by Jackson Lewis
This is Part II of an article covering when and under what conditions protected
information may be disclosed, as well as the penalties for unlawful disclosure. Part
I dealt with who is a covered entity, what information is protected, and what control
patients have over information.
Insurance, health care provider and pharmacy records containing confidential personal
health information are subject to stiffer privacy protection under regulations issued
by the Department of Health and Human Services, as empowered by the federal Health
Insurance Portability and Accountability Act of 1996, or HIPAA Until recently it
was left to the states to protect this type of confidential and personal information.
The federal regulations were designed to cover the weaknesses in many of those state
laws while preserving the stronger protection in areas such as mental health, HIV
infection, and AIDS information. The rules took effect April 14, 2001, but most employers
affected by the rules have until April 14, 2003 to comply.
The basic principle of the new rules is simple: "covered entities"
cannot use or disclose "protected health information" except with the consent
or authorization of the patient or as permitted under the regulations.
The final regulations permit disclosure of protected health information in the
following limited circumstances:
- to the patient;
- by general consent of the patient for routine disclosures necessary to carry
out health care treatment, payment, or operations (for example, internal data gathering
by a health care plan); and
- by separate, specific authorization of the patient for a non-routine purpose
of limited duration.
With the exception of disclosures to or requests by a health care provider for
treatment, the final privacy rules permit only the disclosure of the minimum amount
of information necessary to carry out the consent or authorization.
Employers and Health Plan Sponsors. While the privacy rules do not apply
directly to employers and health plan sponsors, they do affect the flow of information
from covered entities to health plan sponsors. The rules permit a group health plan
or insurer to disclose summary health information (e.g., claims history data with
individually identifiable information deleted) to allow the plan sponsor to obtain
premium bids or to change the plan. They also permit a group health plan or insurer
to disclose personal health care information to a plan sponsor which agrees to be
bound by the privacy rules.
Use of the personal information for any "employment purpose" is forbidden, and
for any permitted use, the plan sponsor must first amend the health plan document
to include privacy restrictions paralleling those for covered entities.
Requirements for Compliance and Penalties for Noncompliance
Covered entities are required to implement numerous administrative policies and
procedures to protect personal health care information, including:
- a complaint and grievance procedure;
- a documented privacy procedure;
- and privacy training for employees dealing with protected health information.
Penalties. Violations of the privacy rules may result in civil penalties
of up to $25,000 within a single calendar year, and criminal penalties up to $250,000
and/or a 10-year prison term if the information is used for commercial advantage
or malicious harm.
For more information on the privacy rules on personal health care information,
please contact the Jackson Lewis Benefits Group, 914-328-0404, or by email,
[email protected].