The Health Insurance Portability and Accountability Act of 1996 (HIPAA) is a law that seeks to accomplish many admirable goals. The public may be most familiar with the portion of the law that relates to the portability of health insurance because it has been in effect since 1996. That portion of the law made it possible for individuals to retain some form of health insurance when transferring from one employer to another. Individuals may be less familiar with the portion of the law that relates to Administrative Simplification.
The HIPAA Privacy Regulations place limitations upon covered entities' use of "protected health information" (PHI). Protected health information is information that is individually identifiable and that relates to an individual's past, present, or future medical condition or treatment. The Privacy Regulations also create or formalize several rights patients or enrollees in a health plan have regarding their health information. Patients now have a right to request access to or a copy of their health information, to request an amendment to their health information if they believe their health information is inaccurate, or to request an accounting of the covered entity's uses and disclosures of their health information. Finally, the regulations establish an individual, called a Privacy Officer or Privacy Official, to whom patients or enrollees may address their questions, complaints, or requests.
Additional information regardling HIPPA can be found on the U.S. Department of Health and Human Services website.
If you have further questions or concerns about the HIPAA Privacy Regulations, please contact the university's Privacy Official, Alma Olson by phone at 330-972-6577 or by email at email@example.com
If you have general questions about HIPAA, please contact the Office of General Counsel at 330-972-7830.
The University Board of Trustess adopted University Rule 3359-11-19 Policies and Procedures for Release, Privacy, and Security of Selected Health Information to address issuses created by HIPPA and the way to properly protect health information. The Rule provides for Univesity compliance with HIPPA, designates a University Privacy Office (Alma Olson), develops specific privacy and training procedures for University entities determined to be covered by HIPAA, and guides University employees in HIPAA compliance efforts.
All complaints or questions regarding compliance with the HIPAA Privacy Regulations should be directed to the University Privacy Official, Alma Olson. All patient or enrollee requests for access to, amendment of, copies of, or restrictions to their health information should be directed to the Univeresity Privacy Official, Alma Olson. Any department that receives a subpoena for health information should refer the subpoena to the Office of General Counsel and notify the University Privacy Official, Alma Olson.
While HIPAA only applies to healthcare providers, health plans or healthcare clearinghouses that are covered entities and does not apply to the research component of the University, researchers at The University of Akron should be aware of the HIPAA Privacy rule because it impacts how covered entities use or disclose protected health information. Because of this, the HIPAA Privacy Rule may affect the University's researchers because it will affect their interactions with covered entities.
The HIPAA Privacy Rule protects patient information called Protected Health Information or PHI. PHI is individually identifiable health information, including genetic information, that is created or maintained by covered entities and their business associates. However, several types of individually identifiable health information is not covered by the Privacy Rule. Non-protected health information includes individually identifiable health information that is not created or maintained by a covered entity or its business associates, education records covered by the Family Educational Right and Privacy Act (FERPA) (For more information about FERPA protections on campus, see University Rule 3359-11-08.), and records held by a covered entity in its role as an employer.
|Area of Distinction||HIPAA Privacy Rule||HHS Protection of Human Subjects Regulations||FDA Protection of Human Subjects Regulations|
|Applicability||Applies to HIPAA-defined covered entities, regardless of the source of funding.||Applies to human subjects research conducted or supported by HHS.||Applies to research involving products regulated by FDA. Federal support is not necessary for FDA regulations to be applicable. When research subject to FDA jurisdiction is federally funded, both the HHS Protection of Human Subjects Regulations and the FDA Protection of Human Subjects Regulations apply.|
|Identifiable Information||Defines PHI as individually identifiable health information that is transmitted or maintained in any form or medium (electronic, oral or paper) by a covered entity or its business associates, excluding certain educational and employment records.||Private information must be individually identifiable in order for obtaining the information to constitute research involving human subjects. Individually indentifiable means the identity of the subject is or readily may be ascertained by the investigator or others associated with the information.||Title 21 CFR Parts 50 and 56 do not define individually identifiable health information.|
|Permissions for Research||Authorization||Informed Consent||Informed Consent|
|IRB/Privacy Board Responsibilities||Requires the covered entity to obtain Authorization for research use or disclosure of PHI unless a regulatory permission applies. Because of this, the IRB or Privacy Board would only see requests to waive or alter the Authorization requirement. In exercising Privacy Rule authority, the IRB or Privacy Board does not review the Authorization form.||The IRB must insure that informed consent will be sought from, and documented for, each prospective subject or the subject's legally authorized representative, in accordance with, and to the extent required by, HHS regulations. If specified criteria are met, the IRB may waive the requirements for either obtaining informed consent or documenting informed consent. The IRB must review and approve the Authorization form if it is combined with the consent document. Privacy Boards have no authority under the HHS Protection of Human Subjects Regulations.||The IRB must insure that informed consent will be sought from, and documented for, each prospective subject or the subject's legally authorized representative, in accordance with, and to the extent required by, FDA regulations. If specified criteria are met, the requirements for either obtaining informed consent or documenting informed consent may be waived. The IRB must review and approve the Authorization form if it is combined with the informed consent document. Privacy Boards have no authority under the FDA Protection of Human Subjects Regulations.|
|Review of Cooperative Research||Requests to waive or alter the Authorization requirement are reviewed and approved by an IRB or Privacy Board. The Privacy Rule permits a covered entity to reasonably rely on the determination of an IRB or Privacy Board, if the covered entity obtains appropriate documentation of such determination.||Each institution is responsible for safeguarding the rights and welfare of human subjects and for complying with the HHS Protection of Human Subjects Regulations. With the approval of HHS, an institution participating in a cooperative project may enter into a joint review arrangement, rely upon the review of another qualified IRB, or make similar arrangements for avoiding duplication of effort.||Cooperative research/multi-institutional studies may use joint review, reliance upon the review of another qualified IRB, or similar arrangements aimed at avoiding duplication of effort.|
|Waivers of Authorization or Informed Consent Requirements||Allows waiver or alteration of Authorization when IRB or Privacy Board deems the following criteria are met: (1) Use or disclosure involves no more than minimal risk to the privacy of individuals because of the presence of at least the following elements: (a) An adequate plan to protect health information identifiers from improper use or disclosure, (b) an adequate plan to destroy identifiders at the earliest opportunity absent a health or research justification or legal requirement to retain them, and (c) adequate written assurances that the PHI will not be used or disclosed to a third party except as required by law, for authorized oversight of the research study, or for other research uses and disclosures permitted by the Privacy Rule; (2) research could not practicably be conducted without the waiver or alteration; and (3) research could not practicably be conducted without access to and use of PHI.||Permits an IRB to waive some or all of the elements of informed consent, or to waive the requirement to obtain informed consent, provided the IRB finds and documents that (1) the research involves no more than minimal risk to the subjects; (2) the waiver or alteration will not adversely affect the rights and welfare of the subjects; (3)) the research could not practicably be carried out without the waiver or alteration; (4) whenever appropriate, the subjects will be provided with additional pertinent information after participation. Permits an IRB to waive the requirement for the investigator to obtain a signed consent for some or all of the subjects if it finds either (1) that the only record linking the subject and the research would be the consent document and the princial risk would be potential harm resulting from a breach of confidentiality; or (2) that the research presents no more than minimal risk or harm to subjects and involves no procedures for which written consent is normally required outside of the research constitute.||Permits FDA to waive the IRB review requirement. Permits an IRB to approve a clinical investigation without sujects' informed consent in c ertain circumstances. These include: (1) circumstances in which immediate use of the test article is, in the investigator's opinion, required to preserve the life of the subject, and time is not sufficient to obtain informed consent; (2) circumstances when the U.S. President may waive informed consent for military personnel for administration of an investigational product to members of the armed forces; and (3) circusmstances involving emergency research.|
HIPAA does not affect the University’s ability, as an employer, to request or require medical documentation before granting paid sick leave to employees. Congress and the U.S. Department of Health and Human Services recognize that employers frequently require such documentation as a way of eliminating fraudulent sick leave claims.
Therefore, University employees requesting sick leave should contact their departmental supervisor. The University reserves the right to require medical documentation (physician’s certification or other documentation) for all instances of paid sick leave. If the University requires medical documentation prior to approving paid sick leave, the documentation should be submitted directly to the Benefits Administration Office. In the case of employees who work in physical facilities or dining services, the director of these departments is authorized, in accordance with the collective bargaining agreement, to collect, audit and maintain such documentation in place of the Benefits Administration Office. No other departmental office should require, receive or retain such documentation. See University rules 3359-11-01 or 3359-26-04 for more information.
Employees who have further questions should contact the University’s Benefits Administration Office at x7092.
Academic units of the University are not covered by HIPAA. As a result, none of HIPAA’s protections or prohibitions applies to the University’s academic functions. However, the University recognizes that medical information is very personal and should be treated with sensitivity.
Therefore, faculty members who wish to require that students provide medical documentation before absences are counted as excused may continue to do so. Faculty members who request such documentation should handle this information in as confidential a fashion as is possible and, in an effort to protect the student’s privacy, should make it a practice to either:
1) Return the documentation to the student and retain no records for their files; or
2) Shred the documentation after reviewing it and noting that the absence was excused.
Faculty members who have further questions should contact their department chair or dean.
Information about payments made to the University may qualify as customer information and be protected by the Gramm-Leach-Bliley Act. Therefore, you should contact Kevin Rushing, the University's Information Security Program Coordinator, about your concerns. However, if the payment information involves payment for healthcare services or benefits, the information may be protected by HIPAA. For concerns regarding payment for healthcare services, please contact Alma Olson, the University's HIPAA Privacy Official.
The University's HIPAA Privacy Official, Alma Olson, can help address concerns about health information. For more information, please see the University's HIPAA Information web page.
Yes. The records you have described are, most likely, protected by the Family Educational Rights and Privacy Act (FERPA). You may wish to begin by reviewing the University's FERPA notice and FERPA rule. If you still have questions, you should contact Ronald L. Bowman, Jr., the University's FERPA Coordinator.
Do you have other questions about HIPAA that have not been answered here? You may find it helpful to review the HIPAA Background Information page. If you still have questions that you think might be helpful if addressed here, please contact firstname.lastname@example.org.