Where does HIPAA apply?

The HIPAA privacy rule applies to almost every department in a medical facility, even when walking to the parking lot with a colleague or on your home internet, the confidentiality of PHI must be preserved. Only the bare minimum health information that is necessary should be disclosed during any health care service, and this also includes human resources or ancillary services. For example, when a pharmacist is about to dispense medication to a patient, he or she should only ask the patient if they know how to take the pill when to take the pill, and to follow up with their healthcare provider. No in-depth discussion with the patient in full view of other people is permitted. This rule also applies to other healthcare providers who may be exchanging information with other healthcare workers who are also actively involved in patient care. For example, it is permitted for a radiologist to ask the ordering medical resident a few questions about why the patient is having the test to ensure that the procedure is necessary and the best choice for the situation, but he or she is not at liberty to discuss this with a third party who is not actively treating the patient. In all such matters, one must first obtain consent from the patient to determine if he or she is willing to permit the doctor to divulge medical information to others. This rule not only applies to verbal communication but all written and electronic text.[10][11][12]

In addition to HIPAA, many states have their own restrictive rules on the privacy of PHI, which may be far more stringent than HIPAA, particularly when the information concerns patients with infectious diseases like HIV, mental health problems, certain genetic disorders, and substance abuse. Further, there are also federal rules that are more stringent than HIPAA, such as those pertaining to substance abuse and drug addiction records. However, this does not mean that HIPAA is void when other more stringent rules are in place. In situations where a more stringent rule regarding privacy is in place, the more stringent rule will take precedence over HIPAA for that jurisdiction. All healthcare workers must be aware of both HIPAA and the state and federal rules that govern PHI.

Contents and Authorizations

When a patient is admitted to a healthcare institution, he or she must be provided with the information on rights to privacy, what type of PHI will be shared, and for what reason. This notice of privacy practice is now a requirement of HIPAA for all patients, regardless of age or gender. The patient must sign this document, and one copy must be kept in the hospital files. This also indicates that the patient did receive the privacy notice. If for any reason, the patient cannot sign, the reason must be documented and witnessed. If another person signs the document, the reason why the individual is signing must be documented. Once a notice of privacy practices is signed, the healthcare institution does not need to ask the patient repeatedly for disclosure of PHI in the course of normal care. If the patient’s health situation changes or the patient has additional privacy concerns, this should be documented in the note. The patient may ask that no family member or friend is permitted to pick up his or her medications or that none of the medical staff discuss the health condition with family or friends.