The final rule effectively sets a minimum floor for privacy protection.The final rule preempts state privacy laws that are contrary to it, i.e., a covered entity would find it impossible to comply with both the state and federal requirements.[5]A state enacting contrary privacy protections must request an exception form the Office for Civil Rights (OCR) at DHHS to avoid preemption.[6]States are permitted to enact privacy protections that are consistent with, but more stringent than, the final rule.[7]The critical issue in preemption is the interpretation of "contrary" and more stringent," both terms defined in the final rule.[8]

To improve the privacy and security of health information, the final rule reflects five basic principles: boundaries, consumer control, public responsibility, security, and accountability.

Boundaries

The final rule protects protected health information (PHI) and applies to covered entities. PHI means individually identifiable health information.[9]Individually identifiable health information does not include health information that has been properly de-identified.[10] Covered entities include the following: health plans, health care clearinghouses, and health care providers who transmit health information in electronic form with a transaction.[11]Although business associates are not covered entities,[12] covered entities may only disclose PHI to business associates with satisfactory assurances by the business associates to safeguard the information[13] and documentation of those assurances.[14]Also, the final rule addresses covered entities with special organizational structures including hybrid entities,[15] affiliated entities,[16] group health plans,[17] and covered entities with multiple covered functions.[18]

Covered entities must make reasonable efforts to limit the use, disclosure, or request of PHI to the minimum necessary to accomplish the intended purpose of the use, disclosure, or request.[19]The "minimum necessary" standard does not apply to disclosures to or requests by health care providers for the purpose of treatment, however.[20]With a few exceptions,[21] covered entities must treat personal representatives as the individual.[22] Covered entities must also protect the PHI of deceased individuals.[23]

Consumer control

Consent

A covered health care provider must obtain an individual's consent prior to using or disclosing his or her PHI to carry out treatment, payment, or health care operations.[24]Only under very limited circumstances may a covered health care provider use or disclose PHI without prior consent,[25] but even then, the provider must document its attempt to obtain consent and give reason why consent was not obtained.[26]Consent is not required prior to treatment when an indirect treatment relationship exists with the individual[27] or where the individual is an inmate.[28]Consent to use or disclose PHI is limited to the covered entity that obtains it[29] and is subject to revocation.[30]A valid consent requires several elements including plain language.[31]Finally, a covered health care provider or health plan may condition treatment or enrollment on consent by the individual.[32]

Authorization

Generally for those situations outside of treatment, payment, or health care operations,[33] authorization is required before a covered entity is permitted to use or disclose PHI.[34] The content of the authorization must contain several core elements including plain language[35] and an expiration date or event.[36]Like consent, authorization is subject to revocation.[37]Unlike consent, one covered entity may request authorization from another covered entity to access PHI for purposes of treatment, payment, or health care operation if certain requirements are met.[38]Also, a covered entity may not condition treatment or enrollment on the provision of authorization except for a few instances.[39]Finally additional rules apply to authorizations for research-based treatment.[40]

It is possible that conflicting consents and authorizations exist for use and disclosure of PHI to carry out treatment, payment, or health care operations.In this case, the more restrictive consent, authorization, or written legal permission controls;[41] or the individual may resolve the conflict by either giving new consent or communicating the individual's preference.[42]

Opportunity to Object

In certain situations such as maintaining a directory of individuals in the facility[43] or notifying family members of the individual's care,[44] PHI may be used or disclosed without consent or authorization by the individual.The individual must be informed in advance and have the opportunity to agree, prohibit, or restrict the use or disclosure.[45]

Right to Notice

An individual has the right to adequate notice from the covered entity as to the use and disclosure of his or her PHI as well as the individual's rights and the entity's duties with respect to that information.[46]Important elements required in the notice are permissible uses and disclosures,[47] a statement of the individual rights,[48] a statement of the covered entity's duties,[49] and a procedure for filing a complaint.[50]Specific requirements apply to health plans[51] and health care providers,[52] and for electronic[53] and joint notices.[54]

Right to Request Restrictions

An individual has the right to request restrictions on the use and disclosure of his or her PHI.[55]The individual also has a right to request that communications concerning PHI between the health care provider and the individual remain confidential.[56]

Right to Access

An individual has the right to access his or her PHI in a designated record set for purposes of inspection, copying, or both.[57]Exception to the right of access include psychotherapy notes,[58] information compiled in anticipation of a legal proceeding,[59] and PHI subject to the Clinical Laboratory Improvements Amendments.[60]Grounds for which a covered entity may deny individual access are either reviewable[61] or unreviewable.[62]If the covered entity allows the individual access, the provision of access must be timely[63] and fees associated with copying the information must be reasonable and cost-based.[64]If access is denied, the covered entity must provide the individual a timely written basis for denial [65] and the opportunity to have the denial reviewed by an independent licensed health care professional.[66]

Right to Amendments

An individual has the right to amend his or her PHI in a designated record set.[67]The covered entity may deny an individual's request on several grounds.[68]Requests for amendments must be acted upon in a timely manner.[69]If accepted, the covered entity must timely inform the individual[70] and others.[71]If denied in whole or in part, the covered entity must provide the individual with a timely written denial using plain language,[72] provide the individual an opportunity to submit a written statement disagreeing with the denial,[73] and keep the records of all documents.[74]

Right to an Accounting

An individual has a right to an accounting for disclosures of his or her PHI made by the covered entity in the past 6 years prior to the date of the request.[75]However, there is no right to receive an accounting of disclosures of PHI used to carry out treatment, payment and health care operations.[76]Other exceptions exist[77] and limitations apply.[78]Specific requirements for the content,[79] provision,[80] and documentation[81] of the accounting must be followed.

Public Responsibility

Covered entities may use or disclose PHI without the consent, authorization, or the opportunity to agree or object by the individual in limited situations.[82]Use and disclosure is permitted in situations concerning public health activities;[83] victims of abuse, neglect or domestic violence;[84] health oversight activities;[85] judicial and administrative proceedings; [86] law enforcement;[87] decedents;[88] cadaveric organ, eye or tissue donation;[89] research;[90] serious threats to health or safety;[91] specialized government functions;[92] workers' compensation,[93] and when required by law.[94]

Security

The final rule places the responsibility of safeguarding PHI on covered entities.[95] The covered entity must train members of its workforce on privacy protection procedure.[96]A privacy officer must be designated to ensure the procedures are followed,[97] to impose sanctions for violations,[98] and to mitigate the harmful effects of violations.[99] A grievance process must be in place to address complaints;[100] further, the covered entity may not take retaliatory action against patients and other individuals in the grievance process.[101]A covered entity must have policies and procedures that work to protect privacy[102] and they must be in writing.[103]Also, if use or disclosure is done for underwriting and related purposes, proper verification requirements must be followed.[104]More guidance will be available on the issue of security when the final security rule is published.[105]

Accountability

The final rule applies the standards included in HIPAA to create specific federal penalties for the improper use or disclosure of protected health information.Civil penalties are up to $25,000 per person per year.Criminal penalties are up to $250,000 and up to 10 years in prison.The Secretary has delegated authority to enforce the privacy regulations to the Office for Civil Rights at DHHS.