The HIPAA Privacy Rule explained

Who the Privacy Rule applies to

Business associates must sign a business associate agreement and follow applicable HIPAA requirements. See what is HIPAA compliance for the bigger picture, including the Security Rule.

To record clock-ins, breaks and overtime automatically, see EZTime time and attendance software.

What protected health information is

PHI is individually identifiable health information held or transmitted by a covered entity or business associate, in any form: paper, electronic or spoken. It includes information about a person’s past, present or future health, care or payment for care that identifies them or could reasonably be used to identify them, such as names, addresses, dates, phone numbers, record numbers and photos linked to health information.

Employment records a covered entity holds in its role as employer, such as sick leave notes in a personnel file, are generally not PHI under HIPAA, although other laws, such as the ADA and FMLA, require medical information about employees to be kept confidential.

Permitted uses and disclosures

• Treatment, payment and healthcare operations: generally allowed without patient authorization.
• To the patient: patients can access their own information.
• With an opportunity to agree or object: for example, sharing with family members involved in care in appropriate circumstances.
• Certain public interest purposes: such as some public health reporting, abuse reporting, law enforcement and court orders, under specific conditions.
• With written authorization: required for most other uses, such as most marketing.

The minimum necessary standard

For most uses and disclosures other than treatment, covered entities must make reasonable efforts to use, disclose or request only the minimum PHI needed for the purpose. In practice, this means role-based access: a receptionist needs scheduling information, not full clinical notes; a billing clerk needs billing details. Set access by role and review it when roles change.

Patient rights

What covered entities must put in place

1. Written privacy policies and procedures.
2. A designated privacy official and a contact for complaints.
3. A Notice of Privacy Practices given to patients and posted where required.
4. Workforce training on policies and procedures; see HIPAA training for employees.
5. Administrative, technical and physical safeguards to protect PHI.
6. Sanctions for workforce members who violate policies.
7. A process for handling complaints and mitigating harm.
8. Business associate agreements with vendors that handle PHI.
9. Documentation kept for the required period, generally six years for required policies and records.

Everyday practices for small practices and home care

• Do not discuss patients in public areas or where others can overhear.
• Position screens away from waiting areas and lock computers when away.
• Use secure systems, not personal texting apps, for patient information.
• Keep paper records locked and shred them when disposing.
• Verify identity before sharing information by phone.
• Home care staff should keep care notes secure and not leave records in vehicles.
• Never post about patients on social media, even without names.

Most HIPAA problems in small organizations come from everyday habits, not sophisticated hacks. See what is a HIPAA violation for examples.

Handling patient access requests

Requests for records are one of the most common sources of patient complaints. Have a simple written process: who receives requests, how identity is verified, how the records are gathered and in what format they will be provided. Give patients their records in the form they ask for if it is readily producible, including electronic copies. Any fees must be reasonable and cost-based under HHS rules. Track each request against the deadline so none are forgotten.

Breaches

If unsecured PHI is improperly used or disclosed, the HIPAA Breach Notification Rule may require notifying affected individuals, HHS and, for large breaches, the media, within set time limits. Have an incident response plan so staff know to report suspected breaches immediately, and assess each incident promptly with your privacy official.

Training and accountability

Train every workforce member, including part-time, temporary and volunteer staff, when they join and when policies change, and keep records of training. Many organizations also run annual refreshers. Apply sanctions consistently when policies are broken. See healthcare employee training for building training into onboarding.

A simple compliance checklist for small practices

• A privacy official has been named and staff know who it is.
• Written privacy policies exist and have been reviewed in the past year.
• The Notice of Privacy Practices is current, given to patients and posted where required.
• Every workforce member has completed training, with records kept.
• System access is set by role and removed promptly when people leave.
• Business associate agreements are signed with vendors that handle PHI.
• There is a process for patient access requests that meets the time limits.
• Staff know how to report a suspected breach, and incidents are logged and assessed.
• Sanctions are applied consistently when policies are broken.

Review this list at least once a year and whenever you add a new system, vendor or location.

Common misunderstandings

• HIPAA does not stop providers from sharing information with other providers for treatment.
• HIPAA does not apply to every organization that holds health information; it applies to covered entities and business associates.
• Patients generally cannot be denied access to their records because of unpaid bills.
• Employers’ general employment records are usually governed by other laws, not HIPAA.

How EZTime helps

EZTime helps healthcare employers manage schedules, clock-ins and timesheets for clinical and home care staff without needing patient information in the timekeeping system. Learn more about EZTime for healthcare and EZTime for home care agencies.

Everyday privacy habits

See HIPAA training for employees.

Scheduling and timekeeping data

Scheduling apps and time clocks usually hold employee information rather than patient information. Avoid putting patient names or conditions in shift notes or schedules unless your systems and agreements are set up for PHI. Employment records held by a covered entity in its role as employer are not PHI under HIPAA, though other privacy laws may apply.

Your next 30 days

1. Confirm who your privacy official is.
2. Check that every workforce member has completed training.
3. Review how access requests are handled and timed.
4. Walk through your space for privacy risks.
5. Review breach response steps with your team.

Privacy Rule basics check

Tick each item already in place.

Frequently asked questions

Where to go next