The development and implementation of HIPAA's Privacy Rule

¶ … Privacy Rule

HIPAA Ethical Health Issue

H IPAA

A number of federal initiatives were attempted to protect the privacy of confidential personal information in the past many decades (HIPAA Specialists, 2005). The House of Representatives formed a Special Subcommittee on Invasion of Privacy in 1965. The former Department of Health, Education and Welfare published "The Code of Fair Information Practice Principles" in 1973 to set up a base for information privacy in the U.S. The principles became the basis for the ensuing federal Privacy Act of 1974. These principles would regulate government use of personal information by limiting disclosure; allow users access information about themselves; require federal agencies to specify the purpose for collecting personal information; and impose civil and criminal penalties for misuse. In the early 90s, the Bush administration discussed ways of reducing healthcare administrative costs with healthcare industry leaders. The industry leaders suggested an increased use of electronic data interchange within the industry. They later formed into the Workgroup for Electronic Data Interchange or WEDI. Its first co-chairmen were the presidents of the Blue Cross and Blue Shield Association and the Health Insurance Association of America, representing commercial insurers. The Workgroup conducted studies on the matter and later recommended the passage of federal legislation to insure consistent standards in all States. Many of its recommendations were adopted by the Clinton Health Plan, which, however, failed to pass. Other legislations also contained these recommendations. Former President Clinton finally signed the HIPAA into law on August 21, 1996 (HIPAA Specialists).

Pursuant to the Act, Congress enacted a medical privacy statute (HIPAA Specialists,

2005). It also called on the Secretary of Health and Human Services for recommendations on the protection of the confidentiality of healthcare information. In recognition of the importance of such standards, Congress gave the Secretary the authority to promulgate regulations on healthcare privacy in case lawmakers would not be able to act on this matter within the three years allotted by law (HIPAA Specialists).

The Reason and Importance of HIPAA

As abovementioned, HIPAA preserves workers' insurance coverage who change or lose their jobs; establishes security standards for electronically transmitted information among providers, insurance companies and employers; protects patient health information; requires patient information about their rights; and standardizes the disclosure of patient information. Simplifying, the reasons for implementing HIPAA are to reduce waste and fraud, increase efficiency, facilitate data analysis, and to insure privacy and security (Czaja, 2012).

HIPAA set forth standards for the storage, maintenance and electronic transmission of healthcare data between providers and insurance companies (Czaja, 2012). HIPAA's maintenance and electronic data transmission will increase privacy and security and thus reduce waste and fraud. The specialized software used is also expected to further standardize and speed up the information sharing process. This will increase efficiency and save time and materials. The Department of Health and Human Services projected an annual savings of $9billion, partly from the simplification of payments for medical services throughout the industry. A third reason is the facilitation of the compilation and analysis of health data as a result of standardization. This form will help research work on national health data. It will also enable the public to be better informed and understand healthcare issues better. And HIPAA Privacy Rule standardized process maintains patient information in confidentiality. Failure to do so will incur heavy penalties. Violating healthcare professionals who illegally leak out protected information can be fined up to $50,000 and a prison term of up to 1 year. If an economic motive is behind the leak, the fine can go up to $250,000 and the prison term to 10 years (Czaja).

Who are Covered

HIPAA Rules apply to all health plans, healthcare providers, and healthcare clearinghouses ()CR, 2003). Health plans include individual and group plans, who and which provide or pay the costs of medical care. Health plans include health, dental, vision and prescription drug insurers, health maintenance organizations, Medicare, Medicaid, Medicare-Choice and Medicare supplement insurers, and long-term care insurers. Employer-sponsored group health plans, government and church-sponsored health plans, and multi-employer health plans are covered as health plans. There are exceptions. A group health plan with less than 50 participants and administered only by the employer an exception. Government-funded programs whose principle function is other than to provide or pay for healthcare costs are another exception. A government-funded program, which directly provides health care, such as the community health center, or provides grants to finance healthcare, is also an exception. Insurance entities, which provide insurance for workers' compensation, automobile insurance and property and casualty insurance, are exceptions (OCR).

Statutory and Regulatory Bases

Sections 261 -- 264 require the Secretary of Health and Human Services to publicize these standards, collectively known as the Administration Simplification provisions (OCR, 2003). The Act also mandated the Secretary to issue privacy regulations for identifiable health information if Congress would not do so within 3 years from the passage of the Act. The Secretary complied with the mandate and developed a proposed rule, which was released for public comment on November 3, 1999. The Department received more than 52,000 public reactions. The Privacy Rule, the final regulation, was published on December 28, 2000. The Department published proposed modifications to the Privacy Rule and received 11,000 comments on these modifications. Final modifications were published in their final form on August 14, 2002 (Czaja).

State Laws

State laws, which are contrary to the Privacy Rule, are overridden by federal requirements (OCR, 2003). it, however, makes exemptions. These are State laws that relate to privacy of identifiable health information and provide greater privacy protection or rights to such information; provide for the reporting of disease or injury, child abuse, birth or death or for public health surveillance, investigation or intervention; and require particular health plan reporting for management or financial audits, for example. In addition, exception will be given if the State law meets any of set conditions. One is if the State law is necessary in preventing fraud and abuse relating to the payment of healthcare. Another is if the State law is necessary in insuring State regulation of insurance and health plans as authorized by statute or regulation. Another is if it is necessary for State reporting on healthcare delivery or costs. Still another is if it is necessary in meeting a compelling public health, safety or welfare need or the Secretary determines that the violation of privacy balances or justifies the need of the one served. And if the State law's principal purpose is to regulate the manufacture, register, distribute, dispense or control controlled substances or what are deemed to be controlled substances by the State law (OCR).

Enforcement and Penalties

HHS will help covered entities in complying with HIPAA rules (OCR, 2003). Affected entities or persons may file complaints with the HHS. The Privacy Rule also sets forth the responsibilities of these covered entities to provide appropriate data, records and compliance reports. They are also to cooperate with or allow the access to, investigation and compliance reviews of the particular information (OCR).

Civil monetary or criminal penalties may be imposed with the failure to comply with a requirement of the Privacy Rule (OCR, 2003). The civil penalty will not exceed $25,000 per year. There will be no civil monetary penalty if the failure is due to a reasonable cause or when no willful neglect is involved. But the failure must be corrected within 30 days from the time of notification of the violation. Criminal penalty will be imposed on a person who knowingly obtains and reveals identifiable health information and violates HIPAA Rules at a fine of $50,000 and up to 1 year imprisonment. The fine can increase to $100,000 and the imprisonment to 5 years if the violation involves false pretenses. The fine can go up to $250,000 and up to 10 years imprisonment if there is an intent to sell, transfer or use the information for commercial or personal gain or malicious harm. The Department of Justice enforces criminal sanctions (OCR).

Protected Information

Protected health information or PHI refers to all held or transmitted individually identifiable health data by a covered entity or its business association, contained in any form or medium -- whether electronic, paper or in oral form (OCR, 2003). These data are a person's past, present or future physical or mental health or condition; his or her healthcare provision; and his or her past, present or future payment for healthcare. The data must identify the person and other identifiers, such as address, birthday, and social security number (OCR).

Un-protected Health Information

Health information not protected by HIPAA Privacy Rule pertains to employment records kept or used by a covered entity as an employer (OCR, 2003). These are records of an individual's employment information, education or other records coming under the Family Educational Rights and Privacy Act. Neither is de-identified health information covered, and therefore unprotected, by HIPAA. This refers to health information that neither identifies nor provides an identifier of the person with that record or data. De-identification can be made either by a formal determination by a qualified statistician or by the removal of specific identifiers of the individual and his family, relatives, household members and employers. In this second case, the de-identification can be done only if the covered entity has o actual knowledge that the remaining information may be used in identifying the person (OCR).

Uses and Disclosures

A covered entity may not use or disclose protected health information except as the Privacy Rules permits or requires or it is authorized in writing by the individual or his or her representative (OCR, 2003).

Permitted Uses and Disclosures

A disclosure is permitted, but not required, without the individual's authorization, under certain circumstances (OCR, 2003). These are if the disclosure is made to the individual himself or herself; if it is part of the treatment or as basis for payment and healthcare operations; as an opportunity for the patient to agree or object; incidental use and disclosure; for the public interest and benefit; and limited data set. Public interest is involved and justifies the use and disclosure when it is required by law; as part of public health activities; for the benefit of victims of abuse, neglect or domestic violence; for health oversight activities; as inputs to judicial and administrative proceedings; for law enforcement purposes; for the use of funeral parlors or medical examiners in the identification of deceased persons; for the facilitation of donation and transplant of cadaver organs; for research; for serious threats to health and safety; and for essential government functions (OCR).

Authorized Uses and Disclosures

This is allowed when there is written and specific authorization of the individual involved (OCR, 2003). It is also allowed from psychotherapy notes without the person's authorization if the notes will be used for treatment or for use in training and court litigations. Protected health information may also be disclosed without authorization for marketing purposes in exchange for direct or indirect compensation for product endorsement (OCR).

Limiting Uses and Disclosures

The first limiting provision is that of minimum necessary (OCR, 2003). A covered entity must expend all effort and resources to acquire and reveal only the barest minimum information in order to satisfy its allowed purpose. When done, the covered entity may no longer use or disclose the data for another purpose. The second provision covers the access and uses of an allowed disclosure of the protected health data. The covered entity must develop and use policies and procedures, which will restrict the use of the data. Those who need the data must be identified through the policies and procedures. The provision on disclosures and requests for disclosures require policies and procedures for routine, recurring disclosures or requests for disclosures that will limit the amount of information to be used in fulfilling the allowed purpose. And the provision on reasonable reliance requires the covered entity to comply with the minimum necessary standard.

Requests that satisfy the minimum necessary standard may be from a public official, a professional, or a researcher needing it for documentation or representation for research (OCR).

Court Decisions

The OCR implements the HIPAA Privacy Rule in order to make people aware of privacy rights (Keilholtz, 2012). While it protects patient confidentiality, the Privacy Rule does not cover all situations. This clash brings about legal situations, which conflict with HIPAA provisions (Keilholtz).

One example is the Gunn v. Sound Shore Medical Center dated March 2003 (Keilholtz 2012). The complaint emanated from Donna Gunn, a resident of New York and a patient, who attended a cardiac physical therapy session at the hospital. She reported an injury on a treadmill during a session. She sued the hospital and demanded that it be ordered by the court to release the names of patients present in the same rehabilitation facility during the incident. The hospital refused to do so, citing HIPAA provisions, leading to the dismissal of the complaint. The court ruled that HIPAA provides that the disclosure of the identity of other patients would violate the physician-patient privilege and was, therefore, not permitted (Keilholtz).

Another example is the Hutton v. City of Martinez case also in 2003 (Keilholtz, 2012). This involves the police shooting. The case was filed by the injured man against the police officer. The policeman claimed that he fired at the man because he could not physically come after him. The injured man requested a review of the officer's medical records. The judge granted the requests and ordered for the police officer's workers' compensation health records. The judge justified the opening of the defendant's medical records. He stressed that HIPAA does not preclude the production of the records and compensation files in response to a discovery request, subpoena, or a court order "under a protective order." HIPAA's privacy rules are, therefore, only a guideline to uphold patient information without a guarantee of confidentiality (Keilholtz).

A third example is the Law v. Zuckerman (Keilholtz, 2012). HIPAA can also clash against State laws. In 2004, a federal court had some trouble deciding if a meeting between a defense lawyer and the physician of a patient violated that patient's privacy law rights. The court initially ruled that the meeting did not break the law but later reversed this rule. The decision must be on which, between HIPAA and the Maryland State law was the more inflexible and therefore must dominate. The judge later ruled that HIPAA was the more inflexible. It stated that a privacy waiver is not allowed because of inferred consent. The judge then ruled that patient consent is inferred by the filing of the lawsuit by plaintiffs. He did not see inferred consent satisfied the intended purpose of HIPAA (Keilholtz). #