Federal (United States) · Agency FAQs
HHS OCR HIPAA FAQs
444 sections
444 sections
- HHS OCR HIPAA FAQ 187What does the HIPAA Privacy Rule do?
- HHS OCR HIPAA FAQ 188Why is the HIPAA Privacy Rule needed?
- HHS OCR HIPAA FAQ 189Generally, what does the HIPAA Privacy Rule require the average provider or health plan to do?
- HHS OCR HIPAA FAQ 190Who must comply with HIPAA privacy standards?
- HHS OCR HIPAA FAQ 191When did covered entities have to meet these HIPAA privacy standards?
- HHS OCR HIPAA FAQ 192What were the major modifications to the HIPAA Privacy Rule that the Department of Health and Human Services (HHS) adopted in August 2002?
- HHS OCR HIPAA FAQ 193Why was the consent requirement eliminated from the HIPAA Privacy Rule, and how will it affect individuals' privacy protections?
- HHS OCR HIPAA FAQ 196Can health care providers engage in confidential conversations with other providers or with patients, even if there is a possibility that they could be overheard?
- HHS OCR HIPAA FAQ 197Does the HIPAA Privacy Rule require hospitals and doctors' offices to be retrofitted, to provide private rooms, and soundproof walls to avoid any possibility that a conversation is overheard?
- HHS OCR HIPAA FAQ 198May physician's offices or pharmacists leave messages for patients at their homes, either on an answering machine or with a family member, to remind them of appointments or to inform them that a prescription is ready? May providers continue to mail appointment or prescription refill reminders to patients' homes?
- HHS OCR HIPAA FAQ 199May physician's offices use patient sign-in sheets or call out the names of their patients in their waiting rooms?
- HHS OCR HIPAA FAQ 200Are physicians and doctor's offices prohibited from maintaining patient medical charts at bedside or outside of exam rooms, or from engaging in other customary practices where the potential exists for patient information to be incidentally disclosed to others?
- HHS OCR HIPAA FAQ 201A clinic customarily places patient charts in the plastic box outside an exam room. It does not want the record left unattended with the patient, and physicians want the record close by for fast review right before they walk into the exam room. Will the HIPAA Privacy Rule allow the clinic to continue this practice?
- HHS OCR HIPAA FAQ 202A hospital customarily displays patients' names next to the door of the hospital rooms that they occupy. Will the HIPAA Privacy Rule allow the hospital to continue this practice?
- HHS OCR HIPAA FAQ 203May mental health practitioners or other specialists provide therapy to patients in a group setting where other patients and family members are present?
- HHS OCR HIPAA FAQ 204Are covered entities required to document incidental disclosures permitted by the HIPAA Privacy Rule, in an accounting of disclosures provided to an individual?
- HHS OCR HIPAA FAQ 205Do the HIPAA Privacy Rule's provisions permitting certain incidental uses and disclosures apply only to treatment situations or discussions among health care providers?
- HHS OCR HIPAA FAQ 206Is a covered entity required to prevent any incidental use or disclosure of protected health information?
- HHS OCR HIPAA FAQ 207How are covered entities expected to determine what is the minimum necessary information that can be used, disclosed, or requested for a particular purpose?
- HHS OCR HIPAA FAQ 208Won't the HIPAA Privacy Rule's minimum necessary restrictions impede the delivery of quality health care by preventing or hindering necessary exchanges of patient medical information among health care providers involved in treatment?
- HHS OCR HIPAA FAQ 209Do the HIPAA Privacy Rule's minimum necessary requirements prohibit medical residents, medical students, nursing students, and other medical trainees from accessing patient medical information in the course of their training?
- HHS OCR HIPAA FAQ 210Must the HIPAA Privacy Rule's minimum necessary standard to be applied to uses or disclosures that are authorized by an individual?
- HHS OCR HIPAA FAQ 211Are providers required to make a minimum necessary determination to disclose to Federal or state agencies, such as the Social Security Administration (SSA) or its affiliated agencies, for individuals' applications for federal or state benefits?
- HHS OCR HIPAA FAQ 212Doesn't the HIPAA Privacy Rule minimum necessary standard conflict with the HIPAA transaction standards?
- HHS OCR HIPAA FAQ 213Does the HIPAA Privacy Rule strictly prohibit the use, disclosure, or request of an entire medical record? If not, are case-by-case justifications required each time the entire medical record is disclosed?
- HHS OCR HIPAA FAQ 214A provider might have a patient's medical record that contains older portions of a medical record that were created by another previous provider. Will the HIPAA Privacy Rule permit a provider who is a covered entity to disclose a complete medical record even though portions of the record were created by other providers?
- HHS OCR HIPAA FAQ 215In limiting access, are covered entities required to completely restructure existing workflow systems, including redesigning office space and upgrading computer systems, in order to comply with the HIPAA Privacy Rule's minimum necessary requirements?
- HHS OCR HIPAA FAQ 216Is a covered entity required to apply the HIPAA Privacy Rule's minimum necessary standard to a disclosure of protected health information it makes to another covered entity?
- HHS OCR HIPAA FAQ 217May a covered entity accept documentation of an external Institutional Review Board's (IRB) waiver of authorization for purposes of reasonably relying on the request as the minimum necessary?
- HHS OCR HIPAA FAQ 219Does the HIPAA Privacy Rule change the way in which a person can grant another person health care power of attorney?
- HHS OCR HIPAA FAQ 220If someone has a health care power of attorney for an individual, can they obtain access to that individual's medical record?
- HHS OCR HIPAA FAQ 221Can the personal representative of an adult or emancipated minor obtain access to the individual's medical record?
- HHS OCR HIPAA FAQ 222How can family members of a deceased individual obtain the deceased individual's protected health information that is relevant to their own health care?
- HHS OCR HIPAA FAQ 223Does the HIPAA Privacy Rule address when a person may not be the appropriate person to control an individual's protected health information?
- HHS OCR HIPAA FAQ 224May personal representatives access health information based on a non-health care power of attorney?
- HHS OCR HIPAA FAQ 226How does a covered entity identify an individual’s personal representative?
- HHS OCR HIPAA FAQ 227Does the HIPAA Privacy Rule allow parents the right to see their children’s medical records?
- HHS OCR HIPAA FAQ 228If a child receives emergency medical care without a parent's consent, can the parent get all information about the child's treatment and condition?
- HHS OCR HIPAA FAQ 229Does the HIPAA Privacy Rule provide rights for children to be treated without parental consent?
- HHS OCR HIPAA FAQ 230When an individual reaches the age of majority or becomes emancipated, who controls the protected health information concerning health care services rendered while the individual was an unemancipated minor?
- HHS OCR HIPAA FAQ 231May a psychologist continue his practice to notify a parent before treating his or her minor child, even though the minor child is able to consent to such health care under state law?
- HHS OCR HIPAA FAQ 232Has the Secretary exceeded the HIPAA statutory authority by requiring "satisfactory assurances" for disclosures to business associates?
- HHS OCR HIPAA FAQ 236Is a covered entity liable for, or required to monitor, the actions of its business associates?
- HHS OCR HIPAA FAQ 237Instead of entering into a contract, can business associates self-certify or be certified by a third party as compliant with the HIPAA Privacy Rule?
- HHS OCR HIPAA FAQ 238Are accreditation organizations business associates of the covered entities they accredit?
- HHS OCR HIPAA FAQ 239Is a business associate contract required for a covered entity to disclose protected health information to a researcher?
- HHS OCR HIPAA FAQ 240When is a health care provider a business associate of another health care provider?
- HHS OCR HIPAA FAQ 241May a covered entity share protected health information directly with another covered entity's business associate?
- HHS OCR HIPAA FAQ 242Are covered entities that engage in joint activities under an organized health care arrangement (OHCA) required to have business associate contracts with each other?
- HHS OCR HIPAA FAQ 243Is a business associate contract required with organizations or persons where inadvertent contact with protected health information may result - such as in the case of janitorial services?
- HHS OCR HIPAA FAQ 246Does the HIPAA Privacy Rule require a business associate to provide individuals with access to their protected health information or an accounting of disclosures, or an opportunity to amend protected health information?
- HHS OCR HIPAA FAQ 247Would business associate contracts in electronic form, with an electronic signature, satisfy the HIPAA Privacy Rule's business associate contract requirements?
- HHS OCR HIPAA FAQ 248Do physicians with hospital privileges have to enter into business associate contracts with the hospital?
- HHS OCR HIPAA FAQ 249Under the HIPAA Privacy Rule, may a covered entity contract with a business associate to create a limited data set the same way it can use a business associate to create de-identified data?
- HHS OCR HIPAA FAQ 250I want to hire the intended recipient of a limited data set to also create the limited data set as my business associate. Can I combine the data and use agreement and business associate contract?
- HHS OCR HIPAA FAQ 251If the only protected health information a business associate receives is a limited data set, does the HIPAA Privacy Rule require the covered entity to enter into both a business associate agreement and data use agreement with the business associate?
- HHS OCR HIPAA FAQ 252Are business associates required to restrict their uses and disclosures to the minimum necessary? May a covered entity reasonably rely on a request from a covered entity's business associate as the minimum necessary?
- HHS OCR HIPAA FAQ 253Is a physician or other provider considered to be a business associate of a health plan or other payer?
- HHS OCR HIPAA FAQ 254Is a health insurance issuer or HMO who provides health insurance or health coverage to a group health plan a business associate of the group health plan?
- HHS OCR HIPAA FAQ 255Is a reinsurer a business associate of a health plan?
- HHS OCR HIPAA FAQ 256Is a software vendor a business associate of a covered entity?
- HHS OCR HIPAA FAQ 258How does the HIPAA Privacy Rule change the laws concerning consent for treatment?
- HHS OCR HIPAA FAQ 259Can a pharmacist use protected health information to fill a prescription that was telephoned in by a patient's physician without the patient's written consent if the patient is a new patient to the pharmacy?
- HHS OCR HIPAA FAQ 260Can health care providers, such as a specialist or hospital, to whom a patient is referred for the first time, use protected health information to set up appointments or schedule surgery or other procedures without the patient's written consent?
- HHS OCR HIPAA FAQ 261Are health care providers restricted from consulting with other providers about a patient’s condition without the patient’s written authorization?
- HHS OCR HIPAA FAQ 262Does the HIPAA Privacy Rule restrict pharmacists from giving advice about over-the-counter medicines to customers?
- HHS OCR HIPAA FAQ 263Can a patient have a friend or family member pick up a prescription for her?
- HHS OCR HIPAA FAQ 264What is the difference between “consent” and “authorization” under the HIPAA Privacy Rule?
- HHS OCR HIPAA FAQ 265May a health care provider disclose protected health information to a health plan for the plan's Health Plan Employer Data and Information Set (HEDIS)?
- HHS OCR HIPAA FAQ 266Does the HIPAA Privacy Rule permit a covered entity or its collection agency to communicate with parties other than the patient (e.g., spouses or guardians) regarding payment of a bill?
- HHS OCR HIPAA FAQ 267Does the HIPAA Privacy Rule prevent reporting to consumer credit reporting agencies or otherwise create any conflict with the Fair Credit Reporting Act (FCRA)?
- HHS OCR HIPAA FAQ 268Does the HIPAA Privacy Rule prevent health plans and providers from using debt collection agencies? Does the Privacy Rule conflict with the Fair Debt Collection Practices Act?
- HHS OCR HIPAA FAQ 269Are location information services of collection agencies, which are required under the Fair Debt Collection Practices Act, permitted under the HIPAA Privacy Rule?
- HHS OCR HIPAA FAQ 270Does the HIPAA Privacy Rule permit an eye doctor to confirm a contact prescription received by a mail-order contact company?
- HHS OCR HIPAA FAQ 271Does a physician need a patient's written authorization to send a copy of the patient's medical record to a specialist or other health care provider who will treat the patient?
- HHS OCR HIPAA FAQ 272Is a hospital permitted to contact another hospital or health care facility, such as a nursing home, to which a patient will be transferred for continued care, without the patient's authorization?
- HHS OCR HIPAA FAQ 273When an ambulance service delivers a patient to a hospital, is it permitted to report its treatment of the patient and patient's medical history to the hospital, without the patient's authorization?
- HHS OCR HIPAA FAQ 274How does the HIPAA Privacy Rule apply to professional liability insurance? Specifically, how can professional liability insurers continue to arrange for and maintain medical liability insurance for health care providers covered by the Rule?
- HHS OCR HIPAA FAQ 275Does the HIPAA Privacy Rule expand the ability of providers, plans, marketers and others to use my protected health information to market goods and services to me? Does the Privacy Rule make it easier for health care businesses to engage in door-to-door sales and marketing efforts?
- HHS OCR HIPAA FAQ 277Can telemarketers obtain my health information and use it to call me to sell good and services?
- HHS OCR HIPAA FAQ 278When is an authorization required from the patient before a provider or health plan engages in marketing to that individual?
- HHS OCR HIPAA FAQ 279How can I distinguish between activities for treatment or health care operations versus marketing activities?
- HHS OCR HIPAA FAQ 280Do disease management, health promotion, preventive care, and wellness programs fall under the HIPAA Privacy Rule's definition of "marketing"?
- HHS OCR HIPAA FAQ 281Is it marketing for a covered entity to describe products or services that are provided by the covered entity to its patients, or to describe products or services that are included in the health plan's plan of benefits of the health plan?
- HHS OCR HIPAA FAQ 282Is it marketing for a covered entity to describe the entities participating in a health care provider network or a health plan network?
- HHS OCR HIPAA FAQ 283Is it marketing for an insurance plan or health plan to send enrollees notices about changes, replacements, or improvements to existing plans?
- HHS OCR HIPAA FAQ 284Can health plans communicate about health-related products or services to enrollees that add value to, but are not part of, a plan of benefits?
- HHS OCR HIPAA FAQ 285Can a doctor or pharmacy be paid to make a prescription refill reminder without a prior authorization under the HIPAA Privacy Rule?
- HHS OCR HIPAA FAQ 286Are appointment reminders allowed under the HIPAA Privacy Rule without authorizations?
- HHS OCR HIPAA FAQ 287What are examples of "alternative treatments" that are excepted from the HIPAA Privacy Rule's definition of "marketing"?
- HHS OCR HIPAA FAQ 288Are prior authorizations required when a doctor or health plan distributes promotional gifts of nominal value?
- HHS OCR HIPAA FAQ 289Are health care providers required to seek a prior authorization before discussing a product or service with a patient, or giving a product or service to a patient, in a face-to-face encounter?
- HHS OCR HIPAA FAQ 290Must insurance agents that are business associates of a health plan seek a prior authorization before talking to a customer in a face-to-face encounter about the insurance company's other lines of business?
- HHS OCR HIPAA FAQ 291What effect do the “marketing” provisions of the HIPAA Privacy Rule have on Federal or State fraud and abuse statutes?
- HHS OCR HIPAA FAQ 292May covered entities use information regarding specific clinical conditions of individuals in order to communicate about products or services for such conditions without a prior authorization?
- HHS OCR HIPAA FAQ 293Are communications concerning information to beneficiaries about government programs or government-sponsored programs "marketing" under the HIPAA Privacy Rule?
- HHS OCR HIPAA FAQ 294Must a health care provider or other covered entity obtain permission from a patient prior to notifying public health authorities of the occurrence of a reportable disease?
- HHS OCR HIPAA FAQ 295Does the public health provision of the HIPAA Privacy Rule require covered entities to make public health disclosures?
- HHS OCR HIPAA FAQ 296May covered entities disclose facially identifiable protected health information, such as name, address, and social security number, for public health purposes?
- HHS OCR HIPAA FAQ 297Does the HIPAA Privacy Rule's public health provision permit covered entities to disclose protected health information to authorities such as the National Institutes of Health (NIH)?