Give Examples Of Information Not Covered By The Security Rule

The HIPAA Security Rule safeguards protected health information (PHI) in electronic form, but it's vital to understand what types of information fall outside its scope. Recognizing these exceptions is crucial for healthcare providers, business associates, and anyone handling health-related data to ensure they comply with HIPAA regulations and avoid potential breaches.

Understanding the HIPAA Security Rule

The HIPAA Security Rule, a cornerstone of healthcare data protection, specifically addresses electronic protected health information (ePHI). Now, this includes any individually identifiable health information that is created, received, used, or maintained in electronic form. The rule mandates administrative, physical, and technical safeguards to ensure the confidentiality, integrity, and availability of ePHI.

Key Aspects of the Security Rule

Administrative Safeguards: These involve policies and procedures to manage security measures, conduct risk assessments, implement security awareness training, and manage workforce access to ePHI.
Physical Safeguards: These protect physical access to ePHI, including facility access controls, workstation security, and device and media controls.
Technical Safeguards: These involve technology and related policies and procedures to protect ePHI and control access to it, including access controls, audit controls, integrity controls, and transmission security.

Defining Information Not Covered by the Security Rule

While the Security Rule is comprehensive, it doesn't cover all types of information. Understanding the boundaries of what is not covered is essential for ensuring that appropriate protections are in place for all sensitive data.

Here are several categories of information that typically fall outside the purview of the HIPAA Security Rule:

1. Paper Records

The HIPAA Security Rule is explicitly focused on electronic protected health information (ePHI). Information stored in physical form, such as paper records, is not subject to the Security Rule. This includes:

Patient charts: Traditional paper-based patient files.
Printed prescriptions: Handwritten or printed prescriptions stored in physical files.
Physical consent forms: Signed consent forms kept in paper format.
Handwritten notes: Any handwritten notes by healthcare providers that are not digitized.

That said, it's crucial to note that while paper records are not covered by the Security Rule, they are still protected under the HIPAA Privacy Rule, which governs the use and disclosure of PHI in any form.

2. Verbal Communications

Verbal communications of protected health information are generally not covered by the HIPAA Security Rule. This includes spoken conversations between healthcare providers, discussions with patients, and phone calls. Examples include:

Doctor-to-doctor consultations: Discussions between physicians about a patient's condition.
Nurse-patient interactions: Verbal exchanges between nurses and patients regarding treatment plans.
Phone calls: Conversations with patients about appointments or test results.

As with paper records, the HIPAA Privacy Rule still applies to verbal communications, meaning that reasonable efforts must be made to protect the privacy of these exchanges.

3. De-identified Data

De-identified data is information that has been stripped of all identifiers that could link it back to an individual. According to HIPAA, de-identified health information is not considered PHI and is therefore not subject to either the Privacy Rule or the Security Rule. There are two methods for de-identification under HIPAA:

Safe Harbor Method: Requires the removal of 18 specific identifiers, such as names, addresses, dates, phone numbers, email addresses, Social Security numbers, medical record numbers, health plan beneficiary numbers, account numbers, certificate/license numbers, vehicle identifiers, device identifiers, URLs, IP addresses, biometric identifiers, full-face photographs, and any other unique identifying number, characteristic, or code.
Expert Determination Method: Requires a qualified expert to determine that the risk of re-identification is very small.

Once data is properly de-identified, it can be used for research, public health activities, and other purposes without the constraints of HIPAA. Practical, not theoretical.

4. Employment Records

Employment records held by a covered entity in its role as an employer are generally not subject to HIPAA. This includes information related to employees' job performance, evaluations, disciplinary actions, and other employment-related matters. Examples include:

Personnel files: Records containing employee resumes, job applications, performance reviews, and disciplinary actions.
Workers' compensation records: Records related to workplace injuries and workers' compensation claims.
Employee health records: Health information collected as part of employment, such as pre-employment physicals or drug testing, as long as this information is maintained separately from the covered entity's healthcare operations.

Worth pointing out that if a covered entity also provides healthcare services to its employees (e.g., an on-site clinic), the health information generated from those services would be protected under HIPAA.

5. Education Records

Education records covered by the Family Educational Rights and Privacy Act (FERPA) are not subject to HIPAA. FERPA protects the privacy of student education records and gives parents (or eligible students) certain rights with respect to those records. Examples include:

Student health records: Health information maintained by schools and universities about students.
Immunization records: Records of student immunizations required for school attendance.
Special education records: Records related to students with disabilities and their individualized education programs (IEPs).

If a healthcare provider maintains records about a student that are separate from the student's education records, those records would be subject to HIPAA.

6. Certain Law Enforcement Information

Certain types of information held by law enforcement agencies are not subject to HIPAA. This includes information gathered during criminal investigations, intelligence activities, and other law enforcement functions. Examples include:

Criminal investigation records: Records related to ongoing criminal investigations.
Intelligence information: Information gathered for national security or intelligence purposes.
Inmate medical records: In some cases, medical records of inmates held by correctional facilities may be exempt from HIPAA.

Even so, if a healthcare provider discloses PHI to law enforcement, that disclosure must comply with HIPAA regulations, such as obtaining a court order or warrant, or relying on a specific exception in the Privacy Rule.

7. Data Used Solely for Payment Processing

Data used solely for payment processing may fall outside the HIPAA Security Rule's scope under certain conditions. If the data is used only to process financial transactions and does not involve accessing or using PHI for other purposes, it might not be considered ePHI. Examples include:

Credit card transactions: Processing credit card payments for healthcare services without accessing patient medical information.
Bank transfers: Electronic fund transfers for payment of healthcare bills.

Still, if payment processing involves accessing or using PHI for other purposes, such as verifying insurance coverage or determining patient eligibility for services, then the HIPAA Security Rule would apply.

Want to learn more? We recommend why might a corpse be exhumed and winnie the pooh characters based on disorders for further reading.

8. Information Created Prior to HIPAA

Information created prior to the compliance dates of HIPAA (April 14, 2003, for most covered entities) may not be fully subject to the Security Rule. While HIPAA generally applies to all PHI, regardless of when it was created, covered entities were given time to implement the necessary security measures. Examples include:

Old patient records: Records created before the HIPAA compliance date that have not been updated or accessed electronically since then.
Legacy systems: Older electronic systems that were in use before HIPAA and have not been upgraded to meet Security Rule requirements.

On the flip side, if pre-HIPAA information is accessed or updated electronically after the compliance date, it becomes subject to the Security Rule.

9. PHI Transmitted via Limited Data Set

A limited data set contains PHI from which certain direct identifiers have been removed. While it can be used for research, public health activities, or healthcare operations, it requires a data use agreement between the covered entity and the recipient. Examples include:

Research data: Data sets provided to researchers that exclude names, addresses, and other direct identifiers but may include dates of service or demographic information.
Public health reporting: Data provided to public health agencies for disease surveillance or reporting purposes.

The HIPAA Security Rule applies to the transmission and storage of limited data sets, but the specific requirements may be less stringent than for full PHI, depending on the circumstances.

Examples of Situations Not Covered by the Security Rule

A doctor discusses a patient's case with a colleague over lunch. This verbal communication is subject to the HIPAA Privacy Rule but not the Security Rule, as it does not involve electronic transmission or storage of PHI.
A hospital stores patient records in locked filing cabinets. Because these are paper records, they are not subject to the HIPAA Security Rule.
A university uses student health records for research after removing all identifiers. The de-identified data is no longer considered PHI and is not subject to either the Privacy Rule or the Security Rule.
An employer maintains employee health records separate from the healthcare operations of the company. These employment records are not subject to HIPAA.
A school maintains immunization records for students. These education records are covered by FERPA, not HIPAA.
Law enforcement gathers medical information during a criminal investigation. This information is typically exempt from HIPAA.
A clinic processes credit card payments for services without accessing patient medical information. The payment processing activities are not subject to the HIPAA Security Rule.
A hospital still has patient records created in 2000 that haven't been digitized. This information is not yet subject to the Security Rule until it is accessed or updated electronically.
A healthcare provider sends a limited data set to a researcher for a study. This data is covered by the Security Rule, but with potentially less stringent requirements than full PHI.

Best Practices for Protecting Information Outside the Security Rule

Even though certain information may not be covered by the HIPAA Security Rule, it is still important to protect its privacy and security. Here are some best practices for doing so:

Implement Privacy Policies: Develop and enforce policies to protect the privacy of all types of health information, regardless of whether it is subject to HIPAA.
Provide Training: Train employees on the importance of protecting patient privacy and security, and on the specific policies and procedures that apply to different types of information.
Secure Physical Records: Protect paper records by storing them in locked cabinets or rooms with limited access.
Control Verbal Communications: see to it that verbal communications of PHI take place in private settings and that reasonable efforts are made to avoid being overheard.
De-identify Data Properly: Follow the HIPAA de-identification standards when removing identifiers from health information.
Use Data Use Agreements: Enter into data use agreements with recipients of limited data sets to make sure they protect the privacy and security of the information.
Monitor Access: Monitor access to all types of health information, regardless of whether it is subject to HIPAA, to detect and prevent unauthorized access.
Conduct Risk Assessments: Regularly assess the risks to the privacy and security of all types of health information, and implement appropriate safeguards to mitigate those risks.

Conclusion

While the HIPAA Security Rule provides a strong framework for protecting electronic protected health information, it is important to understand the types of information that fall outside its scope. Paper records, verbal communications, de-identified data, employment records, education records, certain law enforcement information, data used solely for payment processing, information created prior to HIPAA, and PHI transmitted via limited data sets are generally not subject to the Security Rule.

That said, it is still important to protect the privacy and security of these types of information by implementing appropriate policies, procedures, and safeguards. By understanding the boundaries of the Security Rule and taking steps to protect all types of health information, healthcare providers and business associates can see to it that they are complying with HIPAA and protecting the privacy of their patients.

FAQ

Q: Does the HIPAA Security Rule apply to paper records? A: No, the HIPAA Security Rule only applies to electronic protected health information (ePHI). Paper records are subject to the HIPAA Privacy Rule but not the Security Rule.

Q: Are verbal communications of PHI covered by the HIPAA Security Rule? A: No, verbal communications of PHI are not covered by the HIPAA Security Rule. They are subject to the HIPAA Privacy Rule.

Q: Is de-identified data subject to HIPAA? A: No, once data has been properly de-identified according to HIPAA standards, it is no longer considered PHI and is not subject to either the Privacy Rule or the Security Rule.

Q: Are employment records held by a covered entity subject to HIPAA? A: Employment records held by a covered entity in its role as an employer are generally not subject to HIPAA. Still, if the covered entity also provides healthcare services to its employees, the health information generated from those services would be protected under HIPAA.

Q: Are education records covered by HIPAA? A: Education records covered by the Family Educational Rights and Privacy Act (FERPA) are not subject to HIPAA.

Q: What is a limited data set? A: A limited data set contains PHI from which certain direct identifiers have been removed. It can be used for research, public health activities, or healthcare operations, but it requires a data use agreement between the covered entity and the recipient.

Q: What are some best practices for protecting information outside the Security Rule? A: Some best practices include implementing privacy policies, providing training, securing physical records, controlling verbal communications, de-identifying data properly, using data use agreements, monitoring access, and conducting risk assessments.

Q: What should I do if I am unsure whether certain information is subject to the HIPAA Security Rule?

A: If you are unsure whether certain information is subject to the HIPAA Security Rule, it is best to consult with a HIPAA compliance expert or attorney. They can help you assess the specific facts and circumstances and determine whether the Security Rule applies.

By understanding the nuances of what information is and isn't covered by the HIPAA Security Rule, healthcare entities can more effectively manage their compliance efforts and protect sensitive patient information.