Under HIPAA, what are the core requirements for protecting health information in practice?

Prepare for the Business of Healthcare and Health Policy Test. Study with multiple choice questions and explanations to ace your exam!

HIPAA protects health information by establishing two main sets of standards that guide day-to-day handling of PHI: privacy and security. The Privacy Rule limits how PHI can be used and disclosed and gives patients rights over their information. The Security Rule requires concrete safeguards—administrative, physical, and technical—to protect electronic PHI, including things like risk analyses, access controls, audit controls, encryption or de-identification where feasible, and staff training. When a breach happens, the Breach Notification Rule kicks in, requiring prompt notification to affected individuals and, in many cases, to authorities. To make sure partners and vendors also protect PHI, HIPAA requires Business Associate Agreements that spell out safeguards and responsibilities.

Data sharing for care coordination and research is allowed under HIPAA, but within these safeguards—disclosures must follow the minimum necessary standard, disclosures for treatment and care coordination are permitted, and research can proceed with appropriate authorizations or permissions (or with de-identified data). So the statement that HIPAA sets privacy and security standards, requires safeguards, breach notification, and business associate agreements, and influences data sharing for care coordination and research best captures how HIPAA protects health information in practice.