Protected Health Information is crucial for pretty much anyone working in healthcare, regardless of whether you work for a small practice or a large healthcare provider. What is Protected Health Information, more exactly, why does it matter so much, and how to tackle it?\u00a0<\/p>\r\n\r\n\r\n\r\n
Read on to find out more.<\/p>\r\n\r\n\r\n\r\n
In short, Protected Health Information (PHI) is defined as individually identifiable health information that is transmitted or maintained in any medium (traditional or digital).\u00a0 This can include \u201cany oral, written, or electronic communication of information about a patient that identifies him or her and that arises out of the provision of healthcare.\u201d\u00a0<\/p>\r\n\r\n\r\n\r\n
To define what is considered PHI, we must first make a pit-stop and define HIPAA (also known as the Health Insurance Portability and Accountability Act).\u00a0<\/p>\r\n\r\n\r\n\r\n
In essence, all healthcare-related documents, including laboratory reports, medical histories, test results, and prescription records are protected by law under the Health Insurance Portability and Accountability Act (HIPAA).\u00a0<\/p>\r\n\r\n\r\n\r\n
This law requires covered entities (organizations that transmit or store health information) to comply with a set of strict rules governing how this data can be used and shared.\u00a0<\/p>\r\n\r\n\r\n\r\n
So, that being out of the way, what is PHI?\u00a0<\/p>\r\n\r\n\r\n\r\n
Let’s dig a little deeper into this definition and take it apart, piece by piece. “Identifiable health information” means “any information that identifies an individual.” This could be a patient’s name, for example, but also home addresses, email addresses and other similar bits of information fall in the same category.<\/p>\r\n\r\n\r\n\r\n
It can also include healthcare identifiers, such as medical device numbers, medical record numbers, health plan numbers, or\u00a0 specific dates (of admission, discharge, and so on).\u00a0<\/p>\r\n\r\n\r\n\r\n
It’s important to keep in mind that the organization which houses PHI is in control of its use and handling, as well as responsible for what happens with all this data.\u00a0<\/p>\r\n\r\n\r\n\r\n
Obviously, covered entities that hold other organizations’ PHI must treat it with care, and comply with all applicable laws regarding how they can use and disclose PHI.\u00a0<\/p>\r\n\r\n\r\n\r\n
Knowing what falls under the “Protected Health Information” category is important, but it\u2019s equally important to know what doesn’t. To be more specific, information like employee information of someone who is covered, but which is not information related to their healthcare would not qualify as PHI. Furthermore, health data that isn\u2019t personally identifiable or not shared with a covered entity doesn’t qualify as PHI either.\u00a0<\/p>\r\n\r\n\r\n\r\n
To make things clearer, let’s look at a few examples of what qualifies as PHI. There are 18 categories of data that fall under the Protected Health Information definition (also known as “HIPAA identifiers”<\/a>). Some of them include name, address, Social Security Number, and even device identifiers and serial numbers.\u00a0<\/p>\r\n\r\n\r\n\r\n Whatever doesn’t qualify under any of the above isn\u2019t considered to be PHI.\u00a0<\/p>\r\n\r\n\r\n\r\n In some situations, information that would otherwise be qualified as Protected Health Information can be de-identified for specific purposes (such as for clinical trials<\/a> or quality reviews, for example). To do this, PHI data has to be de-identified. This means that it doesn\u2019t have to identify a patient, not belong to a living person, or not be obtained through intervention or interaction). Once the data has been de-identified, it no longer falls under HIPAA.\u00a0<\/p>\r\n\r\n\r\n\r\n Furthermore, there are also situations where PHI has to be divulged, such as for example, when healthcare professionals alert law enforcement about a suspicious death.\u00a0<\/p>\r\n\r\n\r\n\r\n Now that we know what is (and isn’t) Protected Health Information, how do you make sure you guard yours as efficiently as possible<\/a>?\u00a0<\/p>\r\n\r\n\r\n\r\n Some of the absolute basics you should keep in mind include the following:\u00a0<\/p>\r\n\r\n\r\n\r\n Data hygiene and clear data management processes are essential to making sure you abide by HIPAA every step of the way.\u00a0<\/p>\r\n\r\n\r\n\r\n The fewer people have access to this kind of information, the fewer risks you face.\u00a0<\/p>\r\n\r\n\r\n\r\n Aim to see if any PHI is stored on any device, and either eliminate or secure it.<\/p>\r\n\r\n\r\n\r\n Additionally, it\u2019s imperative to make sure that the systems you use are HIPAA compliant and encrypted when transmitting data.\u00a0<\/p>\r\n\r\n\r\n\r\n Always make sure your employees are fully trained in HIPAA and that everyone follows clear procedures when it comes to all categories of PHI.<\/p>\r\n\r\n\r\n\r\n Another basic step is to keep a log of all PHI transmissions. This will allow you to trace data at every point of its life cycle.\u00a0<\/p>\r\n\r\n\r\n\r\n Likewise, remember to dispose of PHI documents correctly (if they are in a physical format, they should be destroyed, and if they are electronic, they should be properly deleted).\u00a0<\/p>\r\n\r\n\r\n\r\n Obviously, these are just some of the tips you should keep in mind when it comes to HIPAA and PHI. Entire bookshelves could be filled on the subject, but if we have to narrow it down to a nutshell, the advice in this article is crucial (and so are proper HIPAA-compliant forms<\/a> that our form builder<\/a> features, just sayin’).<\/p>\r\n","protected":false},"excerpt":{"rendered":" Protected Health Information is crucial for pretty much anyone working in healthcare, regardless of whether you work for a small practice or a large healthcare provider. What is Protected Health Information, more exactly, why does it matter so much, and how to tackle it?\u00a0 Read on to find out more. What is Protected Health Information?\u00a0 […]<\/p>\n","protected":false},"author":31,"featured_media":1008,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":""},"categories":[20],"tags":[],"class_list":["post-1006","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-ultimate-guides"],"yoast_head":"\nSharing Information without Giving Out the Identity\u00a0<\/h2>\r\n\r\n\r\n\r\n
How to Guard Protected Health Information<\/h2>\r\n\r\n\r\n\r\n
Be very mindful of your data collection processes<\/h3>\r\n\r\n\r\n\r\n
Limit who has access to PHI<\/h3>\r\n\r\n\r\n\r\n
Regularly review data\u00a0<\/h3>\r\n\r\n\r\n\r\n
Use Adequate Systems\u00a0<\/h3>\r\n\r\n\r\n\r\n
Train Employees\u00a0<\/h3>\r\n\r\n\r\n\r\n
Keep Track of PHI Transmission<\/h3>\r\n\r\n\r\n\r\n
Dispose Correctly\u00a0<\/h3>\r\n\r\n\r\n\r\n