HIPAA does not state in any rule that the electronic transmission of PHI is prohibited. The protected health information can be in any form i.e., electronic, paper, or oral and includes images, charts, and any other characteristic including characteristics of family members maintained in the same data set that could be used either individually or together identify a patient or health plan member. HHS only gives a general definition of PHI in its Summary of the HIPAA Privacy Rule The Privacy Rule protects all individually identifiable health information held or transmitted by a covered entity or its business associate. HIPAA Journal's goal is to assist HIPAA-covered entities achieve and maintain compliance with state and federal regulations governing the use, storage and disclosure of PHI and PII. Figure 4. In general, the protections of the Privacy Rule apply to information held by covered entities and their business associates. The expert will attempt to determine which record in the data set is the most vulnerable to identification. A qualified expert may apply generally accepted statistical or scientific principles to compute the likelihood that a record in a data set is expected to be unique, or linkable to only one person, within the population to which it is being compared. Thereafter, HIPAA-covered entities are permitted, but not required, to use and disclose PHI for treatment, payment, and health care operations. HIPAA Advice, Email Never Shared Stakeholder input suggests that the determination of identification risk can be a process that consists of a series of steps. Delivered via email so please ensure you enter your email address correctly. For this reason, these services are considered business associates under HIPAA, and therefore must be HIPAA compliant for providers to use the service. No, because although names and telephone numbers are individual identifiers, at the time the individual calls the dental surgery there is no health information associated with them. (i) Applying such principles and methods, determines that the risk is very small that the information could be used, alone or in combination with other reasonably available information, by an anticipated recipient to identify an individual who is a subject of the information; and In a small town, where most everyone knows each other, calling patient names in a waiting room is not releasing PHI and is not a violation of HIPAA. The Census Bureau will not be producing data files containing U.S. OCR convened stakeholders at a workshop consisting of multiple panel sessions held March 8-9, 2010, in Washington, DC. (2) Relates to the past, present, or future physical or mental health or condition of an individual; the provision of health care to an individual; or the past, present, or future payment for the provision of health care to the individual; and All rights reserved. Unfortunately, there is no readily available data source to inform an expert about the number of 25 year old males in this geographic region. It does not incorporate information included in educational and employment records. Similarly, the age of a patient may be generalized from one- to five-year age groups. Utilizing 2000 Census data, the following three-digit ZCTAs have a population of 20,000 or fewer persons. This is because of a second condition, which is the need for a naming data source, such as a publicly available voter registration database (see Section 2.6). This means that the initial three digits of ZIP codes may be included in de-identified information except when the ZIP codes contain the initial three digits listed in the Table below. PHI stands for Protected Health Information and is any data that was degenerated, used, or disclosed during a patient's medical care. Finally, for the third condition, we need a mechanism to relate the de-identified and identified data sources. Postal Service (USPS) ZIP code service areas. No, she cannot be prosecuted for it. For e.g. This is because any individually identifiable health information created, received, maintained, or transmitted by a business associate in the provision of a service for or on behalf of a covered entity is also protected. Although HIPAA does not prohibit calling out patient names in the waiting room, names alone can reveal health information, especially in a highly specialized facility. HIPAA Protected Health Information, or PHI, is any personal health information that can potentially identify an individual, that was created, used, or disclosed in the course of providing healthcare services, whether it was a diagnosis or treatment. In truth, there are five 25 year old males in the geographic region in question (i.e., the population). At the same time, there is also no requirement to retain such information in a de-identified data set. Names; 2. In line with this guidance from NIST, a covered entity may disclose codes derived from PHI as part of a de-identified data set if an expert determines that the data meets the de-identification requirements at 164.514(b)(1). OCR does not require a particular process for an expert to use to reach a determination that the risk of identification is very small. Consequently, compliance experts refer to the "safe harbor" standard for the de-identification of PHI ( 164.514) to determine what is consider PHI. This document was brought to the world more than 20 years ago in 1996 when it wasn't even possible to imagine all of the modern technologies that are now involved in healthcare. However, in certain instances, the expert may not know which particular record to be disclosed will be most vulnerable for identification purposes. However, in recognition of the potential utility of health information even when it is not individually identifiable, 164.502(d) of the Privacy Rule permits a covered entity or its business associate to create information that is not individually identifiable by following the de-identification standard and implementation specifications in 164.514(a)-(b). Data managers and administrators working with an expert to consider the risk of identification of a particular set of health information can look to the principles summarized in Table 1 for assistance.6 These principles build on those defined by the Federal Committee on Statistical Methodology (which was referenced in the original publication of the Privacy Rule).7 The table describes principles for considering the identification risk of health information. For clarification, our guidance is similar to that provided by the National Institutes of Standards and Technology (NIST)29, which states: De-identified information can be re-identified (rendered distinguishable) by using a code, algorithm, or pseudonym that is assigned to individual records. Get our HIPAA Compliance Checklist to see everything you need to be compliant. And therefore the subject line did not have any of the identifiers and so no PHI, particularly within the context of the unlikelihood that someone could take these initials and somehow identify the patient with any reasonable likelihood of accuracy. Although PHI can be shared without authorization for the provision of treatment, when medical professionals discuss a patients healthcare, it must be done in private (i.e. In a healthcare environment, you are likely to hear health information referred to as protected health information or PHI, but what is considered PHI under HIPAA? Have expert determinations been applied outside of the health field? There are even criminal penalties for HIPAA violations; and claiming ignorance of the Rules is not a valid defense if you are found to have failed to protect health information under HIPAA law. That said, the EHR vendor should have a BAA signed for this very purpose. As a result, the event was reported in the popular media, and the covered entity was aware of this media exposure. What is many to many relationship in Salesforce? The HIPAA Privacy Rule details the permissible uses and disclosures of PHI. The other woman training me says never use their last name in public, use their first name (ie: calling out for Jill or Jim). 2.9 Can an Expert determine a code derived from PHI is de-identified? 1.3 De-identification and its Rationale If all identifiers are removed from the set, it ceases to be protected health information and the HIPAA Privacy Rule's restrictions on uses and disclosures no longer apply. If not, the form is invalid and any information released to a third party would be in violation of HIPAA regulations. Covered entities may include the first three digits of the ZIP code if, according to the current publicly available data from the Bureau of the Census: (1) The geographic unit formed by combining all ZIP codes with the same three initial digits contains more than 20,000 people; or (2) the initial three digits of a ZIP code for all such geographic units containing 20,000 or fewer people is changed to 000. In instances when population statistics are unavailable or unknown, the expert may calculate and rely on the statistics derived from the data set. A member of the covered entitys workforce is not a business associate. Basically, anything that could help someone determine a person's identity is considered PHI. Both methods, even when properly applied, yield de-identified data that retains some risk of identification. A person or entity that performs certain functions or activities that involve the use or disclosure of protected health information on behalf of, or provides services to, a covered entity. Though G Suite, email can be made HIPAA compliant provided the service is used alongside a business domain. 2.10 Must a covered entity use a data use agreement when sharing de-identified data to satisfy the Expert Determination Method? Zip codes can cross State, place, county, census tract, block group, and census block boundaries. Are initials PHI HIPAA? Question 1: When does a unique identifying number become PHI? When it comes to mailing patients' protected health information, it is imperative you follow HIPAA regulations. This standard consists of 18 specific identifiers: The acronym PHI stands for Protected Health Information, while the acronym ePHI stands for electronic Protected Health Information a subset of PHI that is subject to the safeguards of the HIPAA Security Rule as well as the HIPAA Privacy Rule. Health information relates to past, present, and future health conditions or physical/mental health that is related to the provision of healthcare services or payment for those services. As a result, an expert will define an acceptable very small risk based on the ability of an anticipated recipient to identify an individual. Table 6, as well as a value of k equal to 2, is meant to serve as a simple example for illustrative purposes only. These are the 18 HIPAA Identifiers that are considered personally identifiable information. The code or other means of record identification is not derived from or related to information about the individual and is not otherwise capable of being translated so as to identify the individual; and Clinical narratives in which a physician documents the history and/or lifestyle of a patient are information rich and may provide context that readily allows for patient identification. It does not provide sufficient detail in statistical or scientific methods to serve as a substitute for working with an expert in de-identification. Some of the methods described below have been reviewed by the Federal Committee on Statistical Methodology16, which was referenced in the original preamble guidance to the Privacy Rule de-identification standard and recently revised. 3.6 What is actual knowledge that the remaining information could be used either alone or in combination with other information to identify an individual who is a subject of the information? Answer: HIPAA permits the use of unique identifying numbers in a de-identified data set, provided that the recipient of the data (e.g., the researcher), has no access to the linking code and no means of re-identifying the data. Protected health information or PHI is often mentioned in relation to HIPAA and healthcare, but what is considered protected health information under HIPAA? When can ZIP codes be included in de-identified information? Initials _____ HIPAA Checklist for a Valid Authorization 164.508(c) (1) defines the following core elements for an authorization to disclose . Postal Service ZIP codes. Patient records should always be kept in a locked space so they can't be stumbled upon by others. At the same time, the Privacy Rule is balanced so that it permits the disclosure of personal health information needed for patient care and other important purposes. Encryption ensures that sensitive information remains secure. Entities related to personal health devices are not covered entities or business associates under HIPAA unless they are contracted to provide a service for or on behalf of a covered entity or business associate. However, the Rule does require that the methods and results of the analysis that justify the determination be documented and made available to OCR upon request. The HIPAA Privacy Rule protects most individually identifiable health information held or transmitted by a covered entity or its business associate, in any form or medium, whether electronic, on paper, or oral. In this case, the risk of identification is of a nature and degree that the covered entity must have concluded that the individual subject of the information could be identified by a recipient of the data. If an item containing PHI, such as a laptop or smartphone, is lost or stolen, that's also considered a HIPAA violation and can result in a hefty fine. Rare clinical events may facilitate identification in a clear and direct manner. De-identified health information created following these methods is no longer protected by the Privacy Rule because it does not fall within the definition of PHI. PHI means having any piece of identifying information linked with any type of clinical data -- e.g. Figure 4 provides a visualization of this concept.13 This figure illustrates a situation in which the records in a data set are not a proper subset of the population for whom identified information is known. As can be seen, there are many different disclosure risk reduction techniques that can be applied to health information. There is no specific professional degree or certification program for designating who is an expert at rendering health information de-identified. However, it could be reported in a de-identified data set as 2009. a health care provider that conducts certain transactions in electronic form (called here a "covered health care provider"). However, due to the publics interest in having statistics tabulated by ZIP code, the Census Bureau has created a new statistical area called the Zip Code Tabulation Area (ZCTA) for Census 2000. For instance, if such information was reported as part of a publicly accessible data source, such as a phone book, then this information would not be PHI because it is not related to heath data (see above). This standard consists of 18 specific identifiers: Names All geographic subdivisions smaller than a State All elements of dates (except year) for dates directly related to an individual. > For Professionals Is a patient name alone considered PHI? https://www.census.gov/programs-surveys/geography/guidance/geo-areas/zctas.html, https://www.hhs.gov/ocr/privacy/hipaa/understanding/coveredentities/index.html, https://www.hhs.gov/ocr/privacy/hipaa/understanding/coveredentities/businessassociates.html. This means that electronic records, written records, lab results, x-rays, and bills make up PHI. The expert may certify a covered entity to share both data sets after determining that the two data sets could not be merged to individually identify a patient. Steve has developed a deep understanding of regulatory issues surrounding the use of information technology in the healthcare industry and has written hundreds of articles on HIPAA-related topics. A higher risk feature is one that is found in many places and is publicly available. In the process, experts are advised to consider how data sources that are available to a recipient of health information (e.g., computer systems that contain information about patients) could be utilized for identification of an individual.8. Example Scenario 1 Under HIPAA, health information such as diagnoses, treatment information, medical test results, and prescription information, as well as national Additionally, other laws or confidentiality concerns may support the suppression of this information. Delivered via email so please ensure you enter your email address correctly. No. If the data set contains any limited identifiers, but none of the direct identifiers, it is considered a limited data set under HIPAA. (1) Is created or received by a health care provider, health plan, employer, or health care clearinghouse; and It notes that derivations of one of the 18 data elements, such as a patient's initials or last four digits of a Social . HIPAA Journal provides the most comprehensive coverage of HIPAA news anywhere online, in addition to independent advice about HIPAA compliance and the best practices to adopt to avoid data breaches, HIPAA violations and regulatory fines. Technologies such as encryption software and firewalls are covered under technical safeguards. However, combined with a unique identifier that can be used to link to health information, the data set could be classified as protected health information (PHI). First, the expert will determine if the demographics are independently replicable. Learn the rules and HIPAA exceptions now. A second class of methods that can be applied for risk mitigation are based on generalization (sometimes referred to as abbreviation) of the information. The preamble to this final rule identified the initial three digits of ZIP codes, or ZIP code tabulation areas (ZCTAs), that must change to 000 for release. Steve is responsible for editorial policy regarding the topics covered on HIPAA Journal. A common de-identification technique for obscuring PII [Personally Identifiable Information] is to use a one-way cryptographic function, also known as a hash function, on the PII. It notes that derivations . Suppression of an entire feature may be performed if a substantial quantity of records is considered as too risky (e.g., removal of the ZIP Code feature). FACT: HIPAA applies to any and all healthcare providers who transmit, store or handle protected health information. 3.5 What constitutes any other unique identifying number, characteristic, or code with respect to the Safe Harbor method of the Privacy Rule? HIPAA does not apply to de-identified PHI, and the information can be used or disclosed without violating any HIPAA Rules. To best explain what is considered PHI under HIPAA Rules, it is necessary to review the definitions section of the Administrative Simplification Regulations (160.103) starting with health information. Covered entities can include limited patient details in a hospital directory and provide limited information to friends and family with the patients informal consent unless the patient is unable to give their consent, in which case professional judgement should be used to determine whether or not the disclosures are in the patients best interests. Notice that every age is within +/- 2 years of the original age. The standards can be found in Subparts I to S of the HIPAA Administrative Data Standards. Other data, like first name, first initial and last name or even height or weight may only count as PII in certain circumstances, or when combined with other information. In this case, specific values are replaced with equally specific, but different, values. PHI only relates to health information about patients or health plan members. Before explaining these terms, it is useful to first explain what is meant by health information, of which protected health information is a subset. Copyright 2014-2022 HIPAA Journal. Various state and federal agencies define policies regarding small cell counts (i.e., the number of people corresponding to the same combination of features) when sharing tabular, or summary, data.20,21,22,23,24,25,26,27 However, OCR does not designate a universal value for k that covered entities should apply to protect health information in accordance with the de-identification standard. When stored or communicated electronically, the acronym "PHI" is preceded by an "e" - i.e. The re-identification provision in 164.514(c) does not preclude the transformation of PHI into values derived by cryptographic hash functions using the expert determination method, provided the keys associated with such functions are not disclosed, including to the recipients of the de-identified information. A covered entity may use a business associate to de-identify PHI on its behalf only to the extent such activity is authorized by their business associate agreement. Linking two data sources to identity diagnoses. There has been confusion about what constitutes a code and how it relates to PHI. Any information maintained in the data set regardless of whether it is individually identifiable health information or not is subject to the provisions of the HIPAA Privacy Rule. A code corresponds to a value that is derived from a non-secure encoding mechanism. Get our HIPAA Compliance Checklist to see everything you need to do to be fully compliant. Personally identifiable information (PII) or individually identifiable health information (IIHI) is any health information that allows the patient to be identified. Therefore: As well as covered entities having to understand what is considered PHI under HIPAA, it is also important that business associates are aware of how PHI is defined. 2.3 What is an acceptable level of identification risk for an expert determination? Patient names (first and last name or last name and initial) are one of the 18 identifiers classed as protected health information (PHI) in the HIPAA Privacy Rule. Inability to design such a relational mechanism would hamper a third partys ability to achieve success to no better than random assignment of de-identified data and named individuals. Using such methods, the expert will prove that the likelihood an undesirable event (e.g., future identification of an individual) will occur is very small. An estimated 80% of healthcare professionals use personal mobile devices, many of whom have sent or received PHI on those devices even though by doing so they are violating HIPAA Rules. If the threats could be reasonably anticipated, covered entities and business associates have to implement measures to protect against the threats, or mitigate the consequences if the threats were to materialize. PHI also includes insurance or employment records that contain a person's name or other . This guidance is intended to assist covered entities to understand what is de-identification, the general process by which de-identified information is created, and the options available for performing de-identification. For example, any HIPAA form a patient signs needs to have a Right to Revoke clause. Beyond gaining access to PHI, parents and guardians have the full range of HIPAA rights. Avail of a complimentary session with a HIPAA compliance risk assessment expert. Therefore, PHI includes health records, health histories, lab test results, and medical bills. Table 4 illustrates how generalization (i.e., gray shaded cells) might be applied to the information in Table 2. During the year of this event, it is highly possible that this occurred for only one individual in the hospital (and perhaps the country). Accidental HIPAA violations can have serious consequences for the individuals whose privacy has been violated and also for the covered entity. HIPAA does not prohibit the electronic transmission of PHI. No. PHI exists in the context of HIPAA, whereas PII is not necessarily . Notice that Gender has been suppressed completely (i.e., black shaded cell). This does not mean every disclosure is included. Example 2: Clear Familial Relation For instance, if a field corresponds to the first initials of names, then this derivation should be noted. The de-identification standard makes no distinction between data entered into standardized fields and information entered as free text (i.e., structured and unstructured text) -- an identifier listed in the Safe Harbor standard must be removed regardless of its location in a record if it is recognizable as an identifier.