FAQs Archive

Q: May a covered health care provider disclose electronic protected health information (PHI) through a health information organization (HIO) to another health care provider for treatment?

Yes. The Privacy Rule permits a covered entity to disclose PHI to another health care provider for treatment purposes. See 45 CFR § 164.506 . Further, a covered entity may use a HIO to facilitate the exchange of such information for treatment purposes, provided it has a business associate agreement with the HIO that requires the HIO to protect the information. See 45 CFR §§ 164.502(e) , 164.504(e) .

Q: How should a covered entity respond to any HIPAA Privacy Rule violation of a health information organization (HIO) acting as its business associate?

The Privacy Rule establishes a series of steps a covered entity should take in response to any complaints or other evidence it receives that a HIO has violated its business associate agreement, which include the following: investigation of any complaint received, as well as of other information containing credible evidence of a violation; reasonable steps to cure/end any material breaches or violations it becomes aware of; termination of the agreement where attempts to cure a material breach are unsuccessful; and in the event termination of the agreement is not feasible, the report of violation(s) to the Secretary of HHS, through OCR. See 45 CFR § 164.504(e) .

Q: Social Networking Sites

Internet sites that provide a variety of ways for users to interact, such as e-mail instant messaging, posting informational web pages and picture exchange services. Common Internet social networking sites are Facebook, Twitter, Instagram, LinkedIn, Pinterest, TikTok, Tumblr, VK, Flickr, Vine and MySpace.