HIPAA Basics
A patient's name, address, Social Security number, and other identifiers can turn ordinary health information into this protected category.
Protected Health Information (PHI)
“Hi, this is the doctor's office. Mr. Smith's test results are…” Whoa, whoa, whoa! Before leaving details, check the patient's preferences regarding this type of communication.
HIPAA consent to disclose PHI to a specific person, such as a family member or caregiver.
When it's time to say goodbye to paper PHI, use this secure disposal method.
Shredding
When a reportable HIPAA breach occurs, the clock is ticking! Generally, affected individuals must be notified without unreasonable delay and no later than this many days after discovery.
60 days
This was a BIG deal! Former UCLA cardiothoracic surgeon Huping Zhou was convicted of accessing the records of this actor and several others' without authorization.
Tom Hanks
Dr. Zhou ended up serving 4 months in federal prison.
The law that says your medical information deserves serious protection—no matter how interesting the gossip might be.
HIPAA (Health Insurance Portability and Accountability Act)
Before you ask, “Who gets to see my medical information?” check out this document, which explains how a healthcare organization may use, share, and protect your PHI.
Notice of Privacy Practices
Your coworker says, “Can I borrow your login? I just need to get in really quick.” Nice try! This should generally remain private and never be shared for convenience.
Password
Someone accesses, uses, acquires, or discloses PHI in a way HIPAA doesn't allow—and patient privacy or security is compromised. What do we call this trouble?
Breach
Oops! They did it again. This singer has been the victim of 2 separate HIPAA breaches (2005 and 2008). The second time happened during her psychiatric hospitalization at UCLA Medical Center.
Britney Spears
13 employees were fired and 6 were suspended for viewing her records without authorization.
HIPAA was signed into law the year President Bill Clinton was re-elected.
1996
HIPAA's version of “don't take more than you need.” This principle says staff should access, use, or disclose only the PHI necessary to accomplish the intended purpose.
Minimum necessary standard
Congratulations! You've won a free trip to Bora Bora! Or have you? Beware of getting “hooked” by this type of suspicious email.
Phishing
When patient privacy goes off the rails, these three categories of HIPAA violations can come into play—think paperwork problems, lawsuits, and serious corruption.
Administrative, civil, criminal
Employees at the Ronald Reagan UCLA Medical Center might have thought it was a "Thriller" to view this singer's records after his death in 2009.
Michael Jackson
The employees ended up being fired, and the hospital was fined $95,000.