“A neurologist arrives on a medical ward to perform a consultation. All the charts on the chart rack are turned facing the wall so that no names are visible on viewing it. He must then remove each one individually until he finds the name of the patient on the proper chart.” This example is provided in the NIH article HIPAA: A Flawed Piece of Legislation.
This action is a direct result of the confusion and over-caution brought on by HIPAA regulations. The ambiguity within these rules has led healthcare providers to take extreme measures to ensure compliance, even when such actions appear nonsensical or unnecessary. The NIH article further states, “Given the vagueness of this criterion and such potentially draconian punishments for any breach in confidentiality, it is no wonder that many health care providers were driven by paranoia to the kinds of absurdities in behavior described above.”
According to the Department of Health and Human Services (HHS), “The minimum necessary standard is based on sound current practice that protected health information should not be used or disclosed when it is not necessary to satisfy a particular purpose or carry out a function. The minimum necessary standard requires covered entities to evaluate their practices and enhance safeguards as needed to limit unnecessary or inappropriate access to and disclosure of protected health information. The Privacy Rule’s requirements for minimum necessary are designed to be sufficiently flexible to accommodate the various circumstances of any covered entity.”
45 CFR § 164.530(c) requires covered entities to implement appropriate administrative, technical, and physical safeguards to protect PHI, including measures for verbal communications. For example, safeguarding against disclosing PHI in a public space, or having clear protocols for ensuring that conversations involving PHI do not occur in environments where unauthorized individuals may overhear.
The HIPAA Security Rule divides implementation specifications into two categories: "required" and "addressable." While required specifications must be implemented, addressable ones allow organizations to:
Determining which third-party relationships qualify as business associates continues to challenge many healthcare organizations.
Section 164.514(a) of the HIPAA Privacy Rule provides the standard for de-identification of protected health information. Under this standard, health information is not individually identifiable if it does not identify an individual and if the covered entity has no reasonable basis to believe it can be used to identify an individual.
HIPAA provides two methods for de-identifying PHI: the Expert Determination Method and the Safe Harbor Method. However, both leave room for interpretation.
The Security Rule requires organizations to conduct a "thorough and accurate" risk analysis, but provides minimal specifics about methodology or frequency.
45 CFR § 164.506 outlines the conditions under which covered entities can disclose PHI for purposes related to health care operations without obtaining patient consent or authorization.
The regulation allows disclosures for broadly defined "health care operations," which creates challenges in interpretation.
Healthcare organizations can take several approaches to navigate HIPAA's ambiguities:
By implementing clear internal policies, training staff regularly, and seeking legal counsel for complex situations.
The Office for Civil Rights periodically issues guidance and may propose updates to clarify these gray areas.
Misinterpretation can lead to compliance violations, fines, legal actions, and damage to a provider's reputation.