Covered entities have several requirements under the Privacy Rule. The purpose of the rule is to protect and secure individually identifiable patient information and the covered provider has the ultimate responsibility for HIPAA compliance. Compliance with the Privacy Rule was required on April 14, 2003.

According to the OCR’s HIPAA Audit Program Protocol for covered entities on Privacy Rule requirements, the following processes, controls and policies will be reviewed:

• Notice of Privacy Practices for PHI
• Rights to request privacy protection for PHI
• Access of individuals to PHI
• Administrative requirements
• Uses and disclosures of PHI
• Amendment of PHI
• Accounting of disclosures

A couple of important aspects of the rule involve practical steps: assigning a privacy/security officer and staff training.

In a smaller practice, one individual may serve the roles of privacy and security officer, but the description of the duties should be well documented. Staff should be aware of who is serving these important roles. The privacy and security officer should develop, document and maintain policies and procedures, and work with the IT team and EHR vendors.

Staff training and education on the office HIPAA policies and procedures should be ongoing to make sure staff is aware of their responsibilities to keep the patient information private and secure. For instance, a covered entity must obtain an individual’s written authorization for any use or disclosure of PHI that is not related to treatment, payment or healthcare operations with a few otherwise permitted exceptions. Reasonable efforts should be made by the covered entity to disclose the minimum amount of PHI necessary for the intended purpose, and the access to PHI should only be designated to those employees with duties requiring access.

Office policies and procedures should be reviewed and updated as needed to be sure that every possible system is in place to secure and protect all PHI, which under the Privacy Rule applies to any PHI-oral, paper or electronic. Most importantly, the staff must be continually educated about any changes to existing Privacy policies and procedures.