PART 2 OF 4: The Privacy Rule and Patient Rights

How PHI may be used and the rights patients hold over it.

The Privacy Rule is the part of HIPAA that patients experience most directly. It controls how a practice may use and share protected health information and gives patients a set of enforceable rights over their own records. This post addresses the practice's obligations and the patient rights that come with them.

Permitted uses and disclosures

A practice may generally use and disclose PHI for treatment, payment, and healthcare operations without separate patient authorization. Most other uses — such as marketing or disclosures unrelated to care — require the patient's written authorization. When disclosure is permitted, the practice should share only the minimum necessary information for the purpose.

Patient rights

The Privacy Rule gives patients several rights the practice must honor:

• The right to access and obtain copies of their records, generally within a defined timeframe.

• The right to request amendments to their records.

• The right to an accounting of certain disclosures.

• The right to request restrictions on uses and disclosures and confidential communications.

• The right to receive the practice's Notice of Privacy Practices.

The Notice of Privacy Practices

Every practice must maintain and provide a Notice of Privacy Practices describing how it uses PHI and the rights patients hold. The notice must be given to patients and posted, and it should accurately reflect the practice's actual information practices.

Minimum necessary and access controls

The minimum necessary standard runs throughout the Privacy Rule: staff should access and disclose only the PHI needed for their role and the task at hand. Role-based access, both on paper and in electronic systems, is a practical way to build this principle into daily operations.

How West Coast Health Law Can Help

We help practices implement Privacy Rule compliance — from Notices of Privacy Practices and authorization forms to processes for honoring patient access and amendment requests.

West Coast Health Law offers a FREE consultation which you may schedule by clicking the button on our website.

This article is provided for general informational purposes only and does not constitute legal advice or create an attorney-client relationship. Laws change and every practice is different; consult a qualified attorney about your specific circumstances.