patients prescribed a particular pharmaceutical drug. Such programs encompass both financial assistance for the purchase of a specialty drug and behavioral services, including nursing support and injection training, intended to improve drug adherence. Although ostensibly gratuitous, these programs have a steep and underappreciated cost: disclosure of protected health information. In effect, patient support programs compel patients to trade protected health information for drug access. This Article provides the first in- depth examination of the legal and ethical concerns associated with patient support programs. Enrollment in a drug company’s patient support program furnishes the company with linked patient- and prescriber- identifying information for each enrollee, data which may enable drug companies to target marketing to patients and healthcare providers with an otherwise unattainable degree of precision. Moreover, once a drug company acquires an enrollee’s protected health information pursuant to a valid Health Insurance Portability and Accountability Act (HIPAA) authorization, a drug company faces few limits on downstream uses of those data. This Article illuminates a possible role for patient support program-mediated data collection in two unlawful drug company practices: (1) kickback schemes in coordination with foundations that cover pharmaceutical drug copays, and (2) “product hopping” to a new brand-name drug formulation after patent expiration of an older formulation. The current regime for health data privacy in the United States lacks adequate safeguards to prevent drug companies from exploiting patient support program-derived data to the detriment of patients. The Article ends by proposing practical modifications to the HIPAA Privacy Rule to modernize HIPAA’s protections vis-à-vis health data transferred from covered entities to noncovered entities such as drug companies.

Radiological Imaging Transmission via Smartphones by Neurosurgery Residents in the United States

Neurosurgery requires the communication of radiological imaging. Smartphones are increasingly used for this purpose because of the efficiency and convenience of integrated cameras and native Multimedia Messaging Service (MMS) functionality. There is inconsistency among hospitals regarding policies addressing this use as it relates to the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule. Some hospitals offer a HIPAA-compliant secure messaging application (SMA) as a substitute. The authors hypothesized that the use of smartphones for sharing radiological imaging would be commonplace among residents. We sought to characterize usage patterns, resident awareness of policies and HIPPA, and the effectiveness of SMAs as a means of avoiding HIPAA violations. An electronic dynamic questionnaire was sent to all 116 Accreditation Council for Graduate Medical Education-accredited US neurosurgery residency program directors and coordinators to be forwarded to their residents. A total of 100 responses were received, representing 49 residency programs. Ninety-two (92%) residents reported using MMS to transmit radiological imaging. Twenty-six (26%) reported doing so with patient identifiers. Roughly half (48%) of residents were unaware of policies regarding imaging transmission via MMS at their institutions. Among the 17 (35%) programs providing SMAs, only 3 of 27 (11%) residents in these programs did not use MMS for image transmission. The data suggest that there is widespread resident use of MMS for image transmission, regardless of policy and the availability of alternative HIPAA-compliant applications. Knowledge of local institutional policies and HIPAA privacy rules is poor. Alternative strategies are needed to prevent HIPAA-noncompliant transmission of imaging by residents.

HHS‐proposed rule gutting HIPAA would especially hurt patients with SUD

In the ongoing call to make 42 CFR like the Health Insurance Portability and Accountability Act (HIPAA), people who want access to patient records for alcohol and drug use disorders may be thinking “Be careful what you ask for.” Now the federal Department of Health and Human Services (HHS) has made good on a promise to try to get rid of most of the protections of HIPAA. The proposed modifications to the HIPAA Privacy Rule, published Jan. 21 in the Federal Register and released earlier, would have negative consequences for people with substance use disorder (SUD) — and to all patients — according to comments filed by the Legal Action Center and the American Medical Association.

HHS‐proposed rule gutting HIPAA would especially hurt patients with SUD

In the ongoing call to make 42 CFR like the Health Insurance Portability and Accountability Act (HIPAA), people who want access to patient records for alcohol and drug use disorders may be thinking “Watch out what you ask for.” Now the federal Department of Health and Human Services (HHS) has made good on a promise to try to get rid of most of the protections of HIPAA (See “HHS considers weakening HIPAA,” ADAW January 21 2019; https://onlinelibrary.wiley.com/doi/10.1002/adaw.32231). The proposed modifications to the HIPAA Privacy Rule, published Jan. 21 in the Federal Register and released earlier (see ADAW, Jan. 11), would have negative consequences for people with substance use disorder (SUD) — and to all patients — according to comments filed by the Legal Action Center and the American Medical Association.

The HIPAA Privacy Rule, COVID-19, and nurses' privacy rights.

The article discusses the Privacy Rule of the U S Health Insurance Portability and Accountability Act (HIPAA) and how it protects the protected health information (PHI) of nurses if they are infected with COVID-19 while caring for their patients Also cited are the covered entities and business associates regulated by HIPAA, and the guidelines issued by the Department of Health and Human Services' Office of Civil Rights (OCR) on PHI disclosure

What guidance does HIPAA offer to providers considering familial risk notification and cascade genetic testing?

BackgroundIt is unclear how the Health Insurance Portability and Accountability Act (HIPAA) should be interpreted in the context of sharing of genomic information between family members.MethodsThe authors analyzed the HIPAA Privacy Rule, reviewed the literature and constructed a clinical scenario to inform how HIPAA can be interpreted for multiple forms of patient- and provider-mediated genetic risk notification.ResultsUnder HIPAA, healthcare providers can lawfully notify relatives to recommend genetic risk assessment using multiple approaches, including supporting the patient telling their own relatives, contacting relatives directly with the patient’s authorization, or contacting a relative’s provider directly.ConclusionsMultiple forms of patient- or provider-mediated contact of relatives are already legally permissible under HIPAA, are consistent with ethical obligations of care to patients and their families, and could result in improved population health through identification of clinically actionable disease risk. Unanswered questions remain about implementation and impacts of provider-mediated programs.

Data privacy considerations for telehealth consumers amid COVID-19.

The COVID-19 emergency poses particularly high infection risks in a clinical setting, where patients and health care providers are placed in the same room. Due to these risks, patients are encouraged to avoid clinics and instead use Telemedicine for safer consultations and diagnoses. In March, the Office for Civil Rights (OCR) at the U.S. Department for Health and Human Services (HHS) issued a notice titled Notification of Enforcement Discretion for Telehealth Remote Communications During the COVID-19 Nationwide Public Health Emergency (the ‘Notification’). The Notification relaxes the enforcement of privacy and security safeguards established by the Health Insurance Portability and Accountability Act (HIPAA) until further notice, in order to facilitate the transition to telehealth services for the broader purpose of promoting public health during the pandemic. Specifically, covered healthcare providers can use telehealth to provide all services that, in their professional judgment, they believe can be provided through telehealth. If providers make good faith efforts to provide the most timely and accessible care possible, they will not be subject to penalties for breaching the HIPAA Privacy, Security, and Breach Notification Rules. This paper examines the implications of the Notification on patients’ health information privacy. It recommends that patients should undertake a careful reading of provider privacy policies to make sure their protected health information (PHI) is not at risk before switching to telehealth consultation. Acknowledging the limitations of patient self-protection from bad privacy practices when in need for medical treatment during pandemic, the paper proposes that consumers’ data privacy should be protected through one of two alternative regulatory interventions: the FTC’s authority under §5, or HIPAA’s business associates agreements.

Privacy in the Coronavirus Era.

Privacy in the Coronavirus Era.

Important Considerations for the Institutional Review Board When Granting Health Insurance Portability and Accountability Act Authorization Waivers.

Background: Privacy is recognized as a basic human right in the United States and has been identified as a core principle of ethics in clinical research. However, changes in the regulations, changes in how research is conducted, and the availability of health data stored in electronic health record systems all pose risks to individuals’ privacy.Methods: The Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule addresses the use and disclosure of individuals’ health information and sets standards for privacy rights so that individuals can understand and control how their health information is used. However, despite the significant increase in the complexity of the data privacy landscape, the HIPAA Privacy Rule has been largely unchanged since its enactment in 1996.Results: Generally, healthcare entities may not use or disclose protected health information (PHI) for research without written authorization from each subject permitting that use or disclosure. However, the HIPAA Privacy Rule allows an institutional review board (IRB) to waive the need for such authorization if documentation is provided that the use or disclosure of PHI presents “no more than a minimal risk to the privacy” of the subjects. Because IRBs were one of the only bodies allowed to waive the need for authorizations in the research context, they essentially served as the gatekeepers of privacy for human subjects. However, this situation changed with the 2018 revisions to 45 CFR §46—known as the Common Rule—that added new categories of exempt research. Under the new regulations, research administrative staff may review a submitted research study and determine that it is exempt without the IRB ever being involved and with no independent review of privacy considerations. This change lessens privacy protections for research subjects. Therefore, IRBs must be mindful of the relevant HIPAA guidance and carefully consider all facts and circumstances available when granting approvals of HIPAA authorization waiver requirements, especially in the content of exempt research, so that the IRB is confident that reasonable safeguards to protect patient privacy have been maintained. Research institutions should amend their processes to ensure that the appropriate level of privacy review is given to all studies, even those that are exempt.Conclusion: Few concrete rules are applicable in the research context that ensure compliance with the HIPAA Privacy Rule. Ultimately, more definitive regulatory guidance integrating HIPAA and the revised Common Rule should be promulgated.

Review of HIPAA, Part 2: Limitations, Rights, Violations, and Role for the Imaging Technologist.

This article is the second part of a continuing education series reviewing the Health Insurance Portability and Accountability Act (HIPAA) of 1996. The term HIPAA should be familiar to those who work in the medical profession, but this article includes details on its rules, patients' rights, violations, breaches, and penalties. To help administer these safeguards, HIPAA requires that every organization designate a HIPAA privacy and security officer. HIPAA violations can have serious repercussions when rules are not followed; these violations can be either negligent or willful. If breaches of unsecured protected health information occur, HIPAA requires covered entities to notify affected individuals, the Secretary of Health and Human Services, and in some cases the media. Violations in which the covered entity did not know of the violation are now punishable under the first tier of penalties. Unintended violations carry a minimum penalty of $100 per violation and a maximum of $50,000 per violation. All patients have a right to privacy and a right to confidential use of their medical records. The role of medical professionals includes understanding how and when to apply these HIPAA rules verbally and electronically.

HHS Adjusts Penalties for HIPAA Violations

Back to table of contents Previous article Next article ProfessionalFull AccessHHS Adjusts Penalties for HIPAA ViolationsTerri D’ArrigoTerri D’ArrigoSearch for more papers by this authorPublished Online:2 Jul 2019https://doi.org/10.1176/appi.pn.2019.6b11AbstractNew annual limits reflect the level of culpability when violations occur and whether corrective action was taken.The Department of Health and Human Services (HHS) has changed the annual maximum penalties for violating the Health Insurance Portability and Accountability Act (HIPAA). The annual maximum penalties were previously capped at $1.5 million for every tier of violation. Now the annual limit is different for each tier, with only violators who demonstrate willful neglect and failure to correct violations facing a potential $1.5 million annual penalty (see table). The new penalties went into effect in April.In a notice published in the April 30 Federal Register, HHS cited “inconsistent language” in the Health Information Technology for Economic and Clinical Health (HITECH) Act, which established the tiers in 2009, as the impetus for the changes.“Upon further review of the statute by the HHS Office of the General Counsel, HHS has determined that the better reading of the HITECH Act is to apply [the new] annual limits,” Roger Severino, director of the HHS Office for Civil Rights, wrote. “HHS expects to engage in future rulemaking to revise the penalty tiers in the current regulation to better reflect the text of the HITECH Act.”The tiers are defined as follows:Tier 1: The person did not know and, by exercising reasonable diligence, would not have known that the person violated the provision.Tier 2: The violation was due to reasonable cause and not willful neglect.Tier 3: The violation was due to willful neglect that was corrected in a timely manner.Tier 4: The violation was due to willful neglect that was not corrected in a timely manner.APA offers HIPAA guides for members, including “APA’s HIPAA Privacy Rule Manual: A Guide for Your Psychiatric Practice” and “APA HIPAA Security Rule Manual.” They are posted here. ■“Notification of Enforcement Discretion Regarding HIPAA Civil Money Penalties” is posted here. ISSUES NewArchived

Keeping Patient Credit Card and Payment Information on File

Keeping Patient Credit Card and Payment Information on File

Should Immigration Status Information Be Considered Protected Health Information?

In response to a case of an undocumented patient who was reported to immigration authorities, this commentary considers whether a patient's immigration status should be deemed protected health information (PHI) under the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule. A legal argument, supported by clinical data, is offered that immigration status should be regarded as PHI not subject to valid exception for release without patient authorization. This argument concludes that covered entities (eg, hospitals and health care professionals) are legally precluded under the HIPAA Privacy Rule from disclosing a patient's immigration status.

When Is it OK to Communicate With My Adult Patient’s Caregiver?

Back to table of contents Previous article Next article Legal NewsFull AccessWhen Is it OK to Communicate With My Adult Patient’s Caregiver?Moira Wertheimer,J.D., R.N.Moira Wertheimer,Search for more papers by this authorJ.D., R.N.Published Online:24 Feb 2017https://doi.org/10.1176/appi.pn.2017.3a23AbstractConsider the following case example and whether the Health Insurance Portability and Accountability Act (HIPAA) permits a health care provider to disclose information without patient consent to a patient’s family and/or caregivers:You have been treating Mrs. B for depression for several years. She is 32 years old, married with two children, and recently lost her job. She also has been having marital difficulties. Her husband has not been involved in treatment, and Mrs. B did not provide consent to speak with her husband or other family members. Recently, Mrs. B had been staying at her sister’s apartment and was found unresponsive lying next to an empty prescription bottle and brought to the local emergency department. The bottle of pills found next to her had your name on it, and the attending physician calls you upon Mrs. B’s arrival. The attending physician indicates that he left messages for both Mrs. B’s husband and sister. You would like to follow up with them as well to ensure appropriate follow-up is planned. Are you permitted to call Mrs. B’s husband and/or sister? As was covered in an earlier column (Psychiatric News, June 17, 2016), HIPAA recognizes the vital role that family and friends can play in a patient’s health care, and allows some communication between health care providers and some third parties. Under certain conditions, such communication can occur without prior patient consent. According to guidance issued by the Department of Health and Human Services (HHS), the HIPAA Privacy Rule permits a health care provider to disclose protected health information without prior patient consent when the patient is not present or is unable to agree or object to a disclosure due to incapacity or emergency circumstances, if the health care provider determines that the disclosure is in the best interests of the patient. If a provider determines that such a disclosure is in the patient’s best interest, the provider is permitted to disclose only that protected health information that is directly relevant to the person’s involvement in the patient’s care or payment for care. In making this determination about the patient’s best interests, the health care provider should take into account the patient’s prior expressed preferences regarding disclosures of their information, if any, as well as the circumstances of the current situation. Thus, in the case example described above, Mrs. B’s written authorization is not required to make disclosures to notify, identify, or locate her family members, personal representatives, or other persons responsible for the patient’s care. However, once Mrs. B regains the capacity to make these choices for herself, the health care provider should offer the patient the opportunity to agree or object to any future sharing of her information.On the other hand, if Mrs. B is alert and has capacity to make health care decisions, the health care provider may disclose protected health information for notification purposes only if the patient agrees or, when given the opportunity, the patient does not object. Keep in mind, however, that even if a patient objects to disclosing information, HIPAA does permit health care providers to receive information from family members or other caregivers regarding the patient. While there are no easy answers, HHS addresses issues concerning HIPAA and mental health in detail on its website.In addition to HIPAA, please remember that state privacy laws must also be considered when determining whether a particular disclosure is permitted. You should always contact your local attorney or risk management professional with any questions regarding whether a certain disclosure is allowed. ■Allied World, through its subsidiaries, is a global provider of innovative property, casualty, and specialty insurance and reinsurance solu-tions. Allied World is the APA-endorsed carrier for the professional liability program through its strategic relationship with the American Profes-sional Agency Inc., the program administrator. This information is provided as a risk manage-ment resource and should not be construed as legal, technical, or clinical advice. Consult your professional advisors or legal counsel for guid-ance on issues specific to you. This material may not be reproduced without the permission of Allied World. Risk management services are pro-vided by or arranged through AWAC Services Company, a member company of Allied World.Moira Wertheimer, J.D., R.N., is assistant vice president of the Psychiatric and Healthcare Risk Management Group of AWAC Services Co., a member company of Allied World. ISSUES NewArchived

Study on National Protected Health Information for Secondary Use and De-identification

Recently the interest in secondary use of medical information has emerged. But the domestic legislation or guidelines, such as being able to say that already specialize in healthcare information, can be seen a 'national medical privacy guidelines'. However the guidelines have suggested that only a violation of privacy laws in the medical information, it does not defined clearly with respect to protected health information(PHI) for secondary use. In this paper, we learn the HIPAA(Health Insurance Portability and Accountability Act) Privacy Rule of the US legislation which provides a non-identifiable screen instructions for secondary utilization of medical information, domestic guidelines and other country's guidelines. comparing with the HIPAA, national medical privacy guidelines and the domestic studies, we propose a new domestic target non-identifying information suitable for the domestic field and present future research direction.

Can I Communicate With My Adult Patient’s Caregiver?

Back to table of contents Previous article Next article Legal NewsFull AccessCan I Communicate With My Adult Patient’s Caregiver?Moira Wertheimer,J.D., R.N.Moira Wertheimer,Search for more papers by this authorJ.D., R.N.Published Online:24 Jun 2016https://doi.org/10.1176/appi.pn.2016.6b12AbstractCaregivers (who many times are family/friends/guardians) of adult individuals with mental illness can play a vital role in the patient’s psychiatric treatment, often providing important background information that may not be gleaned from an in-office visit, such as information related to patient compliance and troubling behavior patterns, as well as providing physical care and support for the patient. A recent study, however, indicated that a large percentage of these caregivers felt excluded from the patient’s care because health care providers refused to discuss the patient’s condition with them due to concerns about violating federal/state privacy laws.Generally, under the Health Insurance Portability and Accountability Act (HIPAA) and state privacy laws, although providers can always receive information about their patients, they cannot disclose patient information without patient consent, particularly mental health/substance use information. Under certain circumstances, however, the HIPAA privacy rule recognizes the integral role that family and friends play in a patient’s health care, and allows routine—and often critical—communications between health care providers and some third parties. While there are no easy answers, the Department of Health and Human Services addresses these situations and answers the following questions in detail about HIPAA and mental health on its website at http://www.hhs.gov/hipaa/for-professionals/special-topics/mental-health/.Does HIPAA allow a health care provider to communicate with a patient’s family, friends, or other persons who are involved in the patient’s care?Is a health care provider permitted to discuss an adult patient’s mental health information with the patient’s parents or other family members?When does mental illness or another mental condition constitute incapacity under the privacy rule? For example, what if a patient who is experiencing temporary psychosis or is intoxicated does not have the capacity to agree or object to a health care provider’s sharing information with a family member, but the provider believes the disclosure is in the patient’s best interests?If a health care provider knows that a patient with a serious mental illness has stopped taking a prescribed medication, can the provider tell the patient’s family members?What options do family members of an adult patient with mental illness have if they are concerned about the patient’s mental health and the patient refuses to agree to let a health care provider share information with the family?Remember that state privacy laws apply and often require more stringent protections than HIPAA; thus, it is important for you to be aware of all applicable laws. Please note also that “psychotherapy notes” as defined and maintained under HIPAA receive a heightened level of protection from disclosure and may not be disclosed without patient authorization.Before disclosing patient information to an adult patient’s caregiver, psychiatrists should keep in mind the following risk management considerations: Know your state’s laws regarding patient privacy in addition to HIPAA. Understand your state’s duty to warn laws.Seek the assistance of an attorney in the state in which you practice to develop policies and guidelines for sharing and/or releasing patient information to third parties. Inform patients at the outset of your policy on communicating with others and under what circumstances that would occur. Obtain necessary consents, if possible, at the outset of treatment.Lawful communication with an adult patient’s caregivers can often help psychiatrists deliver quality care and is not necessarily prohibited by federal and state privacy laws. Psychiatrists should understand their obligations under applicable privacy laws and should consult their local attorney or risk management professional before disclosing information without the patient’s or legal guardian’s consent. For other risk management topics, please see the online risk management courses available on APA’s Learning Center risk management page. ■This information is provided as a risk management resource and should not be construed as legal, technical, or clinical advice. This information may refer to specific local regulatory or legal issues that may not be relevant to you. Consult your professional advisors or legal counsel for guidance on issues specific to you. This material may not be reproduced or distributed without the express, written permission of Allied World Assurance Company Holdings, AG (“Allied World”). Risk management services are provided by or arranged through AWAC Services Company, a member company of Allied World.Moira Wertheimer, J.D., R.N., is assistant vice president of the Psychiatric Risk Management Group of AWAC Services Company, a member company of Allied World. ISSUES NewArchived