hipaa logo

Part 1: Learning About HIPAA (FAQ 9 of 65)

 

9.Which Health Care Entities Must Comply With HIPAA?

HIPAA doesn't apply to every health record keeper or to every health record. Only covered entities must comply with HIPAA. Get used to the term covered entity because it comes up a lot. HIPAA recognizes and regulates three types of covered entities.

If your medical information is maintained by or for a covered entity, it is usually protected by HIPAA. If your medical information is not maintained by or for a covered entity, it is usually not protected by HIPAA. The covered entity concept is complicated, and we will explain business associates and hybrid entities later in this FAQ.

Covered entities under HIPAA are:

HEALTH CARE CLEARINGHOUSES

Health care clearinghouses transmit information (typically claim and billing information) between other players in the health care system. For example, a hospital may send the bill for your treatment to a health care clearinghouse that will reformat and submit the information to your insurance company. Clearinghouses are of no interest to the average patient because their function is usually invisible. Patients rarely, if ever, come into contact with them. But clearinghouses have the same obligations as other covered entities, and that is important if you do have an issue with a clearinghouse. Otherwise, don't worry about clearinghouses. We won't mention them again.

HEALTH PLANS

Health plans are covered entities. Health insurers, health maintenance organizations (HMOs), and Medicare are examples of health plans subject to HIPAA.

HEALTH CARE PROVIDERS

Health care providers are covered entities, at least most are. Generally, a health care provider is a doctor, hospital, dentist, podiatrist, pharmacist, laboratory, optometrist, and just about anyone else licensed to provide health care. The formal legal definition of health care provider is so complex that it makes lawyers wince.

It is important to understand that not all providers are subject to HIPAA. It generally depends on whether a provider bills (directly or indirectly) for services electronically. The reason for this odd, even silly, standard has to do with the structure of the health care system and the Department of Health and Human Service's authority to regulate. Unless you are a policy wonk, you probably don't want to know more.

Rule of thumb

A simple rule of thumb is that any provider who bills an insurance company or health plan is a covered entity under HIPAA. If your doctor accepts Medicare, for example, the doctor is a covered entity. A free health clinic may not be subject to HIPAA because it doesn't bill anyone. A doctor who charges every patient $25 cash and does not submit a bill to any insurance company may not be covered by HIPAA. A first aid room at your workplace may or may not be covered by HIPAA. If you want to know if the organization you are dealing with is a HIPAA covered entity, ask. If you don't get a straight answer, ask for a copy of its privacy policy. If has a privacy policy, the policy will explain about HIPAA's application. If it doesn't have a written privacy policy, then it is either not covered by HIPAA or it is violating the rule.

SIDEBAR:

Hybrid Entities (Supermarket pharmacies, etc. )

Do you use a pharmacy at a supermarket? If so, the pharmacy's records are subject to HIPAA because the pharmacy is a health care provider that submits electronic bills. What about the records that the supermarket maintains as part of its frequent shopper program? The answer is the supermarket's other customer records are almost certainly not protected by HIPAA. An organization with both health care functions and other functions can define itself as something called a hybrid entity. HIPAA will then apply only to the part of the organization that does health care and not to the rest. This should all be explained in the covered entity's notice of privacy practices.

SCHOOL HEALTH RECORDS

Most school health records are not subject to HIPAA. Instead, schools records (private schools are a major exception) are usually covered by another federal privacy law, the Family Educational Rights and Privacy Act (FERPA). The federal Department of Education administers FERPA. A school nurse is likely to be subject only to FERPA. A university hospital that runs a student clinic on behalf of the university is also subject to FERPA. However, other university hospital records about students could be subject to HIPAA, depending on the circumstances. The relationship between HIPAA and FERPA is very complicated. For more, see www.ed.gov/policy/gen/guid/fpco/ferpa/index.html.

Which law is better for privacy? Privacy rights under FERPA can be better in some ways than under HIPAA and worse in other ways.

OTHER RECORD HOLDERS

Who else has health records but isn't subject to HIPAA? Many organizations have health information about you are not subject to HIPAA. The list of unregulated health record keepers is shockingly long. These include gyms, health websites not offered by covered entities, Internet search engines, life and casualty insurers, Medical Information Bureau, employers (but this one is complicated), worker's compensation insurers, banks, credit bureaus, credit card companies. many health researchers, National Institutes of Health, cosmetic medicine services, transit companies, hunting and fishing license agencies, occupational health clinics, fitness clubs, home testing laboratories, massage therapists, nutritional counselors, alternative medicine practitioners, disease advocacy groups, marketers of non-prescription health products and foods, and some urgent care facilities. Providers of Personal Health Records, such as Google and Microsoft, have health records but are not covered entities. However, PHR maintained by your health care provider or insurer may be covered by HIPAA.

SIDEBAR:

Did you wonder why a hunting and fishing license agency made this list of organizations with health records? Some states give discounted licenses to those who are disabled. How do you prove entitlement to a discount? You have to provide adequate medical information to the agency. This is just one reason why your medical information can end up in the hands of many different types of organizations that have no direct health care or payment responsibilities. This example illustrates how complicated it can be to protect the privacy of health information. The information turns up in places that you might not expect.

SIDEBAR:

Is your PHR protected?

If an organization or a business maintains a Personal Health Record (PHR) for you, that PHR may not always fall under HIPAA's protections. Be cautious with PHRs because they are the subject of much attention and promotion. Many companies are trying to get in the business of storing your health records for you, especially online. But you need to know that unless a health care provider or insurer maintains the PHR, HIPAA does not apply. HIPAA may not even apply if a provider of insurer maintain the PHR. You must read the privacy policy to know.

Here's the most important point: if you give a commercial, advertising-supported PHR service consent to store your records, the records are probably not protected by HIPAA. The PHR service may be able to exploit the records as it pleases, subject only to its own policy. If you read the PHR company's policy carefully, we bet that it says that the company can change the policy at any time. We would not give our health records to an advertising-supported PHR service not covered under HIPAA because it is easy for companies to change their privacy policies at a moment's notice. This means that you can lose control of your sensitive health record information to the whims of a third party of if the company merges with another or goes bankrupt. For more on PHRs, see the World Privacy Forum PHR page or the our report, Personal Health Records: Why Many PHRs Threaten Privacy at www.worldprivacyforum.org/pdf/WPF_PHR_02_20_2008fs.pdf.

A health record covered by HIPAA can lose its privacy protection if transferred to a third person who is not a HIPAA covered entity. This is a very important aspect of HIPAA. Some would call it a loophole. We offer four examples of how you may see it in daily life. However, each of our examples has a weasel word (“probably”) because the rule is complicated. If we stopped to explain this kind of thing further, this document would quadruple in size.

  • You tell your doctor to give part of your health records to your employer to explain your absence from work. The record will probably not be subject to HIPAA in the hands of your employer.
  • A health researcher obtains your health records for use in an authorized research project. The records probably have no HIPAA protection in the hands of the researcher. However, if the researcher is treating you as part of the research (as in a clinical trial), then HIPAA may apply.
  • You apply for life insurance, and the insurance company obtains your health records with your consent. The records are not subject to HIPAA in the hands of the insurance company, but they may be subject to a state insurance privacy law. Some of the information you authorize the insurer to have may also end up at the Medical Information Bureau (MIB), another organization not subject to HIPAA. If you read the fine print in your application/authorization, you will learn that you authorized disclosure to MIB as well. MIB is subject to the Fair Credit Reporting Act, a different privacy law.
  • Your doctor tells you that you have a communicable disease (e.g., tuberculosis). The doctor must report your illness to the state public health department. The part of the health department that received your record is probably not subject to HIPAA.

We could list additional examples, but we offer a rule of thumb instead.

Rule of Thumb:

If a covered entity discloses a health record to anyone who isn't a covered entity, the record is generally outside the scope of HIPAA in the hands of the recipient. This is a major way that health records escape from privacy protections.

If a covered entity hires another company to perform a function that requires access to health information, that other company may be a business associate of the covered entity. A business associate of a covered entity is technically not subject to HIPAA. However, the covered entity must have a contract with each business associate that requires the business associate to comply with all relevant HIPAA provisions. The basic idea is that a covered entity cannot avoid the privacy rule by hiring someone else to process health records. The rules defining business associates are complicated and not that important from a patient perspective. Remember that even if a business associate holds your record, the covered entity that hired the business associate is still responsible to see that the record receives proper protections.

If you share health information with your family, a neighbor, or co-worker, the information that you share is not protected under HIPAA in the hands of the recipient. If you share your health information with a website that isn't a covered entity under HIPAA, then the information you disclosed is not protected under HIPAA in the hands of the website. This is a complex area that has created a lot of confusion among some consumers. Web sites that are medical web sites may very well not be covered under HIPAA, even if they say they are “HIPAA-compliant.”

See Rule of Thumb below, HIPAA Compliant, or HIPAA Covered?

Rule of Thumb:

HIPAA Compliant, or HIPAA Covered?

If a company is not covered by HIPAA, it may still say that it is “HIPAA compliant.” HIPAA compliant does not mean the same thing as being a HIPAA covered entity. If you see the words HIPAA compliant, find out if the company is a HIPAA covered entity. This is a yes or no question; there is no “maybe” answer here. If a company is HIPAA compliant but not a HIPAA covered entity, we urge caution.

 

Jump to list of FAQs 1-64 | See all of Part 1