How SimplePractice protects your privacy through de-identification
The Health Insurance Portability and Accountability Act of 1996 (HIPAA) effectively changed the landscape of healthcare data, specifically with how health information is protected. When passed, the major underpinnings of the legislation focused on health insurance portability and administrative simplification, with privacy protections added through later rules that limit how health information can be used and disclosed without the patient’s authorization.
HIPAA is a critical aspect of clinical operations because it is a federal law that applies to covered entities, including health care providers who conduct certain transactions electronically, and their business associates. As providers, we must ensure that we implement practices that promote the protection of protected health information (PHI).
As Marjorie Bowman and Rose Maxwell wrote in a 2018 Journal of Biomedical Informatics article, PHI is “any information in the medical record that can be used to identify an individual and was created, used, or disclosed in the course of providing a health care service.”
Essentially, if information relates to the provision of a health care service and identifies a person, then the data is considered within the realm of PHI. Common forms of identifiable health information regarding a person can include their name, their home address, their date of birth, their Social Security number, or any other data point that points to the identity of the individual.
Just as important is knowing what is not considered PHI under HIPAA, which this guide covers.
PHI vs. PII: What’s the difference?
The PHI vs. PII difference comes down to context: all PHI is PII (personally identifiable information), but PHI is identifiable health information held by a covered entity or business associate. For example, a person’s address on a billing statement for their mortgage is PII. It is considered both PII and PHI when that same address is included in a billing statement for a health care service from a covered entity.
HIPAA compliance requirements focus on PHI, but understanding the PHI vs. PII difference helps clinicians recognize which sensitive information falls under HIPAA and which is protected by other data privacy laws.
What is the HIPAA Privacy Rule?
HIPAA’s requirements are carried out through three main rules that covered entities and business associates are required to follow.
The U.S. Department of Health and Human Services outlines that covered entities include health plans, health care clearinghouses, and health care providers. Business associates are “persons, other than a workforce member of a covered entity, that are engaged by a covered entity to carry out certain health care activities and functions or to provide certain services that involve the use or disclosure of PHI.” Examples of business associates include health app developers, IT contractors, third-party administrators that help process claims, or attorneys that come into contact with sensitive health information.
The three rules are the Privacy Rule, the Security Rule, and the Breach Notification Rule. The Privacy Rule sets the standards for keeping PHI safe; the Security Rule outlines safeguards that are required to keep the information safe (administrative, physical, and technical); and the Breach Notification Rule sets the requirement that if a breach of unsecured PHI occurs, a covered entity must notify affected individuals and the Department of Health and Human Services, and a business associate must notify the covered entity.
The Privacy Rule showcases when, where, and how PHI can be used. The Privacy Rule sets limits on the use and disclosure of PHI, requires patient authorization for many uses and disclosures outside of treatment, payment, and health care operations, and lastly, gives patients the right to access their health records. The Privacy Rule is essential because this is the part of HIPAA that legislates the parameters of PHI. To maintain proper HIPAA compliance requirements, it’s crucial to know what is considered PHI, what is not, and how the de-identified data HIPAA safe harbor method removes information from PHI status.
What is not considered PHI under HIPAA?
The ability to discern what constitutes PHI versus what doesn’t fall within the realm of PHI will support HIPAA compliance requirements at a practice and clinician level. The de-identification of data takes information outside HIPAA’s definition of PHI, and the de-identified data HIPAA safe harbor method is one of two accepted methods, alongside expert determination.
Safe harbor method: de-identified data
When applying the de-identified data HIPAA safe harbor method, you remove 18 HIPAA identifiers. The concept is that once these items have been removed, the data is no longer identifiable, serving as a prime example of what is not considered PHI under HIPAA. The list of 18 identifiers is:
Name
Geographic data smaller than a state
Dates (all parts of the data except the year) and ages over 89
Telephone numbers
Fax numbers
Email addresses
Social Security numbers
Medical record numbers
Health plan beneficiary numbers/Insurance member IDs
Account numbers
Certificate or license numbers
Vehicle identifiers
Device identifiers and serial numbers
Web URLs
IP addresses
Biometric identifiers (fingerprints or voice prints)
Full-face photographs
Any other unique identifying code, characteristic, or number
If even one piece of identifiable information remains in a data set, that data is still considered PHI. De-identified data must have all identifiers removed so that the information does not tie back to a specific individual. To meet safe harbor, you also can’t have actual knowledge that the remaining information could identify a person. HIPAA recognizes a second method, expert determination, in which a qualified expert finds the risk of re-identification to be very small.
How to handle employment records
Employment records that include some aspects of health information are not considered PHI under HIPAA when held by an employer in its role as an employer. In fact, the employment records HIPAA exclusion specifically removes them from what is considered PHI. The same is true for a covered entity’s own personnel files, such as a clinic’s records about its staff. Its patient records are still PHI.
Examples of employment records could be sick days, leave requests, or accommodations requested by the employee. Privacy and confidentiality efforts pertaining to these records are still covered by other types of legislation, such as the Americans with Disabilities Act (ADA) or Family and Medical Leave Act (FMLA).
How to handle education records
Education records are a part of the exclusion to the HIPAA Privacy Rule. Even though some school systems could qualify as covered entities, HIPAA specifically excludes education records that are covered under the Family Educational Rights and Privacy Act (FERPA).
FERPA was passed in 1974 to create guidelines for how educational records and student information is protected. Student education records can include academic records, student identification information, and medical information pertaining to interactions with the school clinic provider. As such, education records are excluded, providing another clear instance of what is not considered PHI under HIPAA.
What is the 50-year rule under HIPAA?
An additional example of information that is not considered PHI under HIPAA is data that belongs to a person who has been deceased for over 50 years. When a person dies, their existing PHI continues to be protected for 50 years after death.
The rule dictates that the deceased person’s personal representative can access their data during the protection window. After that point in time, the information is no longer PHI under HIPAA, though state laws may still limit access.
Implications for clinical practice
Understanding what data is considered PHI under HIPAA helps ensure that your clinical operations are in alignment with HIPAA compliance regulations.
Fortunately, SimplePractice offers multiple layers of encryption and has achieved HITRUST certification—a widely used security framework. Other security tools and practices used by SimplePractice for protection include multi-factor authentication, firewall systems, and encryption.
Keep in mind that the employment records HIPAA exclusion applies only to records held in an employer’s role as an employer, so treatment records you maintain for a client who is also an employee remain PHI.
With these tools and your own protection of account and data systems, PHI can be secure and trusted by clients in your care.
Sources
American Psychological Association. (n.d.). HIPAA frequently asked questions.
Bowman, M. A., & Maxwell, R. A. (2018). A beginner’s guide to avoiding protected health information (PHI) issues in clinical research: With how-to’s in REDCap data management software. Journal of Biomedical Informatics.
University of California, Berkeley, Office for Protection of Human Subjects. (n.d.). HIPAA PHI: Definition of PHI and list of 18 identifiers.
U.S. Department of Education. (n.d.). Family Educational Rights and Privacy Act (FERPA).
U.S. Department of Health and Human Services. (n.d.). Business associates.
U.S. Department of Health and Human Services. (n.d.). Covered entities and business associates.
U.S. Department of Health and Human Services. (n.d.). Guidance regarding methods for de-identification of protected health information in accordance with the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule.
U.S. Department of Health and Human Services. (n.d.). Health Insurance Portability and Accountability Act of 1996.
U.S. Department of Health and Human Services. (n.d.). The HIPAA Privacy Rule.
U.S. Department of Health and Human Services. (n.d.). Who must comply with HIPAA privacy standards?
How SimplePractice streamlines running your practice
SimplePractice is HIPAA-compliant practice management software with everything you need to run your practice built into the platform—from booking and scheduling to insurance and client billing.
If you’ve been considering switching to an EHR system, SimplePractice empowers you to run a fully paperless practice—so you get more time for the things that matter most to you.
Try SimplePractice free for 30 days. No credit card required.
