When does an individual request electronic access to Phi?

If the individual requests electronic access to PHI that the covered entity maintains electronically, the covered entity must provide the individual with access to the information in the requested electronic form and format, if it is readily producible in that form and format, or if not, in an agreed upon alternative, readable electronic format.

How does the privacy rule protect the privacy of Phi?

Authorization for Research Uses and Disclosures. One way the Privacy Rule protects the privacy of PHI is by generally giving individuals the opportunity to agree to the uses and disclosures of their PHI by signing an Authorization form for uses and disclosures not otherwise permitted by the Rule.

Can a covered entity charge an individual for a Phi?

Under the HIPAA Privacy Rule, a covered entity is prohibited from charging an individual who has requested a copy of her PHI more than a reasonable, cost-based fee for the copy that covers only certain labor, supply, and postage costs that may apply in fulfilling the request. See 45 CFR 164.524(c)(4).

What items are considered phi?

PHI is health information in any form, including physical records, electronic records, or spoken information. Therefore, PHI includes health records, health histories, lab test results, and medical bills. Essentially, all health information is considered PHI when it includes individual identifiers.

When to disclose PHI to a service agency?

For example, a provider may disclose PHI about a patient needing mental health care supportive housing to a service agency that arranges such services for individuals. A covered entity may also disclose PHI to such entities pursuant to an authorization signed by the individual.

PHI is health information in any form, including physical records, electronic records, or spoken information. Therefore, PHI includes health records, health histories, lab test results, and medical bills. Essentially, all health information is considered PHI when it includes individual identifiers.

Is there such thing as PHI without 18 identifiers?

Also note, health information by itself without the 18 identifiers is not considered to be PHI. For example, a data set of vital signs by themselves does not constitute protected health information.

Does the security rule allow for sending e-Phi in an email?

Answer: The Security Rule does not expressly prohibit the use of email for sending e-PHI. However, the standards for access control (45 CFR § 164.312 (a)), integrity (45 CFR § 164.312 (c) (1)), and transmission security (45 CFR § 164.312 (e) (1)) require covered entities to implement policies and procedures to restrict access to,…