HIPAA for the CNA

The Department of Health and Human Services’ Office of Civil Rights (DHHS OCR): monitors HIPAA complaints, enforces penalties, and provides resources.

Encrypted: Electronic information that has been scrambled so that only someone with the right software code can understand it. Encrypted Apps, such as What’s App and TigerText, can only be read by the sender and receiver. Some medical businesses use these texts, calls, and emails to be secure with PHI. The APP companies can’t even read them.

Health Insurance Portability and Accountability Act. (HIPAA). This law is called the Insurance Portability and Accountability Act because it was originally (1996) meant to secure health information about patients when used by insurance companies. More laws have been added over time as lawmakers became aware of the increasing need for Privacy and Security in PHI nationally. The word “portability” required the records to be electronic so everyone who needed to use the information could share them (Hester, 2024). All those paper records were faxed everywhere, causing many privacy issues.

The HIPAA Privacy Rule is the specific regulation within the Health Insurance Portability and Accountability Act (HIPAA). It grants patients the right to view, change, or restrict access to their Protected Health Information (U.S. Department of Health and Human Services, 2024a).

HIPAA breach or violation: A HIPAA breach is defined as “the unauthorized acquisition, access, use or disclosure of Protected Health Information (PHI) which compromises the security or privacy of such information” (Heath et al., 2021).

Mishandled PHI: When protected information is not properly handled by the people using it, such as putting it into the trash or anywhere anyone can see it, like a computer terminal or on a counter.

The Minimum Necessary Rule. This rule means you only get to see or share the smallest amount of information you or a co-worker need to do your jobs safely.

Protected Health Information (PHI) : Is the patient name or “other possible identifier” (photo, rm number, address, social security or driver’s license numbers, family member’s names, neighborhoods, occupations, etc.) linked with the patient’s healthcare info like physical or mental conditions, medications or health history.

We all know about patient privacy. For instance, we do not uncover a patient's private body parts to adjust catheter tubing in the hallway. That kind of privacy is simple. But what about the patient’s protected health information PHI? What does that mean exactly? It can be unclear, although we get trained in it yearly.  PHI is very specific; some people think any patient information is PHI. That's a myth (Tembani, 2023). There are several HIPAA myths that we will cover in this course. The truth is that PHI is the patient name or other possible identifier linked with the patient’s healthcare info, like diseases, medications, or mental/physical health history. Exposure can be devastating to the patient and their family, such as an HIV patient diagnosis, or perhaps a person is pregnant and doesn’t want people to know. Maybe people just want to keep their information safe from criminals. Criminals use PHI, creating financial costs and misery. For companies like hospitals and other patient care facilities, they can be very costly. Both financially and in public reputation (Heath et al.,2021).

“The national costs for HIPAA breaches are staggering, and in 2019, they were $6.2 billion, with the average cost of a single data breach costing hospitals as much as $4 million” (Heath et al., 2021).

According to Heath et al. (2021), one-third of all HIPAA violations happen in hospitals. The rest of the HIPPA violations occur in nursing homes, rehabs, pharmacies, insurance companies, doctor’s offices, personal care homes, and other product and services vendors.

The Health Insurance Portability and Accountability Act of 1996 was the original act passed by Congress, which led to the making of the standards for the privacy of Protected Health Information in federal law. It's a primary federal law that protects private health information. How does it protect? In the days of the far past, the only privacy people could get was if they were bare-bottomed. Everyone tried to keep the patient’s butt covered! But private health info was easy to get.  You could ask any health employee in a hospital or nursing home how someone was, and they would tell you about the patient. A lot of the time, they didn't even ask if you were family. We had, and still have, a problem with protecting privacy. When HIV/AIDS arose in the mid-80s, patient privacy needs were showcased. People with HIV were being discriminated against by people who learned of their condition. Some lost everything (jobs, homes, friends, family, and even their lives) because other people were afraid of catching HIV. In the mid-90s, the HIPPA law was passed. This means that patients with HIV are protected by the same privacy rules as patients without HIV, and it's illegal for a doctor's office to share their test results without their permission. Although privacy and security of PHI for HIV patients was not the only reason for the HIPAA law, it was a big benefit for the patients. Originally, the idea of HIPAA was to make it so that when a person left a job, he could keep insurance and have his PHI secured from the people who would discriminate against them. The Office of Civil Rights (OCR) began enforcing the federal law in 2003. It took seven years for the lawmakers to figure out how to make law and enforcement work together to keep people’s privacy safe. There are two parts of the HIPAA rules: Security (enforcement) and Privacy (guidelines). They also had to figure out how to be the privacy watchdogs to big insurance companies, information clearinghouses, nursing homes, pharmacies, and more (covered entities). This has been a complicated and expensive undertaking for all. However, it has increased patient privacy overall. According to U.S. Department of Health and Human Service (2024b) enforcement reports, from 2003 to May 2024, over 243 million dollars in fines have been charged to companies and individuals with violations. The OCR has referred two thousand two hundred thirty-five cases to the Department of Justice for criminal charges. Additionally, in 63,959 cases, OCR intervened early and provided technical assistance without an investigation. For more about the actual enforcement statistics, go Here.

HIPAA is an important law that protects patient health information. It makes doctors, nurses, and hospitals keep patient medical records private. This means that only people who need to know about patient care can see it. The USA isn’t the only country that requires Patient Privacy. As you can see by the chart below, some countries like Qatar and Dubai don’t count employees accountable (by law)  in the same way the USA, Britain, and Canada do. Those same countries and some Middle East and North African (MENA) countries don’t have detailed security measures (by law). However, you can see that all the countries listed have strict rules for sharing PHI with third parties. Third parties are other outside vendors of needed products and services ordered for patients. More information on the HIPAA Privacy Rule can be found on the HHS.gov website.

In the end, who is really in charge of HIPAA? The US Department of Health and Human Services (DHHS) Office for Civil Rights (OCR) is in charge of HIPAA and violations of the law, ensuring equal access to certain health and human services (like healthcare) and protecting the privacy and security of health information by monitoring and regulating HIPAA violation reports. (U.S. Department of Health and Human Services, 2024a) They also help companies try to prevent PHI from being revealed to the wrong people as much as possible. Guidance resources on compliance are offered free on the website for individuals and healthcare professionals in 16 languages.

Remember, reporting violations decreases HIPAA violations. When should you report that one of your co-workers (like a doctor, nurse, or other CNA) has violated the HIPAA guidelines? What should you do if someone is seen talking about a patient (in a public area)? If this person isn’t your supervisor or other administrator, you can talk to your supervisor about it and let the situation go up the chain of command. If it is your supervisor or other administrator, consider reporting online to the DHHS OCR at hhs.gov, by mail, or by phone to the DHHS/OCR anonymously at (800) 368-1019. You can file a complaint anonymously through the OCR Complaint Portal. You can also download the complaint form and mail it to OCR without your contact information. However, OCR may not do anything against the covered entity if you don't give your contact information. Instead, you can ask OCR to keep your information private and refuse to consent to reveal your identity (U.S. Department of Health and Human Services, n.d.).

We are not allowed to talk about patients’ protected health information with anyone without the patient’s written consent. You could talk about it if you were speaking with another person taking care of the patient “in private.”

According to hipaaguide.net by Liam Johnson, these are ten major ways to get charged for a HIPAA violation.

1. Mishandling medical record information, such as throwing away PHI in the trash.
2. Sharing anything identifying a person in your care in person, online, e-mail, or text messaging, along with any of the person’s medical information.
3. By looking at patient info, you don't need to know how to care for them.
4. By sharing information with others at work that they don’t need to know to do their jobs in public places (it’s OK to talk to your co-worker about what both of you need to do for your patient in private).
5. Using a personal device (your phone or pad) to keep patient information on.
6. It should not be allowed to enter the hands of anyone else except medical workers who need it to do their jobs.
7. Sharing your access code and password to your electronic patient data. Even with a coworker.
8. Leaving charts on countertops or patient info open on your computer screen or portal while you're not there.
9. Talking about a patient while in another patient’s room.

Companies, called covered entities (which may be hospitals, PHI clearinghouses, insurance companies, or other vendors) get charged for HIPAA violations if they are:

1. Not training employees in HIPPA Privacy Practices and keeping records of it.
2. Not signing a contract with all providers and vendors that shows training and agreement to uphold the HIPAA Privacy Practices.
3. Allowing electronic PHI to be read by anyone who doesn't need the info to care for the patient (such as in e-mails or text messages about a patient that are not encrypted).
4. Not having protective passwords for worker access.
5.  Not having ways to prevent hacking.
6. Not notifying the OCR of the possible or actual HIPAA Violation before 60 days.
7. Not correctly disposing of or providing safe storage of electronic PHI after discharge.
8. Not having a plan for what to do if all else fails and the computers get hacked (e.g., a way to lock up or destroy the information so hackers can’t access it).
9. Not protecting devices that record patient information by encryption and two passwords in case of theft or lost devices or records.
10. Not retrieving devices from ex-employees used in the field for charting patient information.

Doesn’t everyone sign a HIPAA consent form when they go to the hospital, the doctor, or any of those other places? Yes, they do, but it’s only a specific consent for the covered entity like the hospital, hospice, or pharmacy to share the information with other covered entities! HIPAA places strict regulations on how healthcare providers and organizations can use and disclose patient information. Consent, whether explicit or implied, is a crucial component of HIPAA compliance. Consent in HIPAA is a clear and specific permission given by a patient to use or share their PHI. This is typically done in writing but can also be verbal (Children’s Hospital of Philadelphia Research Institute, 2022). It's required for specific situations, such as releasing medical records to an insurance company, sharing information with a family member, or taking a photo of the patient.

• What can you do or say if someone tries to get you into a HIPAA violation-type conversation?
• Sometimes, gossipers just can’t wait to share that bit of juicy information. In any case, you can excuse yourself and walk away!  As an employee of your company, you want to say the right things and be nice about it.
• How about telling the gossiper,  “I don’t want to know that stuff; it could get us in trouble.” or saying, “ I don’t need that information; he/she is not my patient.”
• To the outsider (reporters, strangers, people not listed on the consent form): Say, “ I am not authorized to talk about people who may or may not be patients here.”
• To the doctor, nurse, or CNA  in the elevator, cafeteria, or other public space, “ I thought we weren’t supposed to talk about that.”
• To a neighbor: “Why don’t you check with them yourself? I’m sure they would love a visit.”
• To the family, “Here is my supervisor's number; please ask them; thank you for your patience.”
• To the policeman trying to find out about his arrested person, “ I am not authorized to speak to the police about patients unless we are in an active emergency.” Or, you might direct them to your supervisor.

Many facilities have different rules about HIPAA. Your supervisors and administrators have written policies for HIPAA information and possible violations. Always follow the company policies regarding PHI.

Many people do not understand anything about HIPAA at all. They don’t know what’s real and what isn’t. Here are eight myths about HIPAA and PHI you might have heard (Tembani, 2023).

• HIPAA Myth #1: HIPAA prevents the sharing of patient information between healthcare professionals.
  • Truth: Sharing for treatment, sharing for payment, or operation of the organization, such as telling a fireman when a patient can't walk out if there's a fire or flood.
• HIPAA Myth #2: You will go to jail if you violate HIPAA rules.
  • Truth: Probably, there will only be a fine unless you sell the info on the black market (Johnson, n.d.).
• HIPAA Myth #3: Electronic healthcare records must be kept forever.
  • Truth: EHR should be kept and stored safely for six years or until the patient is 18 years old.
• HIPAA Myth #4: The media cannot be told about a patient's health.
  • Truth: If the patient consents to it, the media can obtain the room number, and if the person is in critical, serious, fair good, or undetermined condition, spiritual advisors can find this out, too.
• HIPPA Myth #5: Healthcare providers cannot tell the patient's family members anything about the patient.
  • Truth: If a patient elects to have this information shared, it can be. It can also be shared if the patient is present and says it's OK. Family members cannot receive copies of medical records without the patient's written consent.
• HIPAA Myth #6: When a patient is unconscious, a healthcare worker cannot share info with a family member or close friends because they can't consent if they're unconscious.
  • Truth: In a provider's opinion, if the patient wants family members and friends to have the information, they could share it. However, if the patient said before they became incapacitated, “ Do not give any info to my family, my friends, or anyone else,”  then you must follow his or her wishes.
• HIPAA Myth #7: All patient information is considered PHI.
  • Truth: PHI is the patient name or another possible identifier with the patient’s healthcare info, like disease processes, medicines, or mental and physical health histories.
• HIPAA Myth #8: You can share information about your patients online if you don’t tell their names.
  • Truth: This is a false statement because a clever person can figure out where you work and, with a little detective work, can identify your patient.

What about patients’ rights to their own PHI? Well, laws that have been passed cover that, too.

For example, patients have a right to know:

1. Who can get or has gotten their PHI?
2. They also have the right to limit who can see it.
3. They have a right to know if their PHI has been violated.
4. They have a right to see their health information within 30 days; in some cases, they can correct it if it’s not right (U.S. Department of Health and Human Services, n.d.).

What about minors and HIPAA? Do children and parents have rights under the HIPAA law? According to Remien & Kanchan (2022), unless a state has laws to the contrary, parents have a right to know their children’s medical info up to age 18. Some states have different ages and situations. For a married, pregnant, or emancipated person under 18 years, parents cannot see medical records except with written permission (Guttmacher Institute, 2023a). If a minor comes to a medical care provider and the provider finds the teen pregnant, do they have to tell the parent?

“15  states allow, but do not require, physicians to inform parents that their minor child is seeking or receiving prenatal care when they deem it in the best interests of the minor. Twelve states have no explicit policy on minors’ authority to consent to prenatal care” (Guttmacher Institute, 2023b).

According to the Guttmacher Institute, in 2024, specific laws were enacted by states regarding teens getting care for STIs and other reproductive health care. Parental consent is required. Some states have questioned (by legal appeals) whether this is constitutional, considering the loss of privacy rights for teens. Since HIPAA laws are federal, and these other laws are state laws, it may be some time before any changes are made. It remains to be seen what the HIPAA law will be adjusted to fit these new state laws. In the past, the OCR was only as strict as the political party in favor allowed.

• In the case of child or adult abuse, neglect, or domestic violence, then services can be given, and law enforcement can do its job.
• If there is a court order, a subpoena, or other law or regulation that requires sharing of PHI.
• Public Health: when certain contagious diseases are diagnosed, they are reported with PHI so that the CDC can track the disease process and treatment. Also, the members of the public that were exposed could be notified.
• Public Safety: If a violent criminal escapee is cared for by a doctor so that law enforcement can catch them and protect the public.
• Covered entities can give the government PHI for oversight activities. An example of this is for health audits and investigations of healthcare given in response to government benefit services like TB programs, prenatal care, or WIC.
• When a person dies, PHI can help the Medical Examiner and coroner figure out why they died. Funeral home directors can make death certificates. Another example is if the person is donating organs to others or for research.

If PHI is needed for research, it can be de-identified. Some rules must be followed, even in these special cases.

If you learn and use the three-question PHI decision tree, you will probably never make a mistake. Is it PHI? This decision tree can help you decide. However, it does not cover all possible situations. HIPAA guidelines are complex, and this decision tree is a basic tool.

1. Does the information relate to a patient’s past, present, or future physical or mental health condition(s)?
2. Does the information identify, or could it be reasonably used to identify the patient?
3. Does the information include one or more of the listed identifiers?

If yes to all these questions, you have protected health information. Consult with your privacy/ compliance officer or supervisor if you are ever in doubt about who you can talk to and what can be said to them. You can call the HHS OCR anonymously at (800) 368-1019 or write them (see Resources below).

• U.S. Department of Health and Human Services (HHS) Office for Civil Rights: Centralized Case Management Operations, 200 Independence Ave., S.W. Suite 515F, HHH Building, Washington, D.C. 20201.
• You can also file a complaint (faster) electronically using the OCR Complaint Portal here.

You can also report a HIPAA violation to:

• Your supervisor
• The Privacy Officer at the organization where the violation occurred
• You can call the HHS OCR  anonymously at (800) 368-1019
• Your state Attorney General
• The Defense Health Agency (DHA) Privacy and Civil Liberties Office, 7700 Arlington Boulevard, Suite 5101, Falls Church, VA 22041-5101 

When reporting a violation, you should include as much detail as possible about the incident, including any evidence you have, such as copies of medical records, prescriptions, or bills. You should also report violations within 180 days. If you report a violation that exposed your  PHI, you will also want to follow this information. Report online here. To learn more about HIPAA and PHI, you can go here.

CNAs work with vulnerable patients due to their health conditions. Patients are in a place where they must trust the CNA to care for them while keeping their personal and private information safe. There are many ways to give away a patient's PHI, but the best way to keep from breaking the law is to leave your patients and their stories at work. Always speak about patients with coworkers privately, and only as much as they need to know to care for them safely. Gossip and chart snooping are not allowed. If you are ever in doubt, you can ask your company's compliance or privacy officer or call the HHS hotline. If you feel a rule has been broken and you can’t report it at work for any reason, you can report it online to hhs.gov and remain anonymous. It's very important to have a good understanding of HIPAA rules for your job. This is why we train at least yearly on HIPAA regulations.

• American Medical Association (AMA). (2016). Consent, communication & decision making. AMA Code of Ethics Online. Visit Source.
• Children’s Hospital of Philadelphia Research Institute. (2022). Verbal consent (Waiver of documentation). Children’s Hospital of Philadelphia Research Institute. Visit Source.
• Guttmacher Institute. (2023a). Teens: An overview of consent to reproductive health services by young people. Visit Source.
• Guttmacher Institute. (2023b). Teens: Minors' access to prenatal care. Visit Source.
• Heath, M., Porter, T., & Silvera, G. (2021). Hospital characteristics associated with HIPAA breaches. International Journal of Healthcare Management, 15(2), 171-180. Visit Source.
• Hester, D. M. (2024). Human privacy in virtual and physical worlds. Healthcare privacy in an electronic data age. Visit Source.
• Murray-Watson, R. (2024). Healthcare data breach statistics. The HIPAA Guide, HIPAA Compliance. Visit Source.
• Panasenko, Y. (n.d.). HIPAA vs. healthcare laws and regulations in Canada, the UK, Australia, and MENA countries. Yalantis. Visit Source.
• Remien, K., & Kanchan, T. (2022). Parental Consent. In StatPearls. StatPearls Publishing. Visit Source.
• Tembani, L. (2023). 10 HIPAA myths. Paubox. Visit Source.
• U.S. Department of Health and Human Services (HHS). (n.d.). Personal representatives and minors. U.S. Department of Health and Human Services. Visit Source.
• U.S. Department of Health and Human Services (HHS). (2024a). The HIPPA Privacy rule. U.S. Department of Health and Human Services. Visit Source.
• U.S. Department of Health and Human Service (HHS). (2024b). Enforcement data. U.S. Department of Health and Human Service. Visit Source.