View source for LII:HIPAA Compliance - LII 007 03. What Data Are Protected & General Privacy Principle

__NOTOC__
==PHI per Privacy Rule==
[[File:People.jpg|right|400px]]At the center of all of [[HIPAA]] and [[HITECH]] is a single term and its definition: '''PHI''' or '''protected health information'''. This is the information that can be linked to a patient and has been identified by the U.S. government as being private to a patient, and as such it is protected by both the Privacy Rule and Security Rule of HIPAA, as well as HITECH (for electronic PHI). These protections exist so that unauthorized sharing is prevented or at least minimized, and access is controlled, with significant sanctions and measures available to be applied in the even of breaches.

The [[United States Department of Health and Human Services]] (HHS) and the Privacy Rule define PHI in the following way<ref name="HHSPrivacy">{{cite web |url=http://www.hhs.gov/hipaa/for-professionals/privacy/laws-regulations/index.html |title=Summary of the HIPAA Privacy Rule |publisher=U.S. Department of Health and Human Services |accessdate=9 June 2016}}</ref>:

<blockquote>The Privacy Rule protects all "individually identifiable health information" held or transmitted by a covered entity or its business associate, in any form or media, whether electronic, paper, or oral. The Privacy Rule calls this information "protected health information (PHI)."

“Individually identifiable health information” is information, including demographic data, that relates to:

: ▪ the individual’s past, present or future physical or mental health or condition,
: ▪ the provision of health care to the individual, or
: ▪ the past, present, or future payment for the provision of health care to the individual,

and that identifies the individual or for which there is a reasonable basis to believe it can be used to identify the individual.</blockquote>

According to the Privacy Rule, PHI does NOT include employment records that a covered entity maintains in its capacity as an employer, and education and certain other records subject to, or defined in, the Family Educational Rights and Privacy Act, 20 U.S.C. §1232g.<ref name="HHSPrivacy" />

HIPAA lists 18 identifiers that qualify as PHI, and as such must be kept secure and private in the ways that are set down in HIPAA and HITECH. These identifiers are<ref name="45CFR164">{{cite web |url=http://www.ecfr.gov/cgi-bin/text-idx?SID=064b73f83337b74b8dc8e9c7ed2a508b&mc=true&node=se45.1.164_1514&rgn=div8 |title=Electronic Code of Federal Regulations, Title 45, Subtitle A, Subchapter C, Part 164, Subpart E |publisher=U.S. Government Publishing Office |accessdate=9 June 2016}}</ref>:

# names
# all geographical subdivisions smaller than a state, including street address, city, county, precinct, zip code, and their equivalent geocodes, except for the initial three digits of a zip code, if according to the current publicly available data from the Bureau of the Census: (1) The geographic unit formed by combining all zip codes with the same three initial digits contains more than 20,000 people; and (2) The initial three digits of a zip code for all such geographic units containing 20,000 or fewer people is changed to 000
# all elements of dates (except year) for dates directly related to an individual, including birth date, admission date, discharge date, date of death; and all ages over 89 and all elements of dates (including year) indicative of such age, except that such ages and elements may be aggregated into a single category of age 90 or older
# phone numbers
# fax numbers
# electronic mail (email) addresses
# Social Security numbers
# medical record numbers (MRNs)
# health plan beneficiary numbers
# account numbers
# certificate/license numbers
# vehicle identifiers and serial numbers, including license plate numbers
# device identifiers and serial numbers
# web addresses or Uniform Resource Locators (URLs)
# Internet Protocol (IP) address numbers
# biometric identifiers, including finger and voice prints
# full face photographic images and any comparable images
# any other unique identifying number, characteristic, or code (note this does not mean the unique code assigned by the investigator to code the data)

There are also additional standards and criteria to protect individual's privacy from re-identification. Any code used to replace the identifiers in data sets cannot be derived from any information related to the individual and the master codes, nor can the method to derive the codes be disclosed. For example, a subject's initials cannot be used to code their data because the initials are derived from their name. Additionally, the researcher must not have actual knowledge that the research subject could be re-identified from the remaining identifiers in the PHI used in the research study. In other words, the information would still be considered identifiable if there was a way to identify the individual even though all of the 18 identifiers were removed.<ref name="HHSPrivacy" />

==De-identified PHI==
[[File:PHI.png|left|200px]]The government recognizes that there are instances where there is a need to use and/or transmit PHI. Since the key here is whether it can be used to identify the individual, HIPAA provides for two approved "de-identification" methods.

The first is the '''“Safe Harbor”''' approach, which permits a covered entity to consider data to be de-identified if it removes the 18 types of identifiers and has no actual knowledge that the remaining information could be used to identify an individual - ''either alone or in combination with other information''.<ref name="De-ID">{{cite web |url=http://www.hhs.gov/hipaa/for-professionals/privacy/special-topics/de-identification/2010-de-identification-workshop/index.html |title=Workshop on the HIPAA Privacy Rule's De-Identification Standard |publisher=U.S. Department of Health & Human Services |accessdate=9 June 2016}}</ref> 

The second method is the '''Statistical''' approach, which allows disclosure of PHI in any form provided that a qualified statistical or scientific expert concludes, through the use of accepted analytic techniques, that the risk the information could be used alone or in combination with other reasonably available information to identify the subject is very small (statistically insignificant).<ref name="De-ID" />
{{clear}}
==Privacy Rule: General principle for use/disclosure==
In general, to help in deciding when to disclose or not, it is useful to keep the Privacy Rule's purpose in mind: to define and limit the circumstances in which an individual’s protected heath information may be used or disclosed by covered entities. 

'''A covered entity may not use or disclose protected health information, except either:''' 
# as the Privacy Rule permits or requires; or
# as the individual who is the subject of the information (or the individual’s personal representative) authorizes in writing.

Similarly, there are only two cases where a covered entity is actually ''required'' to disclose PHI<ref name="HHSPrivacy" />:

# when the individual to whom the PHI applies (or authorized representative) requests it in writing; or
# when the HHS is undertaking a compliance investigation, review or enforcement action and requests it.

==References==
<references />

<!---Place all category tags here-->
[[Category:LabCourses material (all)‎]]
[[Category:LabCourses material on regulations and standards‎]]