HIPAA Compliance Beyond the Basics
Understanding HIPAA at a surface level covers the fundamentals: protect patient information, give patients their rights, follow the TPO exception. However, operational compliance requires knowing the specific rules, thresholds, and timelines that govern day-to-day practice. These details are what auditors examine and what the ABO exam tests.
Breach Notification Requirements
When a breach of Protected Health Information (PHI) occurs, HIPAA mandates specific notification procedures. The requirements differ based on the number of individuals affected:
Breaches Affecting 500 or More Individuals
- Individual notification: Written notice to each affected patient within 60 days of discovering the breach
- HHS notification: Report to the Department of Health and Human Services within 60 days
- Media notification: Notify prominent media outlets serving the state or jurisdiction where the affected individuals reside
The media notification requirement ensures broad public awareness when a large-scale breach occurs, allowing affected individuals who may not receive direct notice to take protective action.
Breaches Affecting Fewer Than 500 Individuals
- Individual notification: Written notice to each affected patient within 60 days
- HHS notification: Log the breach and report it to HHS annually (no immediate reporting required)
- No media notification required
Electronic Audit Trails
Audit trails are automated logs maintained by Electronic Medical Record (EMR) systems that track every interaction with patient data. They record:
- Who accessed the record (user identity)
- What they accessed (which patient, which data)
- When they accessed it (date and time stamp)
- What action they took (viewed, modified, printed, deleted)
Audit trails serve multiple purposes:
- Detecting unauthorized access: If a staff member views a record without a legitimate reason, the audit trail records it
- Supporting breach investigations: After a suspected breach, audit trails identify exactly what information was accessed and by whom
- Compliance verification: Auditors review audit trails to verify that access controls are functioning properly
- Accountability: Staff awareness that their access is logged deters inappropriate behavior
Patient Record Requests
Under HIPAA, patients have the right to access their health records. When a patient requests their records:
- You must respond within 30 days of receiving the request
- A single 30-day extension is permitted if you document the reason for the delay and notify the patient
- Provide records in the format the patient requests, if readily producible (paper, electronic)
- You may charge a reasonable, cost-based fee for copying and mailing, but not for the time spent searching and retrieving records
- You cannot deny the request based on an outstanding balance or for other business reasons
PHI on Billing Statements
When sending billing statements or communications to patients, the minimum necessary standard requires you to include only the information needed for the billing purpose:
- Acceptable: Service dates, procedure codes, charge amounts, payment amounts, balance due
- Acceptable: Diagnosis codes (these are standard billing elements)
- Not acceptable: Detailed clinical notes, specific symptoms, sensitive diagnoses beyond what billing requires
Billing statements are often mailed or emailed and may be seen by others in the patient's household. Limiting clinical detail on these documents protects patient privacy in situations where others might access their mail.
Additional Compliance Measures
- Business Associate Agreements (BAAs): Required with any third party that accesses PHI on your behalf (labs, billing services, IT vendors, cloud storage providers)
- Staff training: All employees must receive HIPAA training at hire and annually thereafter
- Risk assessments: Periodic evaluation of vulnerabilities in how PHI is stored, transmitted, and accessed
- Policies and procedures: Written documentation of your practice's privacy and security practices
Key Takeaways
- Breaches affecting 500+ individuals require media notification and immediate HHS reporting
- Breaches affecting fewer than 500 require patient notification but only annual HHS reporting
- Audit trails track all access to electronic health records and are essential for compliance
- Patient record requests must be fulfilled within 30 days (with a possible 30-day extension)
- Billing statements should contain only minimum necessary PHI
- Records cannot be withheld due to unpaid balances