Health care operations include functions such as: (a) quality assessment and improvement (b) competency assessment, including performance evaluation, credentialing, and accreditation (c) medical reviews, audits, or legal services (d) specified insurance functions and (e) business planning, management, and general administration.

Payment includes activities of a health care provider to obtain payment or to receive reimbursement for the provision of health care to an individual.

Treatment is the provision, coordination, or management of health care and related services for an individual, including consultation between providers and referral of an individual to another provider for health care.

A covered entity may use and disclose protected health information for its own вЂњ treatment, payment, and health care operations.вЂќ.

A covered entity may disclose PHI to the individual who is the subject of the information.

These purposes include, but are not limited to, the following: Permitted Uses or Disclosures of PHI Without Authorization:Д®xtensive provisions of the Privacy Rule describe circumstances under which covered entities are permitted to use or disclose PHI, without the authorization of the individual who is the subject of the protected information. ( Note: One must consult not only HIPAA but also other relevant federal privacy laws (such as regulations pertaining to Medicaid and federally funded substance abuse treatment programs), as well as State privacy laws (including the Mental Hygiene Law- section 33.13, the Public Health Law, the Education Law licensing provisions, and the Civil Practice Laws and Rules), to determine whether a disclosure of medical information is permissible in a given circumstance.)

The Privacy Rule supersedes State law, but State laws which provide greater privacy protections or which give individuals greater access to their own PHI remain in effect.

A covered entity must provide individuals (or their personal representatives) with access to their own PHI (unless there are permitted grounds for denial), and must provide an accounting of the disclosures of their PHI to others, upon their request.

A HIPAA-compliant Authorization must contain specific information required by the Privacy Rules.

as authorized by the person (or personal representative) who is the subject of the health information.

as the Privacy Rule permits or requires or.

Generally, a covered entity may not use or disclose PHI to others, except:

A major purpose of the Privacy Rule is to define and limit the circumstances under which an individual's PHI may be used or disclosed by covered entities.

The Privacy Rule protects all вЂњ protected health informationвЂќ ( PHI), including individually identifiable health or mental health information held or transmitted by a covered entity in any format, including electronic, paper, or oral statements.

Covered entities include almost all health and mental health care providers, whether they are outpatient, residential or inpatient providers, as well as other persons or organizations that bill or are paid for health care. The Privacy Rule applies to вЂњ covered entitiesвЂќ which generally includes health plans and health care providers who transmit health information in electronic form.

The Rule is intended to provide strong legal protections to ensure the privacy of individual health information, without interfering with patient access to treatment, health care operations, or quality of care. The HIPAA Privacy Rule (45 CFR Parts 160 and 164) provides the first comprehensive Federal protection for the privacy of health and mental health information. State statutes which provide more stringent protections of health care privacy remain in effect even after HIPAA, and therefore this document includes a few relevant references to requirements in New York State's mental health confidentiality statute (section 33.13 of the Mental Hygiene Law). HIPAA required the federal Department of Health and Human Services ( HHS) to develop regulations to implement these privacy requirements, called the Privacy Rule, which became effective on April 14, 2003.

This document provides guidance about key elements of the requirements of the Health Insurance Portability and Accountability Act ( HIPAA), federal legislation passed in 1996 which requires providers of health care (including mental health care) to ensure the privacy of patient records and health information. Mental health providers and other covered entities should not rely on this summary as a source of legal information or advice and should consult with their own attorney or HIPAA Privacy Officer for specific guidance.) (Note: The information provided below is a summary and intended for general informational purposes.

Hipaa compliance forms employees