Office of Civil Rights Provides Guidance on HIPAA Privacy Rule

By Mike McLafferty

E-mail Story Print Story

• Gives patients more control over their health information;
• Sets boundaries on the use and release of health records;
• Establishes appropriate safeguards that health-care providers and others must achieve to protect the privacy of health information;
• Holds violators accountable, with civil and criminal penalties that can be imposed if they violate patients’ privacy rights;
• Strikes a balance when public responsibility supports disclosure of some data (e.g., to protect public health);
• Enables patients to find out how their information may be used, and how certain disclosures of their information may have been made;
• Limits release information to the minimum reasonably needed for the disclosure’s purpose;
• Gives patients the right to examine and obtain a copy of their own health records and to request corrections; and
• Empowers individuals to control certain uses and disclosures of their health information.

• Notify patients about their privacy rights and how their data can be used;
• Adopt and implement privacy procedures for its practice, hospital, or plan;
• Train employees so that they understand the privacy procedures;
• Designate a responsible individual to see that privacy procedures are adopted and followed; and
• Secure patient records containing individually identifiable health information so that they are not readily available to those who do not need them.