HIPAA Privacy Rule: Rights, Breaches, and Compliance in Healthcare Law — Flashcards

The HIPAA Privacy Rule (45 CFR Part 160, 164) regulates the use and disclosure of Protected Health Information (PHI) by covered entities in the U.S., granting patients rights to access, amend, and receive notice of privacy practices. It requires strict security, training, and breach notification (within 60 days) to the HHS and individuals. 

Key Patient Rights
Access/Copies: Individuals have the right to examine and obtain copies of their health records.
Amendments: Patients can request corrections to incomplete or inaccurate PHI.
Privacy Notices: Patients must receive a notice of privacy practices from providers.
Accounting of Disclosures: Individuals can request a list of certain disclosures made by the entity, typically over the past 6 years.
Authorization: Written permission is generally required before sharing PHI for reasons outside of treatment, payment, or healthcare operations. 

Breach Notification and Definitions
Definition: A breach is an impermissible use or disclosure of unsecured PHI, presumed to be a breach unless a low-probability risk assessment is proven.
Notification Protocol: Covered entities must notify affected individuals and the HHS Secretary within 60 days of discovering a breach.
Media Notice: If a breach affects more than 500 residents of a state or jurisdiction, prominent media outlets must be notified. 

Compliance and Enforcement
Covered Entities: Providers, health plans, and clearinghouses must implement administrative, physical, and technical safeguards (including encryption) to protect PHI.
Business Associates: Third-party vendors handling PHI must also comply with HIPAA.
Penalties: Violations can result in civil penalties ranging from $100 to $50,000+ per violation, with an annual cap of $1.5 million for repeat or willful neglect. Criminal violations can lead to jail time. 

Common Violations
Failure to perform a risk analysis.
Lack of employee training.
Unencrypted, stolen laptops or mobile devices.
Impermissible disclosure of information (e.g., to unauthorized individuals).