Beyond HIPAA Privacy Principles

1. For the last 20 years, the HIPAA Privacy and Security Rules have engendered public trust that individually identifiable health information collected by providers and insurers (HIPAA covered entities) would be disclosed only for health functions like treatment, payment processing, and safety, and not used or disclosed for other purposes without an individual’s authorization. Any future legislation or rulemaking that addresses individually identifiable health information should not conflict with HIPAA’s Privacy and Security Rules.
   • HIPAA’s required “Notice of Privacy Practices” provides an overview of individuals’ rights as well as permitted and required uses and disclosures of identifiable health information.
   • HIPAA’s approach requires use of risk-based administrative, technical, and physical safeguards allowing organizations the flexibility to implement policies and controls commensurate with the level of risks they have identified.
2. Congress should establish a single national privacy and security standard for all health information not subject to HIPAA. This single standard:
   • Should not conflict with HIPAA,
   • Should not disrupt day to day practices for HIPAA Covered Entities and Business Associates,
   • Should align with HIPAA’s definitions of health information, and
   • Should adopt a risk-based approach for the development and implementation of security and privacy controls like HIPAA.
3. Individuals may not fully appreciate that individually identifiable health information collected outside of a HIPAA Covered Entity or Business Associate Agreement are not afforded HIPAA privacy and security protections. Individuals should be given clear, succinct notice concerning collection, use, disclosure, and protection of individually identifiable health information that is not subject to HIPAA.
4. Individual authorization processes (including revocation of authorization) for use and disclosure of identifiable health information not covered by HIPAA should be written in a meaningful and understandable manner and should be easily accessible to individuals prior to and after information is used or shared.
5. Entities that hold or collect identifiable health information have a responsibility to take necessary steps to maintain the trust of individuals. Entities that are not HIPAA Covered Entities or Business Associates that hold identifiable health information should clearly stipulate the purposes for which they collect, use, and disclose identifiable health information.
6. For data use and activities other than the purpose for which the data was provided, individuals must provide authorization for collection and use of individually identifiable health information. Such information collected, used or disclosed by entities outside of HIPAA should be limited to only that information needed to accomplish the purposes for data collection.  This practice provides privacy protection while allowing for continued innovation.
7. Individuals should be informed of their right to seek redress – from the entity and from regulators – in the case of unauthorized access, misuse, or harm attributable to how their identifiable health information was collected, used or disclosed.
8. Penalties and enforcement must be meaningful in order to discourage misuse and unpermitted collection, use or disclosure of identifiable health information.