How does HIPAA compliance affect data sharing?

Under the HIPAA Privacy Rule, which became enforceable in 2003 under the U.S. Office for Civil Rights, (some of) your identifiable health information is required to be protected from being shared or accessed without your permission. Your identifiable health data, called Protected Health Information (PHI), includes anything your doctor or other health care provider puts in your medical record, as well as any conversations your provider has with other doctors, nurses and other medical professionals. It also includes any of your billing information, as well as any identifiable information your health plan has about you in its computer systems [source: HHS].

Under the HIPAA Security Rule, how your personal information is electronically stored, shared and accessed is protected. Eligible electronic transactions include: claims and encounter information, payment and remittance advice, claims status, eligibility, enrollment status, referrals and authorizations, coordination of benefits and premium payment [source: Centers for Medicare & Medicaid Services]. Covered entities are legally obligated to follow the rules of HIPAA-covered transactions. They, and those they contract to do business with, are all required to sign a legal contract agreeing to protect your information before sharing or accessing your data -- whether it's an online transaction, accessing your records on a tablet or another electronic administrative transaction. Covered entities and their business associates are also responsible for having not only administrative safeguards such as documented policies and employee training for protecting electronic health data, but technical and physical safeguards as well, such as data backup, data encryption and security systems. They're also responsible for disclosing why there is a need to access your health information and what the intended purpose is -- every time.

Outside of covered entities, HIPAA law doesn't apply. That means your employer doesn't need to worry about keeping any of your health data private, nor do workers compensation providers, life insurance providers, school districts, state agencies (such as child protective services), law enforcement agencies and other municipal offices. The account manager who uses a computer to electronically verify your insurance eligibility is engaging in a HIPAA-protected action, and must comply with HIPPA confidentiality rules -- but HIPAA only applies when the transaction is electronic; if the account manager used the phone to verbally confirm your insurance eligibility, HIPAA rules wouldn't apply to the exchange of PHI.

Under some circumstances, HIPAA allows for some of your protected health information to be shared without your permission. Your PHI may be shared without your authorization in an emergency situation -- including emergency medical treatment, but also in the event of bioterrorism or any public health threat. Exceptions to HIPAA also include instances such as public health surveillance (such as collecting information for local flu reports), investigations (such as an emergency medical center reporting a gunshot wound) and research -- even in some health care situations such as interventions [source: CDC]. This information is collected into what is called a "limited data set" (LDS); limited data sets include limited yet personal information about you: your age (in years, months, days or hours), relevant dates (including your date of birth and date of death, and also admission and discharge dates, if applicable) and your basic geographic data (zip code or city and state of residence).

The list of information that isn't allowed in a limited data set is much greater. Under the Privacy Rules of HIPAA the following 16 identifiable pieces of information can't be included in an LDS: names, Social Security numbers, physical addresses (street addresses) and phone numbers (including fax numbers), e-mail addresses, URLs and IP address numbers, vehicle identifiers (including serial numbers and license plates), as well as full-face photos (or any comparable images) and biometric identifiers (such as your fingerprints). Additionally, no account numbers, medical records numbers, health plan beneficiary numbers, certificate license numbers nor any device identifiers (including serial numbers) can be included in a limited data set [source: Johns Hopkins Medicine].

Despite these HIPAA rules in place regarding our medical records, 83 percent of Americans still have privacy and security-related concerns when it comes to their medical records, and nearly 70 percent don't want to have their health information digitized, period [source: Xerox]. So what happens when those fears are validated -- what happens when there's a breach?

If or when a PHI breach does happen, which is often the result of computer theft, according to the Breach Notification Rule, the affected patient (or patients) must be notified, and the incident reported to the Secretary of the U.S. Department of Health & Human Services (HHS). Similarly, if an individual wants to report a privacy violation, they can report the breach to either the covered entity (or business associate) responsible or to the HHS -- or both. Depending on the circumstance, HIPAA violations may result in civil penalties such as fines (called civil money penalties) or in criminal penalties that include not only fines but imprisonment.