Are health information organizations (HIOs) required to have a HIPAA Notice of Privacy Practices (NPP)?
Generally, no. The HIPAA Privacy Rule’s NPP obligations extend only [...]
May a HIPAA Notice of Privacy Practices (NPP) specifically mention that protected health information (PHI) will be disclosed to and through a health information organization (HIO)? May the NPP mention that the covered health care provider uses an electronic health record (EHR)?
Yes, covered entities are permitted to include such information in [...]
Can a health information organization (HIO) participate as part of an affiliated covered entity?
A HIO generally is not a HIPAA covered entity and [...]
Can a health information organization (HIO) participate as part of an organized health care arrangement (OHCA)?
A HIO, by definition, cannot participate as part of an [...]
Can a health information organization (HIO), as a business associate, exchange protected health information (PHI) with another HIO acting as a business associate?
Yes, so long as the disclosure of PHI is authorized [...]
What are some considerations in developing and implementing a business associate agreement with a health information organization (HIO)?
In general, the HIPAA Privacy Rule requires that the contract [...]
Can a health information organization (HIO) operate as a business associate of multiple covered entities participating in a networked environment?
Yes. A HIO can operate as a business associate of [...]
Is a health information organization (HIO) covered by the HIPAA Privacy Rule?
Generally, no. The HIPAA Privacy Rule applies to health plans, [...]
Who has the right to consent or the right to request restrictions with respect to whether a covered entity may electronically exchange a minor’s protected health information to or through a health information organization (HIO)?
As with a minor’s paper medical record, generally a parent, [...]