1. HIPAA AND PATIENT MEDICAL RECORD
CONFIDENTIALITY
F E D E R A L C I V I L R I G H T S L AW S A N D T H E H E A LT H
I N S U R A N C E P O R TA B I L I T Y A N D A C C O U N TA B I L I T Y A C T
( H I PA A ) P R I VA C Y R U L E , TO G E T H E R P R O T E C T Y O U R
F U N D A M E N TA L R I G H T S O F N O N D I S C R I M I N AT I O N A N D
H E A L T H I N F O R M A T I O N P R I V A C Y. C I V I L R I G H T S H E L P T O
P R O T E C T Y O U F R O M U N FA I R T R E AT M E N T O R
D I S C R I M I N AT I O N , B E C A U S E O F Y O U R R A C E , C O L O R ,
N A T I O N A L O R I G I N , D I S A B I L I T Y, A G E , S E X ( G E N D E R ) , O R
RELIGION. FEDERAL LAWS ALSO PROVIDE CONSCIENCE
P R O T E C T I O N S F O R H E A LT H C A R E P R O V I D E R S .
T H E P R I VA C Y R U L E P R O T E C T S T H E P R I VA C Y O F Y O U R
H E A LT H I N F O R M AT I O N ; I T S AY S W H O C A N L O O K AT A N D
R E C E I V E S Y O U R H E A LT H I N F O R M AT I O N , A N D A L S O G I V E S
Y O U S P E C I F I C R I G H T S O V E R T H AT I N F O R M AT I O N . I N
A D D I T I O N , T H E PAT I E N T S A F E T Y A C T A N D R U L E
E S TA B L I S H A V O L U N TA R Y R E P O R T I N G S Y S T E M T O
E N H A N C E T H E D ATA AVA I L A B L E T O A S S E S S A N D R E S O LV E
PAT I E N T S A F E T Y A N D H E A LT H C A R E Q U A L I T Y I S S U E S A N D
P R O V I D E S C O N F I D E N T I A L I T Y P R O T E C T I O N S F O R PAT I E N T
SAFETY CONCERNS.

2. HEALTH INFORMATION PRIVACY
The Office for Civil Rights enforces the HIPAA Privacy Rule,
which protects the privacy of individually identifiable
health information; the HIPAA Security Rule, which sets
national standards for the security of electronic protected
health information; and the confidentiality provisions of
the Patient Safety Rule, which protect identifiable
information being used to analyze patient safety events
and improve patient safety.
The Standards for Privacy of Individually Identifiable Health
Information (“Privacy Rule”) establishes, for the first
time, a set of national standards for the protection of
certain health information. The U.S. Department of Health
and Human Services (“HHS”) issued the Privacy Rule to
implement the requirement of the Health Insurance
Portability and Accountability Act of 1996 (“HIPAA”).

3. THE PRIVACY RULE
Standards address the use and disclosure of
individuals’ health information—called
“protected health information” by organizations
subject to the Privacy Rule — called “covered
entities,” as well as standards for individuals'
privacy rights to understand and control how
their health information is used. Within HHS,
the Office for Civil Rights (“OCR”) has
responsibility for implementing and enforcing
the Privacy Rule with respect to voluntary
compliance activities and civil money penalties.

4. ORGANIZATIONAL POLICIES AND REGULATIONS
• All staff members should have training at least annually on
confidentiality especially when the staff has access to personal
information; the training should include HIPAA rules and regulations.
Staff should know that there can be serious ramifications for violating a
patient’s privacy.
• All employees that have access to personal information should be
required to attend the annual training. During the meeting they should
be given an employee handbook that address confidentiality and the
employees should sign a copy for their personnel file.
• Training should include a review of applicable Case Studies of various
types of violations of medical record confidentiality and HIPAA
regulations.
• Role playing exercises should be conducted to teach personnel what to
do in the event they witness violations and misuse of patient records.
• Training should incorporate real life examples of potential
confidentiality violations and how to avoid mistakes.
• A Privacy Officer should be used to monitor and to make sure that
security measures are maintained, that all the applicable state and
federal laws are enforced, and that all organizational policies and
procedures are followed.

5. SECURITY MEASURES
• Background checks for all employees
• Limited Access to Records
• Login Authentication
• Monitor Login Frequency
• Maintain Chain-of-Custody
• List of all Personnel Associated with Patient
Care
• Maintain Attendance Records
• Record Login Dates and Time

6. REFERENCES
Summary of the HIPAA Privacy Rule (2012) –
U. S. Department of Health and Human
Services. Retrieved June 28, 2012 from
website:
http://www.hhs.gov/ocr/privacy/hipaa/unders
tanding/ summary/index.html