As part of the healthcare space in the United States, it is impossible to avoid HIPAA laws and regulations. The Health Insurance Portability and Accountability Act (HIPAA) is a federal legislation first released in 1996 to govern privacy requirements in the healthcare industry. Early in the 1990s, it became obvious that computers and digital records would play a significant role in storing health data and that precautions needed to be taken to preserve sensitive data. Since 1996, HIPAA has undergone a number of amendments and additions to reflect emerging technological developments. However, the law still has the same goal: to protect protected health information so that patients are safe from data privacy and security violations. 

Here’s the thing, though. Putting such ideas into practice can be difficult, particularly when new difficulties are encountered daily while recognizing protected health information (PHI) and comprehending covered companies. You can keep up with rapidly changing laws and technologies with proper guidance. This is why we at Akitra have carefully curated this article for you, which will help you navigate PHI from start to finish. In this blog, we will tell you everything you need to know about protected health information (PHI), including why it is important for Covered Entities (CEs), the requirements for PHI disclosure, when should you disclose or use PHI, and much more. 

What is Protected Health Information (PHI)?

Any health-related information paired with a special identity that corresponds to a specific person is what HIPAA refers to as “protected health information.”

Identifiers include (but may not be limited to) the following:

• Date of birth
• Home address
• Mobile Number 
• Social Security Number

You may also consider some additional and frequently ignored data components that may serve as identifiers and, hence, fall under the criteria of PHI:

• MAC address of a device’s network card
• Full-face photos and geographic data
• The IP address of a patient’s device
• Driver’s license number
• Image diagnostic codes
• Numbers on certain medical records
• Numbers for a health plan or insurance accounts
• Serial numbers for medical equipment used in patient’s treatment
• Visitation, admission, and discharge dates
• Payments for financial treatments or medicines
• Biometric information, such as fingerprints, retinal scans, and more

If a patient’s identity can be determined using the data, it should be regarded as a potential identifier and handled as protected health information (PHI).

Now that you know all about PHI, let’s define a PHI disclosure.

What is a PHI Disclosure?

Based on the above mentioned information, protected health information (PHI) transmission to a person or group outside the covered entity’s scope is called a disclosure. A hybrid entity may also entail sharing PHI from a healthcare component to a non-healthcare component.

Why is it Important to Disclose PHI Before Covered Entities (CEs) and Organizations?

PHI disclosure is a risky endeavor. Why is it vital to disclose PHI before covered entities (CEs) and organizations?

Interestingly, PHI disclosure aligns with maintaining patient privacy. Consider this. You entrust a healthcare professional with your personal information, medical history, and test results when you visit them. Covered entities and organizations are inherently tasked with respecting your expectation that the information will be kept private.

Imagine that someone gained access to your medical records without your permission. Your private information may be compromised, endangering identity theft and putting other negative repercussions (such as ramifications for your reputation) at risk. It is obvious that maintaining PHI security is not just required by law but also a fundamental responsibility to protect patient safety and confidence. 

Remember to consider the financial side as well. Covered entities and organizations handle billing, insurance claims, and financial transactions relating to healthcare services. These financial transactions entail private data, including payment and insurance history. Without adequate protections, unauthorized access or tampering could result in scams, financial losses, and legal repercussions. Thus, covered entities and organizations must fully disclose patient information.

When Do You Have to Disclose PHI?

A covered entity (CE) must enable access to any PHI item upon request from an individual or authorized representative; when the HHS needs access to PHI to look into compliance or assess enforcement, a covered entity must provide such information. A covered entity must comply when the disclosure of PHI is required by law enforcement or judicial investigation. A covered entity must also disclose PHI to enable abuse and trauma victims to participate in legal procedures. In rare circumstances, you may have a good basis to believe that keeping PHI secret could seriously harm anyone—including the patient—or the general public. It would help if you revealed it to the appropriate authority.

When Can You Disclose or Use PHI?

The HIPAA Privacy Rule also specifies the circumstances in which a covered entity may use and disclose PHI. Unlike the two mandatory instances mentioned above, these circumstances do not require a covered company to report.

A covered entity is allowed to disclose PHI to the person whose PHI it is. A covered entity may also disclose and use PHI for healthcare operations, payment, and treatment.

A covered organization may disclose and use PHI when more than one healthcare practitioner is necessary for the appropriate treatment of an individual. The same applies when a patient must be referred from one covered entity to another. The use and disclosure of PHI to bill a health plan for services rendered is authorized. The same holds when using PHI to calculate premiums or assess the full extent of insurance coverage and its advantages.

Pertaining to the information above, the following are considered essential healthcare operations:

• Care coordination and case management for better healthcare delivery and quality evaluation
• A competency evaluation for a health plan or provider accreditation, credentialing, or evaluation
• Conducting medical evaluations or audits, organizing legal services for compliance programs, and executing fraud and abuse detection investigations
• Underwriting, risk rating, and re-insurance risk assessment activities
• For business growth, administration, management, and planning
• For using PHI that has been deidentified to raise money for a covered entity

Next, let’s see what are the requirements for PHI disclosures.

What are the Requirements for PHI Disclosure?

A covered entity (CE) is only required to disclose PHI under the HIPAA Privacy Rule in two particular circumstances. Let’s deconstruct it:

• Individual Requests

When people (or their representatives) request access to their PHI or a list of disclosures made with their data, a covered entity must provide that information. It ultimately comes down to giving people control over and understanding how their medical information is used.

• Participation of the Department of Health and Human Services (HHS)

When the Department of Health and Human Services (HHS) initiates a compliance inquiry, review, or enforcement action, PHI must be provided in the second circumstance. This makes it possible to ensure that the necessary checks and balances are in place to protect the confidentiality of medical information.

Best Practices for Disclosing PHI

Besides the requirements, it is advisable to keep these five best practices in mind before you disclose pertinent patient information:

1. Get Written Consent from Patients 

Before revealing any PHI, get the patient’s written consent. The information given, to whom, and why should all be included in this authorization duly signed by the patient under concern.

2. Minimum Necessary Rule

Only disclose the minimum amount of PHI required to achieve the intended purpose in accordance with the minimum necessary rule. Don’t divulge information that isn’t needed or pertinent to the disclosure.

3. Verify Identity of Entity Requesting PHI

Before disclosing any information, confirm the identity and authority of the individual requesting PHI. Implement procedures to verify that the request is authorized and legitimate.

4. Use Business Associate Agreements

Have Business Associate Agreements (BAAs) signed when working with third-party vendors or business associates who may handle PHI on your behalf to ensure they also adhere to HIPAA standards.

5. De-identify PHI

To lower the risk of patient identification, deidentify PHI whenever possible before disclosing it. De-identification refers to eliminating or modifying specific identifiers that might connect the information to a specific person.

HIPAA Compliance Readiness with Akitra!

Establishing trust is a crucial competitive differentiator when courting new SaaS businesses in today’s era of data breaches and compromised privacy. Customers and partners want assurances that their organizations are doing everything possible to prevent disclosing sensitive data and putting them at risk, and compliance certification fills that need.

Akitra offers an industry-leading, AI-powered Compliance Automation platform for SaaS companies. Using automated evidence collection and continuous monitoring, together with a full suite of customizable policies and controls as a compliance foundation, our compliance automation platform and service help our customers prepare readiness for the HIPAA compliance standard, along with other security frameworks like SOC 1, SOC 2, GDPR, PCI DSS, ISO 27001, ISO 27701, ISO 27017, ISO 27018, NIST CSF, NIST 800-53, NIST 800-171, FedRAMP, CCPA, CMMC, and more such as CIS AWS Foundations Benchmark, etc. In addition, companies can use Akitra’s Risk Management product for overall risk management for your company, Trust Center, and AI-based Automated Questionnaire Response product to streamline and expedite security questionnaire response processes delivering huge cost savings. Our compliance and security experts will provide customized guidance to navigate the end-to-end compliance process confidently. 

The benefits of our solution include enormous savings in time, human resources, and cost savings, including discounted audit fees with our audit firm partners. Customers achieve compliance certification fast and cost-effectively, stay continuously compliant as they grow, and can become certified under additional frameworks using a single compliance automation platform.

Build customer trust. Choose Akitra TODAY!‍
To book your FREE DEMO, contact us right here.