HIPAA and PHIPA Privacy Laws

Privacy decisions begin with the information, the organization holding it, and the purpose for access—not with whether the nurse is curious or whether the patient is well known. Under HIPAA, protected health information (PHI) is individually identifiable health information held or transmitted by a covered entity or business associate in any form. A printed medication list, a spoken report in an elevator, a photograph of a wound, and an electronic health record entry can all be PHI. Oral disclosure is not exempt simply because no screen or paper is involved. HIPAA applies to covered entities: health plans, health care clearinghouses, and health care providers that conduct specified standard transactions electronically. Business associates are directly regulated for their HIPAA responsibilities. A nurse employed by a hospital or clinic generally acts as part of that organization's workforce. The nurse must follow HIPAA, state law, and organizational policy, but is not ordinarily a separate covered entity merely because the nurse can view PHI. HIPAA is a federal floor, not a ceiling. A state may impose stricter protections or additional consent requirements for information...