Among healthcare professionals and auxiliary providers, HIPAA compliance maintains the privacy and security of patient information. And by limiting the amount of patient information that individuals and organizations access, industry enforcement agencies can better protect patient privacy. The foundation for patient data safeguarding lies in the HIPAA minimum necessary rule.
What is the HIPAA Minimum Necessary Rule?
Among authorized agencies that interact with protected health information (PHI), the U.S. Department of Health and Human Services (HHS) moderates the frequency and scope with which patient data travels across multiple systems. The more that a patient’s personal and medical information move around, the greater the risks of lost or stolen data.
A key component of the HIPAA Privacy Rule is that all covered entities only share the “minimum necessary” amount of patient information to carry out their duties. What’s challenging about the HIPAA minimum necessary standard is that each covered entity must determine what information constitutes the “minimum necessary” when establishing company policies and procedures.
“The terms ‘reasonable’ and ‘necessary’ are open to interpretation which can cause some confusion. The use of these terms leaves it to the covered entity’s judgement to decide what information to disclose and the efforts required to restrict access to the information. Any decisions that are made with respect to the minimum necessary standard should be supported by a rational justification, should reflect the technical capabilities of the covered entity, and should also factor in privacy and security risks.” – The HIPAA Journal
Despite the flexibility that HIPAA grants covered entities when it comes to “minimum necessary” methodology, the HSS Office of Civil Rights (OCR) is very rigid when it comes to enforcing HIPAA compliance. If an OCR investigation reveals that a covered entity shared more PHI than was necessary, and that the oversharing led to a breach, then that covered entity faces serious penalties.
Assess your HIPAA / HITECH compliance
Protected Health Information (PHI)
Protected health information, or PHI, is any patient-specific information that, if disclosed, leads to identifying that patient. In the wrong hands, PHI can result in altered records or stolen identities. Any information about a patient that in no way identifies that patient – in other words, is anonymous and vague – does not qualify as PHI.
That said, covered entities and authorized users of PHI must be very careful when extracting non-PHI data from PHI records for general purposes such as medical research. More importantly, agencies that collect and exchange PHI to fulfill their responsibilities must do so with extreme care, particularly when it comes to working with business associates and employee access.
Adhering to the HIPAA minimum necessary rule means that covered entities must vet their employees and contractors carefully. Covered entities are liable for any internal HIPAA violations among their employees and business associates. Being HIPAA compliant means performing routine audits on the collection, storage, and distribution of PHI.
Who the Minimum Necessary Rule Applies to
The HIPAA minimum necessary rule applies to all covered entities and their business associates. These organizations are permitted under the HIPAA Privacy Rule to gather, store, and distribute PHI to serve patients and their medical providers.
All covered entities fall into one of three categories:
- Health Plan Providers
- Healthcare Providers
- Healthcare Clearinghouses
A Quick Guide on Covered Entities
Each covered entity uses PHI to fulfill their obligations on behalf of patients and medical professionals. The entire healthcare industry relies on patient information management, and this means that covered entities create processes that gather, store, and share specific patient information fluidly and securely.
There is no denying that each covered entity must handle PHI extensively. But in each case, covered entities are liable to the HIPAA minimum necessary rule. When going about their duties, each organization must ensure that they are only sharing the minimum amount of PHI required to fulfill their obligations. Any negligence, intentional or unintentional, can lead to unnecessary risks resulting in lost or stolen data.
Health Plan Providers
Under the HIPAA Privacy Rule, health plans are covered entities responsible for accessing medical invoices and issuing payments in a timely manner. Health plan providers include insurance companies providing general health insurance, along with vision, dental, HMOs, prescription, and other “supplement insurers.” Medicaid/Medicare providers and group health plan agencies also fall under the health plan category of covered entities. There are a number of exceptions within this category, and they are outlined in the OCR Privacy Rule Summary.
-
- What do health plan providers need PHI to do? Without health plans in the United States, the majority of patients would not be able to pay for medical treatment. Insurance companies and similar organizations are authorized to collect the necessary amount of information to validate treatment costs and issue payment to healthcare providers. In the case of workplace accidents, health plan providers frequently use PHI to process workers compensation claims.
- Where do health plan providers get PHI from? Health plan providers collect PHI from their clients during the application and onboarding process. These providers also receive PHI from doctors and healthcare facilities that treat one of their clients. This PHI includes treatment details, such as what treatment the healthcare provider issued, the dates for treatment, invoice details, and costs.
- Where might health plan providers send PHI? Many health plan providers partner with contractors and professional services. Any third-party vendor with access to the health plan provider’s network will likely come into contact with PHI. HIPAA recognizes this likelihood and urges health plan providers to minimize the amount of PHI exposure to outsiders. Regardless, all business associates of health plan providers must also maintain HIPAA compliance to protect patient privacy.
Download Our HIPAA Compliance Checklist
Healthcare Providers
Every medical professional or facility providing healthcare-related services fall under the Healthcare Provider category within HIPAA Privacy Law. Healthcare providers are typically divided between institutional or non-institutional providers.
Hospitals and medical facilities are institutional providers. Non-institutional providers include private medical practices, such as the typical doctor’s office. These medical practices include every field of medicine and healthcare. Naturally, healthcare providers manage the most significant volume of PHI among all other covered entity types.
-
- What do healthcare providers need PHI to do? The primary concern of healthcare providers is assisting the patient, often in the midst of a health crisis. Secondarily, these providers require payment for their medical services. PHI assists providers on both fronts and ensures that every patient receives the correct treatment and/or diagnostics.
- Where do healthcare providers get PHI from? Healthcare providers collect PHI directly from patients and those serving patients. Institutional providers may access PHI through non-institutional providers, and vice versa. In order to serve the patient, PHI sharing among various medical providers must be seamless, even amidst minimum rule restrictions. These providers may also perform special investigations on certain cases and environments for the purpose of medical research and advanced diagnostics.
- Where might healthcare providers send PHI? Healthcare providers send select PHI to other covered entities to seek payment for their services. Medical professionals often field authorization requests from friends, family, or attorneys who are trying to learn more about the condition and treatment of a particular patient. Only the patient or authorized agent may grant PHI authorizations before a healthcare provider may disclose PHI to another individual or organization.
Healthcare Clearinghouses
Healthcare clearinghouses act as a go-between for healthcare providers and health plans. These agencies distribute medical coding and billing services to streamline the payment process for healthcare providers.
When treating patients, much of the information involved is not readily available in billable form. For example, insurance companies cannot read doctor’s notes and understand what services they are paying for. Coders convert this “nonstandard information into standard information,” and medical billers move this standard information into an invoice for the benefit of health plan providers.
Healthcare clearinghouses are not always considered covered entities. In many cases, they may actually be business associates of covered entities. According to the HIPAA Privacy Rule,
“Health care clearinghouses will receive individually identifiable health information only when they are providing these processing services to a health plan or health care provider as a business associate. In such instances, only certain provisions of the Privacy Rule are applicable to the health care clearinghouse’s uses and disclosures of protected health information.”
Healthcare clearinghouse agencies that are uncertain about which standards apply to them should consult the Electronic Code of Federal Regulations, 45 C.F.R. § 164.500(b).
-
- What do healthcare clearinghouses need PHI to do? Clearinghouses must convert “nonstandard information into standard information” and oversee billing processes. These organizations allow both healthcare and health plan providers to focus on what they do best – treating patients and paying healthcare providers for their services.
- Where do healthcare clearinghouses get PHI from? In most cases, clearinghouses will collect PHI from healthcare providers. For other scenarios, clearinghouses may assist health plan providers in converting “standard information” into “nonstandard information” for the benefit of healthcare providers.
- Where might healthcare clearinghouses send PHI? As noted above, clearinghouses frequently act as “middleman” agencies between healthcare providers and health plans. As such, there is a certain level of information free flow among these three category organizations. However, with this information free flow comes an even greater accountability to abide by the HIPAA minimum necessary standard.
How the Minimum Necessary Rule Applies to Business Associates
No environment is so relevant to the minimum necessary rule as the exchange and exposure of PHI between covered entities and their associates. Most business associates, according to the HIPAA Privacy Rule, assist covered entities in a very limited capacity and are not considered essential to providing medical treatment or disbursing payment for medical treatment.
Business associates are non-employees of covered entities that provide certain services for the covered entity. By default, these business associates encounter or manage PHI stored in the covered entity’s information network. HIPAA recognizes the inevitability of this scenario, which is one of the main reasons for HIPAA Privacy Law.
Most vendors that fall under this category provide PHI-related services, such as “claims processing, data analysis, utilization review, and billing.” For more information about expectations of these vendors, you can review 45 C.F.R. § 160.103.
Most business associates maintain their own workforce external to the covered entity. These businesses must also maintain HIPAA compliance and adhere to the HIPAA minimum necessary standard governing the use of PHI. Any abuse of privilege among business associates could lead to serious consequences for both the vendor and the covered entity that hired the vendor.
How the Minimum Necessary Rules Applies to Employees
Even within organizations that are authorized covered entities, it is not necessary for every employee to access all PHI within the company database. HIPAA compliance dictates that employees function on a need-to-know basis when it comes to PHI management.
Covered entities are liable for misbehavior among staff members. As such, they must vet their new hires carefully and set up internal safeguards to limit employee exposure to PHI. Even if an employee were to violate company policy and “go rogue,” proper compliance to the HIPAA minimum necessary rule seriously limits the amount of damage that that employee could do.
Are Cybersecurity Intrusions a Violation of the Minimum Necessary Rule?
If a covered entity installs and maintains a reasonable cybersecurity program and still experiences a major security breach, that covered entity is not in violation of the HIPAA minimum necessary rule. The major caveat to this scenario is that covered entities must report the breach to the HHS and also initiate robust incident detection and response measures to minimize the loss of PHI.
In the wake of a covered entity security breach, the HHS OCR may perform an investigation and determine that that organization failed to incorporate a reasonable amount of cybersecurity policies and procedures. Failing to secure PHI against hacks or phishing schemes counts as a violation of HIPAA Privacy Law.
For cybersecurity negligence leading to the loss or unauthorized disclosure of PHI, covered entities face severe penalties from the OCR. These penalties range from fines amounting to a few hundred dollars per infraction to several million dollars annually for many years.
The Importance of Compliance to the HIPAA Minimum Necessary Rule
Covered entities and their business associates must take the HIPAA minimum necessary rule seriously in an effort to protect themselves and patients from lost or stolen data. Working with a HIPAA-compliant security agency can help you establish, maintain, and enforce safeguards pertaining to authorized use of PHI.
RSI Security helps covered entities maintain compliance to HIPAA Privacy Law, including regulations pertaining to the minimum necessary rule. Our cybersecurity teams help covered entities adhere to industry best practices, HIPAA compliance standards, and cutting edge cybersecurity risk management.
Download Our Complete Guide to Navigating Healthcare Compliance Whitepaper
Not sure if your HIPAA or healthcare compliance efforts are up to snuff? Unsure about where to even start? Download RSI Security’s comprehensive guide to navigating the HIPAA and healthcare compliance labyrinth. Upon filling out this brief form you will receive the whitepaper via email.