HEALTH PROVISIONS · 5 MIN READ

HIPAA Privacy, Security, and Breach Notification

The HIPAA Privacy Rule governs when protected health information (PHI) may be used or disclosed. The default is simple: uses and disclosures beyond treatment, payment, and health care operations require the individual's written authorization. But the rule carves out permitted disclosures that need no authorization — categories that include disclosures required by law, public health reporting and surveillance, abuse and neglect reports, health oversight, judicial proceedings, law enforcement, organ donation, approved research, serious threats to health or safety, specialized government functions, and workers' compensation. Data can also escape the rule entirely by de-identification, accomplished two ways: the Safe Harbor method, which strips 18 categories of identifiers (names, geographic units smaller than a state, dates other than year, contact information, SSNs, record and account numbers, biometrics, full-face photos, and more — with one exception allowing the first three digits of a ZIP code if that ZIP3 area holds more than 20,000 people), or the Expert Determination method, where a qualified statistician documents a very small re-identification risk. A middle path, the limited data set, keeps some data elements but requires a data use agreement. The Security Rule requires administrative, physical, and technical safeguards for electronic PHI. The HITECH-era Breach Notification Rule then flipped the burden of proof on incidents: any impermissible use or disclosure of unsecured PHI is presumed a reportable breach unless the covered entity documents a low probability that the PHI was compromised, using a four-factor risk assessment — the nature and extent of the PHI, who received it, whether it was actually acquired or viewed, and how well the risk was mitigated. This replaced the older, softer 'significant risk of harm' standard. Enforcement runs through HHS's Office for Civil Rights, which audits covered entities and applies tiered civil penalties that scale with culpability — from lack of knowledge, through reasonable cause, up to willful neglect, with the harshest tier reserved for uncorrected willful neglect.