How may the HIPAA Privacy Rule’s minimum necessary standard apply to electronic health information exchange through a networked environment?
The Privacy Rule generally requires covered entities to take reasonable [...]
May a health information organization (HIO), acting as a business associate of a HIPAA covered entity, de-identify information and then use it for its own purposes?
A HIO, as a business associate, may only use or [...]
What may a HIPAA covered entity’s business associate agreement authorize a health information organization (HIO) to do with electronic protected health information (PHI) it maintains or has access to in the network?
A business associate agreement may authorize a business associate to [...]
May a health information organization (HIO) manage a master patient index on behalf of multiple HIPAA covered entities?
Yes. A HIO may receive protected health information from multiple [...]
May a covered health care provider disclose electronic protected health information (PHI) through a health information organization (HIO) to another health care provider for treatment?
Yes. The Privacy Rule permits a covered entity to disclose [...]
Who is liable under the HIPAA Privacy Rule where multiple covered entities have signed on to a single business associate agreement and one member breaches the agreement?
The Privacy Rule is flexible enough to allow multiple covered [...]
How should a covered entity respond to any HIPAA Privacy Rule violation of a health information organization (HIO) acting as its business associate?
The Privacy Rule establishes a series of steps a covered [...]
Does the HIPAA Privacy Rule require a covered entity to “police” a health information organization (HIO), which functions as its business associate?
No. As with other business associates, the Privacy Rule would [...]
What is a covered entity’s liability under the HIPAA Privacy Rule for sharing data inappropriately to or through a health information organization (HIO) or other electronic health information exchange network?
A covered entity that exchanges protected health information (PHI) to [...]