HIPAA glossary for private practices

The Breach Notification Rule (45 CFR 164.400–414) requires covered entities to notify affected individuals, HHS, and sometimes the media after a breach of unsecured PHI. Notice to individuals is due without unreasonable delay and no later than 60 days from discovery. It applies to breaches occurring on or after September 23, 2009.

A business associate is a person or company that creates, receives, maintains, or transmits protected health information on behalf of a covered entity, other than as a member of its workforce (45 CFR 160.103). Common examples: an EHR vendor, a billing service, a cloud backup, or an email provider that touches patient data.

A Business Associate Agreement (BAA) is the written contract a covered entity must have with any vendor that handles PHI on its behalf. Under 45 CFR 164.502(e) the covered entity must obtain satisfactory assurances the vendor will safeguard the data, and 45 CFR 164.504(e) sets the clauses the contract must contain.

A covered entity is a health plan, a health care clearinghouse, or a health care provider who transmits any health information in electronic form in connection with a HIPAA transaction (45 CFR 160.103). For a private practice the trigger is the electronic transaction, most often an insurance claim, not the act of seeing patients.

The minimum necessary standard requires that when a covered entity or business associate uses, discloses, or requests PHI, it makes reasonable efforts to limit the information to the minimum needed for the purpose (45 CFR 164.502(b)). It does not apply to treatment disclosures between providers or to disclosures to the individual, among other exceptions.

A Notice of Privacy Practices (NPP) is the document a covered entity must give patients describing how it uses and discloses their PHI and their rights over it. Under 45 CFR 164.520 the individual has a right to adequate notice, and providers with a direct treatment relationship must give it at first service, post it, and put it online.

Protected health information (PHI) is individually identifiable health information a covered entity or business associate holds or transmits in any form, electronic, paper, or oral. Under 45 CFR 160.103 it excludes education records governed by FERPA, employment records held by an employer, and information about someone deceased more than 50 years.

A Security Risk Analysis (SRA) is HIPAA’s required, documented assessment of the risks and vulnerabilities to the electronic PHI a practice holds. Under 45 CFR 164.308(a)(1)(ii)(A) it must be an accurate and thorough assessment of potential risks to the confidentiality, integrity, and availability of ePHI. It is the single most-cited deficiency in OCR enforcement.