Question

What is the purpose of the privacy rule?

What information must be removed from a patient's medical record in order to de-identify it?

What are some practical recommendations for the implementation of HIPAA?

Answer 1

1. Purposes of privacy rule:

The HIPAA rules are national standards to protect individual medical records and personal health information.

It sets limitations for release of health information and patients have control over their information

It prevents breach and misuse of personal and health information.

It describes criminal penalties for breach of information

It protects the patient’s medical records.

2. According to HIPAA there are 18 direct identifiers which can be removed to de-identify the patient. They are

• Names
• Geographic subdivisions smaller than a state (e.g. street address, city and ZIP code)
• All dates that are related to an individual (e.g., date of birth, admission)
• Telephone numbers
• Fax numbers
• Email addresses
• Social Security numbers
• Medical record numbers
• Health plan beneficiary numbers
• Account numbers
• Certificate/license numbers
• Vehicle identifiers and serial numbers, including license plate numbers
• Device identifiers and serial numbers
• Web universal locators (URLs)
• IP address numbers
• Biometric identifiers such as fingerprints and voice prints
• Full-face photographic images
• Other unique identifying numbers, characteristics or codes

3. Some practical recommendations for implementing HIPAA could be

• Give training for employees regarding rules and policies of HIPAA and keep record of it.
• Make a plan on how to comply with the Rules and policies and adhere to it.
• Do a risk assessment to identify vulnerabilities such as electronic devices, softwares, people who have access to information etc.
• Appoint a Privacy officer who will work solely for the purpose of implementing the privacy policy
• Make agreements with Business Associates (Third party payers, laboratories etc) regarding the privacy rules and audit their compliance.