are measures, policies, and procedures to physically protect the Covered Components’ Systems and related buildings and equipment that contain ePHI, from natural and environmental hazards and unauthorized intrusion.

the activities undertaken by (1) except as prohibited when involving genetic information, a health plan to obtain premiums or to determine or fulfill its responsibility for coverage and provision of benefits under the health plan, including determinations of eligibility and adjudication of claims; risk adjusting; billing, claims management, and collection activities; review of health care services with respect to medical necessity, coverage under a health plan, appropriateness of care, or justification of charges; utilization review activities; and disclosure to consumer reporting agencies of certain PHI relating to collection of premiums or reimbursement; or (2) a covered health care provider or health plan to obtain or provide reimbursement for the provision of health care.

an adult family member or friend who a patient grants authority to have access to the patient’s Protected Health Information ( PHI ) in order to assist the patient in their care or payment for care.

Organized Health Care Arrangement, a clinically integrated care setting where individuals typically receive health care from more than one health care provider. Members of an OHCA may agree to abide by the terms of a joint notice of privacy practices and to share PHI as necessary to carry out treatment, payment, or operations relating to the OHCA.

Office of Civil Rights, the branch of the DHHS that is responsible for federal oversight of the privacy regulations.

A standard that requires covered entities to take reasonable steps to limit the use or disclosure of, and requests for PHI to the minimum necessary to accomplish the intended purpose. The minimum necessary standard does not apply to certain uses or disclosures such as those requests by a health care provider for treatment purposes, disclosures to the individual who is the subject of the information or pursuant to an individual’s authorization.

FAQs Archive

Q: Personal Representative

Someone with the legal authority to act on behalf of an incompetent adult patient, a minor patient or a deceased patient or the patient’s estate in making health care decisions or in exercising the patient’s rights related to the individual’s protected health information.

Q: Can the phone number of a patient’s room be released as part of the facility directory?

Yes. The phone number of the patient's room in the facility may be released as part of the directory information about the patient's location in the facility, provided that the other requirements at 45 CFR 164.510(a) also are followed. For further information about how this section of the Rule applies, see our other FAQs on this topic by searching on the term "directory."

Q: Can the fact that a patient has been "treated and released," or that a patient has died, be released as part of the facility directory?

Yes. The fact that a patient has been "treated and released," or that a patient has died, may be released as part of the directory information about the patient’s general condition and location in the facility, provided that the other requirements at 45 CFR 164.510(a) also are followed. For further information about how this section of the Rule applies, see our other FAQs on this topic by searching on the term "directory."