Introduction to HIPAA
The Health Insurance Portability and Accountability Act (HIPAA) is a federal law that protects the privacy and security of certain health information. However, not all information is protected by HIPAA. To understand what information is not protected, it is essential to know the scope and limitations of the law.
HIPAA applies to covered entities, such as healthcare providers, insurance companies, and billing companies, and protects individually identifiable health information. This includes medical records, billing information, and other health-related data.
Employment Records and HIPAA
Employment records are not protected by HIPAA, even if they contain health information. This is because employment records are not considered protected health information (PHI) under the law. However, employers must still comply with other laws, such as the Americans with Disabilities Act (ADA), when handling employee health information.
Employers may collect health information from employees for various purposes, such as workers' compensation claims or disability benefits. In these cases, the information is not protected by HIPAA, but employers must still maintain confidentiality and comply with other applicable laws.
Education Records and HIPAA
Education records are also not protected by HIPAA. The Family Educational Rights and Privacy Act (FERPA) regulates the handling of education records, which may include health information. FERPA applies to educational institutions and protects the privacy of student education records.
While FERPA and HIPAA are separate laws, they may overlap in certain situations. For example, a school may have a clinic or healthcare services on campus, and the health information collected in these settings may be subject to HIPAA. However, education records, including health information, are generally not protected by HIPAA.
Publicly Available Information
Publicly available information is not protected by HIPAA. This includes information that is readily available to the public, such as phone books, public directories, or online search results. If health information is publicly available, it is not considered protected health information (PHI) under HIPAA.
However, even if health information is publicly available, healthcare providers and other covered entities must still comply with HIPAA when handling the information. This means that they must ensure the confidentiality, integrity, and availability of the information, even if it is publicly available.
De-Identified Information
De-identified information is not protected by HIPAA. De-identified information is health information that has been stripped of identifying features, such as names, addresses, or social security numbers. This type of information is not considered protected health information (PHI) under HIPAA.
De-identified information can be used for various purposes, such as research, public health activities, or marketing. However, covered entities must ensure that the information is properly de-identified and that it does not contain any identifiable features that could be used to re-identify the individual.
Frequently Asked Questions
What is considered protected health information under HIPAA?
Protected health information (PHI) includes individually identifiable health information, such as medical records, billing information, and other health-related data.
Are employment records protected by HIPAA?
No, employment records are not protected by HIPAA, even if they contain health information.
Can education records contain health information?
Yes, education records may contain health information, but they are not protected by HIPAA. Instead, they are regulated by FERPA.
Is publicly available information protected by HIPAA?
No, publicly available information is not protected by HIPAA. However, covered entities must still comply with HIPAA when handling the information.
What is de-identified information?
De-identified information is health information that has been stripped of identifying features, such as names, addresses, or social security numbers.
Can de-identified information be used for research purposes?
Yes, de-identified information can be used for research purposes, as well as for public health activities or marketing.