HIPAA: Privacy, Security, and Patient Rights

Core Review

What Is HIPAA?

The Health Insurance Portability and Accountability Act of 1996 is a federal law with several components relevant to dental practice:

1. Privacy Rule: Establishes national standards for the protection of PHI. Governs ALL forms of PHI (paper, electronic, oral).

1. Security Rule: Establishes national standards for protecting electronic PHI (ePHI). Only applies to electronic information.

1. Breach Notification Rule: Requires covered entities to notify affected individuals, HHS, and (in some cases) the media of breaches of unsecured PHI.

1. Enforcement Rule: Establishes penalties for HIPAA violations.

Who Must Comply?

• Covered Entities: Healthcare providers (including dental practices), health plans, and healthcare clearinghouses that transmit health information electronically
• Business Associates: Organizations or individuals that perform services for a covered entity involving PHI (e.g., billing companies, IT support, shredding services, answering services). Business associates must sign a Business Associate Agreement (BAA).

Protected Health Information (PHI)

PHI is ANY health information that can identify an individual patient. HIPAA identifies 18 specific identifiers:

1. Name
2. Geographic subdivisions smaller than a state (address, ZIP code)
3. Dates directly related to an individual (birth date, admission date, treatment date — year alone is generally permitted)
4. Telephone numbers
5. Fax numbers
6. Email addresses
7. Social security numbers
8. Medical record numbers
9. Health plan beneficiary numbers
10. Account numbers
11. Certificate/license numbers
12. Vehicle identifiers and serial numbers (including license plates)
13. Device identifiers and serial numbers
14. Web URLs
15. IP addresses
16. Biometric identifiers (fingerprints, voice prints)
17. Full-face photographs and comparable images
18. Any other unique identifying number, characteristic, or code

De-identification: If ALL 18 identifiers are removed and the covered entity has no reasonable basis to believe the information can be used to identify the patient, the information is no longer PHI and is not subject to HIPAA restrictions.

The Privacy Rule

The Privacy Rule establishes the conditions under which PHI may be used (internally) and disclosed (to external parties).

Permitted Uses and Disclosures WITHOUT Patient Authorization:

1. Treatment: Sharing PHI among healthcare providers for the purpose of treating the patient
   • Example: A dental hygienist sending a periodontal chart to a periodontist for a referral — this is a treatment disclosure and does not require patient authorization.

1. Payment: Using or disclosing PHI to obtain payment for services
   • Example: Submitting a claim to the patient's insurance company including procedure codes and diagnostic information.

1. Healthcare Operations: Administrative, quality improvement, training, and business functions
   • Example: Reviewing patient charts for a quality assurance audit.

Other Permitted Disclosures Without Authorization (specific circumstances):

• Required by law (court order, subpoena)
• Public health activities (disease reporting to health departments)
• Reporting abuse, neglect, or domestic violence
• Health oversight activities (state board investigations)
• Judicial and administrative proceedings
• Law enforcement purposes
• Organ and tissue donation
• Research (with Institutional Review Board waiver)
• Workers' compensation

Disclosures REQUIRING Patient Authorization:

• Marketing purposes
• Sale of PHI
• Psychotherapy notes (special protections)
• Most research uses
• Disclosing PHI to an employer (for purposes other than workers' compensation)

The Minimum Necessary Standard: When using or disclosing PHI (except for treatment purposes), the covered entity must make reasonable efforts to limit PHI to the MINIMUM NECESSARY to accomplish the intended purpose.

• Example: If an insurance company requests records to verify a specific procedure, do NOT send the entire patient record — send only the information relevant to that procedure.
• The minimum necessary standard does NOT apply to treatment purposes (clinicians need full access to make treatment decisions) or to disclosures to the patient themselves.

Notice of Privacy Practices (NPP):

• Every patient must receive a Notice of Privacy Practices that explains how their PHI will be used and their rights
• The patient must sign an acknowledgment of receipt (or the practice must document a good-faith attempt to obtain acknowledgment)
• The NPP must be posted in the practice and available on the practice website

The Security Rule

The Security Rule applies specifically to electronic PHI (ePHI). It requires covered entities and business associates to implement administrative, physical, and technical safeguards.

Administrative Safeguards:

• Security management process (risk analysis and risk management)
• Designation of a security officer
• Workforce training on security policies
• Policies for authorizing access to ePHI
• Contingency planning (data backup, disaster recovery, emergency mode operations)

Physical Safeguards:

• Facility access controls (limited physical access to areas where ePHI is stored)
• Workstation security (positioning screens so unauthorized persons cannot view them)
• Device and media controls (secure disposal of electronic media containing ePHI)

Technical Safeguards:

• Access controls (unique user IDs, automatic logoff)
• Audit controls (recording and examining access to ePHI)
• Integrity controls (ensuring ePHI is not improperly altered or destroyed)
• Transmission security (encryption of ePHI when transmitted electronically)

Patient Rights Under HIPAA

Patients have specific rights regarding their PHI:

1. Right to Access: Patients may inspect and obtain a copy of their PHI. The covered entity must provide access within 30 days. Reasonable cost-based fees may be charged for copies.

1. Right to Amend: Patients may request amendments (corrections) to their PHI if they believe it is inaccurate or incomplete. The covered entity may deny the request but must provide a written explanation.

1. Right to an Accounting of Disclosures: Patients may request a list of certain disclosures of their PHI made by the covered entity (excluding disclosures for treatment, payment, and healthcare operations).

1. Right to Request Restrictions: Patients may request restrictions on how their PHI is used or disclosed. The covered entity is NOT required to agree, EXCEPT: if the patient pays out of pocket in full for a service and requests that the information not be disclosed to their health plan, the covered entity MUST comply.

1. Right to Request Confidential Communications: Patients may request to receive communications in an alternative manner or at an alternative location (e.g., "send my bills to my work address, not my home").

1. Right to Receive a Notice of Privacy Practices: As described above.

Breach Notification Rule

A breach is the unauthorized acquisition, access, use, or disclosure of unsecured PHI.

Breach Notification Requirements:

• Affected individuals: Must be notified without unreasonable delay, and no later than 60 days after discovery of the breach.
• HHS: For breaches affecting 500+ individuals, notification must be provided to the Secretary of HHS at the same time as individual notification. For breaches affecting <500 individuals, notification is made via an annual report.
• Media: For breaches affecting 500+ individuals in a state or jurisdiction, prominent media outlets must be notified.

Breach Risk Assessment: Not every unauthorized disclosure is a reportable breach. The covered entity must conduct a risk assessment considering:

• The nature and extent of the PHI involved
• The unauthorized person who received the PHI
• Whether the PHI was actually acquired or viewed
• The extent to which the risk has been mitigated

If the risk assessment determines a low probability that PHI has been compromised, notification may not be required.

Examples of breaches:

• A laptop containing unencrypted patient records is stolen
• A dental practice employee emails a spreadsheet of patient names, dates of birth, and treatment information to their personal email
• Patient records are left in an unsecured area and accessed by unauthorized individuals
• Discussing patient PHI in a public area where it is overheard by others (this is a privacy violation and potentially a breach)

HIPAA Violations in Dental Practice: Common Scenarios

Scenario 1: Social Media A dental hygienist posts a "before and after" photo of a patient's cosmetic procedure on the practice Instagram. The patient's face is visible.

• Violation: Yes. Full-face photos are PHI identifiers. Posting them without written HIPAA authorization is a violation.

Scenario 2: Front Desk The receptionist calls a patient's home number and leaves a voicemail: "This is Dr. Smith's office calling to confirm your root canal appointment tomorrow at 10 AM."

• Potential violation: The content of the message could be overheard by anyone with access to the voicemail. Best practice: "This is Dr. Smith's office calling for [Patient Name]. Please call us back at [number]." — identifying only the practice, not the nature of the appointment.

Scenario 3: Staff Discussion Two staff members are discussing a patient's treatment in the break room. They use the patient's name. Other staff members not involved in the patient's care are present.

• Violation: Yes. Discussing PHI where unauthorized individuals can overhear violates the Privacy Rule and the minimum necessary standard.

Scenario 4: Chart Left Open A clinician leaves a patient's electronic chart open on a computer screen in an operatory while stepping out. The hallway is visible to other patients.

• Violation: Yes. Failing to log off or secure the workstation exposes ePHI to unauthorized viewing.

Scenario 5: Referral A dental hygienist calls a periodontist's office to schedule a referral and provides: patient name, date of birth, and periodontal chart findings.

• NOT a violation: This is a disclosure for TREATMENT purposes, which does not require patient authorization. However, the minimum necessary standard still applies — provide only the information the periodontist needs.

HIPAA Enforcement and Penalties

HIPAA is enforced by the Office for Civil Rights (OCR) within HHS. Penalty tiers:

Criminal penalties (Department of Justice):

• Knowingly obtaining/disclosing PHI: up to 1 year imprisonment + fine
• Obtaining PHI under false pretenses: up to 5 years + fine
• Obtaining PHI with intent to sell or for malicious harm: up to 10 years + fine

HIPAA and State Laws

HIPAA is a FEDERAL floor — it sets minimum standards. State laws that provide GREATER protection to patient privacy preempt (override) HIPAA. For example, many states have additional privacy protections for mental health records, HIV status, or substance abuse treatment records. Dental professionals must comply with BOTH HIPAA and applicable state privacy laws.

Clinical Application

A patient requests a copy of their complete dental record, including radiographs and periodontal charting. The receptionist says, "We can't give you the original, but we can provide copies for a copying fee."

HIPAA analysis: The patient is exercising their right to access. The practice must provide access within 30 days. A reasonable cost-based fee for copies is permitted. Radiographs must also be provided (patients have a right to all PHI, including images). The practice cannot withhold records for unpaid bills (this may violate HIPAA and state law).

Common Traps

• TRAP: Thinking that de-identified patient information (e.g., "a 45-year-old female with periodontitis") is always HIPAA-compliant to share. Must remove ALL 18 identifiers to be truly de-identified.
• TRAP: Requiring patient authorization for every disclosure. TPO disclosures do not require authorization. Referral to a specialist is a treatment disclosure.
• TRAP: Thinking the minimum necessary standard applies to treatment. It does not. Clinicians need unrestricted access to PHI to provide care.
• TRAP: Posting clinical photos on social media with "patient permission" but without written HIPAA authorization. Verbal permission is insufficient for marketing/social media use.