Education, HIPAA / HITECH Enforcement, Tip of the Week

Did You Know?

Permitted Uses and Disclosures: Exchange for Health Care Operations

45 Code of Federal Regulations (CFR) 164.506(c)(4)

Although the HIPAA regulations have been in effect for quite some time, health care providers frequently still question whether the sharing of health information, even for routine purposes like treatment or care coordination, is permissible under HIPAA.

Health Insurance Portability and Accountability Act (HIPAA) governs how Covered Entities (CEs) protect and secure Protected Health Information (PHI). HIPAA also provides regulations that illustrates the circumstances in which CEs are permitted, but not required, to use and disclose PHI for specific actions without first obtaining an individual’s authorization: including for treatment and for health care operations of the disclosing CE or the recipient CE when the appropriate relationship exists.
Note: Other laws may apply.


This slideshow requires JavaScript.

Permitted Uses and Disclosures_ Exchange for Health Care Operations

Permitted Uses and Disclosures_ Exchange for Treatment

Data Breach, Education, HIPAA / HITECH Enforcement, News Events, OCR HIPAA Audits, Settlements

Recent Enforcement Actions

Recent Enforcement ActionsData Breach Four examples

Just when we thought our information was up to date!

On Tuesday February 13, 2018, the HHS Office for Civil Rights announced that “Consequences for HIPAA violations don’t stop when a business closes”.  Filefax, Inc. located in Northbrook, Illinois is no longer in business after an anonymous complaint that Protected Health Information (PHI)  destined for the shredding/recycling facility was left unattended in an unlocked truck (alleged date February 6 & 9, 2015). OCR’s investigation reported that Filefax, Inc. impermissibly disclosed the PHI of 2,150 individuals at the Filefax parking lot by granting an unauthorized person to remove the PHI from Filefax and leaving it unsecured outside their facility.Filefax Inc

During the 2016 court ruling in an unrelated litigation, a receiver was appointed to liquidate Filefax’s assets for distribution to creditors, etc. The receiver agreed to pay $100,000 monetary settlement and to store/dispose of the remaining medical records discovered at the Filefax’s facility in accordance to HIPAA’s standards.

View the Press Release