HIPAA resource center

HIPAA applies only to protected health information (PHI). Not all health information is PHI. For information to be PHI, it must contain both a) an identifier tying it to the patient, and b) clinical or diagnostic information. Clinical or diagnostic information simply refers to the type of information you find in a health record, such as vitals and physician notes, but also labs and radiology results. An identifier is any piece of information that could uniquely identify an individual patient.

Under federal law, patients have a civil right to privacy. As a result, all staff must take care to protect patient privacy. Patient confidentiality must be protected whether in electronic, physical, or verbal communications.

Generally, patients have to give their permission for PHI to be disclosed, but PHI may be shared from physician to physician without explicit consent if it is for treatment, payment, or operations. To give an example, if one doctor consults with another about a patient’s treatment, they do not need the patient’s written consent. However, marketing materials or social media posts must never disclose PHI without the patient’s explicit consent.

If patients request a copy of their health records, clinicians must provide the copy as soon as possible, but always within 30 days. Providers are allowed to charge for copies of health records. However, they can only charge for the actual costs of reproduction. The laws for copying medical records vary by state. Check the most current fees for each state. 

The first time a patient visits a provider, they should receive a Notice of Privacy Practices (NPP). The NPP explains when and how patient information will be used, identifies the organization’s privacy officer, and explains how to contact HHS with complaints. HHS has provided free NPP templates.  

Your practice must also designate a privacy officer to oversee compliance and serve as a point of contact on privacy matters, both for patients and staff. In smaller organizations, this role is usually assigned to a staff member who has other responsibilities. The privacy officer should receive some additional training in HIPAA requirements and their role.