Security and Privacy

Statutory basis.

The HIPAA security and privacy provisions are adopted under the Secretary's authority to prescribe standards under the Social Security Act and other public laws.

Definitions.

Defines key terms for HIPAA security and privacy, including common control, hybrid entity, and required by law.

Applicability.

Specifies that HIPAA security and privacy standards apply to health plans, health care clearinghouses, and health care providers who transmit health information electronically.

Organizational requirements.

Sets requirements for hybrid entities and affiliated covered entities, including documentation and safeguard obligations.

Relationship to other parts.

Covered entities and business associates must comply with applicable provisions of parts 160 and 162 in addition to the requirements of this part.

Applicability.

Covered entities and business associates must comply with the security standards and requirements of this subpart regarding electronic protected health information.

Definitions.

This section provides the specific definitions for terms used within the HIPAA security subpart.

Security standards: General rules.

Covered entities and business associates must ensure the confidentiality, integrity, and availability of electronic protected health information and implement appropriate security measures.

Administrative safeguards.

Covered entities and business associates must implement administrative policies and procedures to manage the selection, development, implementation, and maintenance of security measures.

Physical safeguards.

A covered entity or business associate must, in accordance with § 164.306:

Technical safeguards.

A covered entity or business associate must, in accordance with § 164.306:

Organizational requirements.

Covered entities must ensure that business associate contracts and group health plan documents include specific provisions to safeguard electronic protected health information.

Policies and procedures and documentation requirements.

A covered entity or business associate must, in accordance with § 164.306:

Compliance dates for the initial implementation of the security standards.

This section specifies the compliance deadlines for health plans, clearinghouses, and health care providers regarding the security standards.

Applicability.

The requirements of this subpart apply to breaches of protected health information occurring on or after September 23, 2009.

Definitions.

As used in this subpart, the following terms have the following meanings:

Notification to individuals.

Requires covered entities to notify individuals following the discovery of a breach of unsecured protected health information.

Notification to the media.

Mandates that covered entities notify prominent media outlets when a breach of unsecured protected health information affects more than 500 residents of a state or jurisdiction.

Notification to the Secretary.

Requires covered entities to notify the Secretary of HHS regarding breaches of unsecured protected health information.

Notification by a business associate.

Establishes the requirement for business associates to notify covered entities of breaches of unsecured protected health information.

Law enforcement delay.

If a law enforcement official states to a covered entity or business associate that a notification, notice, or posting required under this subpart would impede a criminal investigation or cause damage to national security, a covered enti...

Administrative requirements and burden of proof.

Outlines the administrative requirements and the burden of proof for covered entities and business associates regarding breach notifications.

Applicability.

Defines the scope and applicability of the HIPAA privacy standards to covered entities, business associates, and health care clearinghouses.

Definitions.

As used in this subpart, the following terms have the following meanings:

Uses and disclosures of protected health information: General rules.

This provision establishes the general standards for the use and disclosure of protected health information by covered entities and business associates, including requirements for minimum necessary access, de-identification, and specific prohibitions regarding genetic information, sales of information, and reproductive health care.

Uses and disclosures: Organizational requirements.

This regulation establishes organizational requirements for covered entities under HIPAA, including standards for business associate contracts, group health plan privacy, and the management of multiple covered functions.

Uses and disclosures to carry out treatment, payment, or health care operations.

This provision outlines the standards and implementation specifications for covered entities to use or disclose protected health information for treatment, payment, and health care operations under the HIPAA Privacy Rule.

Uses and disclosures for which an authorization is required.

This provision establishes the requirements for valid patient authorizations for the use and disclosure of protected health information, including core elements, revocation procedures, and limitations on conditioning treatment or payment.

Uses and disclosures for which an attestation is required.

This regulation mandates that covered entities obtain a valid attestation before disclosing protected health information related to reproductive health care for specific legal or administrative purposes.

Uses and disclosures requiring an opportunity for the individual to agree or to object.

A covered entity may use or disclose protected health information, provided that the individual is informed in advance of the use or disclosure and has the opportunity to agree to or prohibit or restrict the use or disclosure, in accorda...

Uses and disclosures for which an authorization or opportunity to agree or object is not required.

Except as provided by § 164.502(a)(5)(iii), a covered entity may use or disclose protected health information without the written authorization of the individual, as described in § 164.508, or the opportunity for the individual to agree...

Other requirements relating to uses and disclosures of protected health information.

This provision establishes standards for de-identification of protected health information, minimum necessary requirements for uses and disclosures, limited data set usage, fundraising communications, and verification of identity and authority for disclosures.

Notice of privacy practices for protected health information.

This provision mandates that covered entities provide individuals with a clear, written notice of their privacy practices, legal duties, and the individual's rights regarding protected health information.

Rights to request privacy protection for protected health information.

This regulation establishes the rights of individuals to request restrictions on the use and disclosure of their protected health information and to request confidential communications from covered entities.

Access of individuals to protected health information.

This regulation establishes the right of individuals to inspect and obtain copies of their protected health information in a designated record set, including procedures for requests, denials, and review of denials.

Amendment of protected health information.

This provision establishes the right of an individual to request amendments to their protected health information maintained in a designated record set and outlines the covered entity's obligations for processing, documenting, and responding to such requests.

Accounting of disclosures of protected health information.

This provision defines the individual's right to receive an accounting of disclosures of their protected health information made by a covered entity and specifies the required content, timelines, and documentation for such accountings.

Administrative requirements.

This provision establishes the mandatory administrative framework for covered entities, including personnel designations, workforce training, privacy safeguards, complaint processes, sanctions, and documentation retention requirements.

Transition provisions.

This provision outlines the transition rules for the use and disclosure of protected health information under prior authorizations, research permissions, and business associate contracts.

Compliance dates for initial implementation of the privacy standards.

This provision establishes the historical compliance deadlines for health care providers, health plans, and clearinghouses regarding the HIPAA privacy standards.

Severability.

This provision specifies that if any part of the HIPAA Privacy Rule is held invalid, the remaining provisions shall remain in effect.