Beyond the HIPAA Privacy Rule: Enhancing Privacy, Improving Health Through Research.

The Value and Importance of Health Information Privacy

Ethical health research and privacy protections both provide valuable benefits to society. Health research is vital to improving human health and health care. Protecting patients involved in research from harm and preserving their rights is essential to ethical research. The primary justification for protecting personal privacy is to protect the interests of individuals. In contrast, the primary justification for collecting personally identifiable health information for health research is to benefit society. But it is important to stress that privacy also has value at the societal level, because it permits complex activities, including research and public health activities to be carried out in ways that protect individuals’ dignity. At the same time, health research can benefit individuals, for example, when it facilitates access to new therapies, improved diagnostics, and more effective ways to prevent illness and deliver care.

The intent of this chapter1 is to define privacy and to delineate its importance to individuals and society as a whole. The value and importance of health research will be addressed in Chapter 3.

CONCEPTS AND VALUE OF PRIVACY

Definitions

Privacy has deep historical roots (reviewed by Pritts, 2008Westin, 1967), but because of its complexity, privacy has proven difficult to define and has been the subject of extensive, and often heated, debate by philosophers, sociologists, and legal scholars. The term “privacy” is used frequently, yet there is no universally accepted definition of the term, and confusion persists over the meaning, value, and scope of the concept of privacy. At its core, privacy is experienced on a personal level and often means different things to different people (reviewed by Lowrance, 1997Pritts, 2008). In modern society, the term is used to denote different, but overlapping, concepts such as the right to bodily integrity or to be free from intrusive searches or surveillance. The concept of privacy is also context specific, and acquires a different meaning depending on the stated reasons for the information being gathered, the intentions of the parties involved, as well as the politics, convention and cultural expectations (Nissenbaum, 2004NRC, 2007b).

Our report, and the Privacy Rule itself, are concerned with health informational privacy. In the context of personal information, concepts of privacy are closely intertwined with those of confidentiality and security. However, although privacy is often used interchangeably with the terms “confidentiality” and “security,” they have distinct meanings.Privacy addresses the question of who has access to personal information and under what conditions. Privacy is concerned with the collection, storage, and use of personal information, and examines whether data can be collected in the first place, as well as the justifications, if any, under which data collected for one purpose can be used for another (secondary)2 purpose. An important issue in privacy analysis is whether the individual has authorized particular uses of his or her personal information (Westin, 1967).

Confidentiality safeguards information that is gathered in the context of an intimate relationship. It addresses the issue of how to keep information exchanged in that relationship from being disclosed to third parties (Westin, 1976). Confidentiality, for example, prevents physicians from disclosing information shared with them by a patient in the course of a physician–patient relationship. Unauthorized or inadvertent disclosures of data gained as part of an intimate relationship are breaches of confidentiality (Gostin and Hodge, 2002NBAC, 2001).

 

Read More: http://snip.ly/tlhw0#https://www.ncbi.nlm.nih.gov/books/NBK9579/

 

HIPAA’s compliance expectations from Business Associate

 

The Health Information Portability and Accountability Act (HIPAA) regards the Business Associate as a major player. HIPAA defines the Business Associate (BA) as either an organization or a person who works with or provides service to a Covered Entity, who in turn is defined as one who handles or discloses Protected Health Information (PHI).

So, a Business Associate is any person or entity that is involved in creating, receiving, maintaining or transmitting PHI to a Covered Entity for a purpose or activity or function as mandated and regulated by the HIPAA Privacy Rule.

Getting compliance right is complicated

While there is no ambiguity about the definition of a Business Associate; what is vague and confusing is the set of roles, responsibilities and requirements expected from a BA. HIPAA has a lot of expectations from the Business Associate. It expects total and complete compliance with the requirements it has set out for Business Associates.

The HITECH Act has recently made changes and updates, raising the bar of expectations from Business Associates. The reasoning for these changes is that the role of the Business Associate is critical, and its functions need to keep changing from time to time to accommodate the changes in technology, best practices, etc. As a result, it has extremely stringent mandates regarding the way a Business Associate handles and uses health information, which is confidential and highly valuable.

Compliance is not negotiable

A Business Associate has to show compliance with a wide range of regulatory requirements. The core areas of HIPAA compliance, such as privacy obligations, security standards, and breach notification requirements, are all where the Business Associate’s work is heavily regulated. A small deviation is viewed very seriously by the OCR. Punitive actions from the OCR are damaging to the Business Associate. The only way of avoiding these penal actions is to be completely compliant with the HIPAA expectations.

All these do not mean that Business Associates should dread HIPAA compliance implementation. They can become successful at their business if they get a complete grasp of HIPAA’s compliance requirements. They need clarity on a number of areas. Once their problem areas are addressed, they are sure to become successful in their business.

Come and get complete understanding of HIPAA compliance for Business Associates

It is with the aim of imparting this understanding that GlobalCompliancePanel, a leading provider of professional trainings for all the areas of regulatory compliance, will be organizing a two-day seminar. Jay Hodes, who is a leading expert in HIPAA compliance and President of Colington Consulting, which provides HIPAA consulting services for healthcare providers and Business Associates, will be the Director of this seminar.

In order to get a complete grasp of the compliance requirements that HIPAA has for Business Associates, please register for this highly valuable seminar by logging on to HIPAA’s compliance expectations from Business Associate.

Total understanding of the requirements for Business Associates

The main aim of this course is to clear the confusions about the roles, requirements and responsibilities of the Business Associate, a role that is often shrouded in haziness. it is only when this is done that Business Associates will have the confidence to enter into contracts for providing services as a vendor or subcontractor. Jay will equip participants with complete understanding of what they must put in place to meet these requirements. In other words, he will help them get complete clarity on HIPAA compliance regulations for Business Associates.

The seminar will be very in-depth, as Jay will start with an understanding of the basics, such as why HIPAA was created, which will help participants get to the deeper aspects of HIPAA compliance requirements. Over the course of these two days, Jay Hodes will cover the following areas at this seminar:

  • Why was HIPAA created?
  • Who Must Comply with HIPAA Requirements?
  • What are the HIPAA Security and Privacy Rules?
  • What are the Consequences of being a Business Associate
  • What is a HIPAA Compliance Program for a Business Associate?
  • What is a HIPAA Risk Management Plan?
  • What is a HIPAA Risk Assessment?
  • What is the Role of the HIPAA Security Official?
  • What are HIPAA training requirements?
  • What is a HIPAA data breach and what happens if it occurs?
  • What are the penalties and fines for non-compliance and how to avoid them
  • Case Examples of HIPAA Data Breaches
  • Creating a Culture of Compliance
  • Q&A.