• A
  • |
  • A
  • Text size

Privacy Standards

Changes Made to HIPAA Privacy Requirements as a Result of ARRA

Under HIPAA and ARRA, physicians are required to control the ways in which they use and disclose patients' protected health information.

The U.S. Department of Health & Human Services' (HHS) Office of Civil Rights oversees compliance with the HIPAA Privacy requirements. In January 2013, OCR published an omnibus final rule that covers changes to the HIPAA rule as required by ARRA; final regulations on notifications associated with the breach of patient information that has not been encrypted; modifications to the HIPAA rule regarding privacy protections for genetic information as required by the Genetic Information Nondiscrimination Act (GINA); and additional changes to the HIPAA privacy, security, and enforcement rules. The compliance date for the final Omnibus rule was effective September 23, 2013.

The AMA developed a plain-English toolkit, "HIPAA privacy and security toolkit: Helping your practice meet new compliance requirements," which walks physicians through what is needed to comply with the changes to HIPAA privacy and security rules that physicians are required to have met by the September 23, 2013 compliance deadline. Key provisions in the HIPAA omnibus rule cover:

  • Extending the applicability of certain of the Privacy and Security Rules’ requirements to the Business Associate (BA) of Covered Entities (CE);
  • Requiring CEs and BAs to provide for notification of breaches of unsecured Protected Health Information (PHI);
  • Establishing new limitations on the use and disclosure of PHI for marketing and fundraising purposes;
  • Limiting circumstances on the sale of PHI;
  • Requiring the consideration of a limited data set as the minimum necessary amount of information for a particular use, disclosure, or request of PHI;
  • Expanding individuals’ rights to obtain restrictions on certain disclosures of PHI to health plans; and
  • Strengthening enforcement provisions.

The AMA also has a fact sheet that describes what constitutes a health care information "breach" and when notice of a breach is required to the federal government.

Guidance on De-Identifying PHI

On November 26, 2012, the Department of Health and Human Services Office for Civil Rights released guidance about methods and approaches to de-identify protected health information (PHI) to aid physicians and other covered entities subject to the HIPAA Privacy Rule.

Read the OCR guidance.

Privacy Audits

The U.S. Department of Health & Human Services (HHS) Office for Civil Rights (OCR) initiated 115 audits of HIPAA covered entities in late 2011 through a pilot program to assess compliance with HIPAA privacy and security requirements as a result of the American Recovery and Reinvestment Act of 2009 (ARRA) which requires HHS to conduct periodic audits to assess compliance. The pilot program is expected to conclude December 2012. More information about the program can be found on the HHS website.

Privacy Resources
Disclosures Involving Public Safety
OCR Guidance on HIPAA Privacy and Same-Sex Marriage

The U.S. Department of Health and Human Services Office for Civil Rights (OCR) has developed guidance to assist covered entities in understanding how the decision by the Supreme Court in United States v. Windsor may affect certain of their HIPAA Privacy Rule obligations. OCR's guidance on HIPAA and Same-sex Marriage addresses the effect of the 2013 Supreme Court decision regarding the Defense of Marriage Act (DOMA) on these provisions, making clear that spouses include both same-sex and opposite-sex individuals who are legally married, whether or not they live or receive services in a jurisdiction that recognizes their marriage.

OCR's guidance on the Windsor decision is available on the HHS website.

OCR Guidance on Emergencies
AMA Advocacy on HIPAA Privacy