HIPAA Awareness: The Basics

What HIPAA protects, and who has to follow it

HIPAA is the federal law that protects patients' health information. If you work in a medical practice, you are part of its "workforce," which means these rules apply to you directly, not just to the practice owner or the IT department.

The goal is simple to state: keep patient information private, keep it accurate, and keep it available to the people who are supposed to have it. Everything below is a way of doing that.

What counts as protected health information (PHI)

PHI is any health information that can be tied to a specific person. It is more than diagnoses and test results. It includes anything that identifies the patient alongside their care, such as:

• Name, address, phone number, email, or dates tied to the patient
• Medical record numbers, account numbers, or insurance details
• Appointment information, visit notes, images, and billing records
• Even a photo, a voicemail, or a sticky note, if it identifies a patient and their care

The minimum necessary rule

Access and share only the information needed for the task in front of you. If you are confirming an appointment, you do not need the full chart. If a request comes in for records, send only what was asked for and authorized, not the entire file "to be safe."

This applies to what you look at as much as what you send. Opening a record you have no work reason to open is a violation, even if you never share it.

Everyday safeguards

Most protection is ordinary habits done consistently:

• Lock your screen whenever you step away, even for a minute
• Use your own login, and use multi-factor authentication where it is offered
• Never share passwords or write them where others can see them
• Do not put PHI in personal email or text messages, or in tools the practice has not approved
• Keep conversations about patients out of waiting rooms, hallways, and elevators
• Verify who you are speaking to before disclosing anything over the phone

Common ways things go wrong

Most incidents are honest mistakes, not attacks. The frequent ones are worth knowing so you can catch them:

• A fax or email sent to the wrong recipient
• Looking up a friend, family member, coworker, or well-known person out of curiosity
• A screen or paper left visible to patients or visitors
• A phishing email that tricks someone into giving up a password
• A lost or unencrypted laptop, phone, or USB drive with PHI on it

If something goes wrong, report it right away

If you think PHI was seen, sent, lost, or accessed the wrong way, report it immediately to your practice's Privacy Officer or Security Officer. Do not try to hide it or fix it quietly. Fast reporting is what lets the practice meet its obligations and limit the harm.

Breach notification timelines and decisions are the practice's responsibility. Your job is to raise it quickly and honestly.

Patients have rights over their information

Patients can ask to see and get a copy of their records, ask to correct information they believe is wrong, and in many cases ask who their information has been shared with. When a patient makes one of these requests, route it to the right person at your practice rather than handling it informally.