HIPAA Rules
Privacy Rule: protects all individually identifiable health information (PHI). PHI includes: name, DOB, address, SSN, MRN, diagnosis, treatment, photos. Minimum necessary: only access/share PHI needed for the task. Security Rule: administrative, physical, technical safeguards. Breach Notification Rule: notify patients within 60 days, HHS if >500 individuals. Omnibus Rule: extends to business associates. HITECH: promotes EHR, strengthens enforcement. Penalties: up to $50,000 per violation, $1.5M per year per violation category.
Security Practices
Passwords: strong, unique, never share, change regularly. Secure logoff when leaving workstation. Screen privacy (position monitors, privacy filters). Lock computer when stepping away. No PHI on personal devices. Encrypt emails containing PHI. No PHI in text messages unless using secure app. Shred paper PHI. No PHI on social media (even de-identified — can be re-identified). Minimum necessary: only access records of patients you are caring for. No accessing records of family, friends, coworkers, VIPs without legitimate need. Audit trails track all access.
Breach Response
Report immediately to privacy officer/supervisor. Do not investigate alone. Preserve evidence. Notification: patient (60 days), HHS (if >500). Mitigation: offer credit monitoring if financial data involved. Investigation: root cause, corrective action. Sanctions: for intentional or negligent violations. Document: what happened, when discovered, who notified, actions taken. Education: retrain staff. Prevention: audit access, strengthen policies, improve technology. Common breaches: lost/stolen devices, misdirected faxes/emails, snooping, social media posts, unauthorized access.
Important Notes
- Accessing PHI without a legitimate care relationship is a HIPAA violation — never look up family, friends, coworkers, or VIPs out of curiosity.
- Secure logoff when leaving any workstation — unattended, logged-in computers are a primary source of HIPAA breaches.
Clinical Tips
- Never post patient information on social media — even de-identified — PHI can be re-identified from contextual details.
- Minimum necessary: only access the PHI needed for the specific task — curiosity browsing is a violation.
Summary
HIPAA compliance requires minimum necessary access, strong passwords, secure logoff, encrypted communication, and immediate breach reporting.
