bmad-plus 0.9.0 → 0.9.1

package/src/bmad-plus/packs/pack-shield/references/hipaa-compliance/privacy-rule.md

@@ -1,276 +1,276 @@
-# HIPAA Privacy Rule Reference
-## 45 CFR Part 164, Subparts A and E
-
----
-
-## Table of Contents
-1. [Applicability & Scope](#1-applicability--scope)
-2. [Uses and Disclosures — General Rules](#2-uses-and-disclosures--general-rules)
-3. [Permitted Uses Without Authorization](#3-permitted-uses-without-authorization)
-4. [Patient Rights](#4-patient-rights)
-5. [Notice of Privacy Practices (NPP)](#5-notice-of-privacy-practices-npp)
-6. [Minimum Necessary Standard](#6-minimum-necessary-standard)
-7. [Authorization Requirements](#7-authorization-requirements)
-8. [Special Categories of PHI](#8-special-categories-of-phi)
-9. [Administrative Requirements](#9-administrative-requirements)
-10. [Marketing & Fundraising](#10-marketing--fundraising)
-
----
-
-## 1. Applicability & Scope
-
-**Covered Entities (CEs)** subject to Privacy Rule:
-- Health plans (insurance companies, HMOs, employer-sponsored plans with 50+ participants)
-- Healthcare clearinghouses
-- Healthcare providers who transmit health information electronically
-
-**Business Associates (BAs):**
-- Entities that create, receive, maintain, or transmit PHI on behalf of a CE
-- Must sign a **Business Associate Agreement (BAA)** before PHI is shared
-- Subject to Security Rule; portions of Privacy Rule apply via BAA
-
-**PHI Definition** (§164.501):
-Protected Health Information = health information that:
-- Is created or received by a CE/BA
-- Relates to past/present/future physical or mental health condition, healthcare provision, or payment
-- Identifies or could reasonably identify the individual
-
-**Does NOT apply to:**
-- Employers acting in their employer capacity
-- Life insurers (unless also a health plan)
-- Workers' comp carriers (in most states, not subject to HIPAA directly)
-- Education records (FERPA applies instead)
-
----
-
-## 2. Uses and Disclosures — General Rules
-
-### General Prohibition (§164.502(a))
-A CE/BA may not use or disclose PHI except as permitted or required by the Privacy Rule.
-
-### Required Disclosures (§164.502(a)(2))
-- To the **individual** (upon request for access or accounting)
-- To **HHS** for compliance investigations/enforcement
-
-### Consent vs. Authorization vs. Agreement
-| Mechanism | When Required | Notes |
-|-----------|--------------|-------|
-| Written Authorization | Uses/disclosures beyond TPO, marketing, sale of PHI | Must meet §164.508 requirements |
-| Opportunity to agree/object | Facility directories, to family/friends involved in care | Informal; oral ok |
-| No permission needed | TPO, public health, law enforcement (limited), etc. | See §164.512 |
-
----
-
-## 3. Permitted Uses Without Authorization
-
-### Treatment, Payment, Operations (TPO) (§164.506)
-- **Treatment**: Providing, coordinating, managing healthcare
-- **Payment**: Billing, claims processing, utilization review
-- **Operations**: Quality assessment, training, auditing, legal, business planning
-
-### Other Permitted Disclosures (§164.512)
-| Purpose | Requirements |
-|---------|-------------|
-| Public health (§164.512(b)) | To authorized public health authorities |
-| Abuse/neglect reporting (§164.512(c)) | To government authorities authorized to receive |
-| Health oversight (§164.512(d)) | Audits, inspections, licensure by oversight agencies |
-| Judicial/administrative (§164.512(e)) | Court order or subpoena with satisfactory assurance |
-| Law enforcement (§164.512(f)) | Limited; specific conditions apply (e.g., court order, crime on premises) |
-| Research (§164.512(i)) | With IRB/Privacy Board waiver or individual authorization |
-| Serious threat (§164.512(j)) | To prevent imminent serious harm to individual or others |
-| Workers' comp (§164.512(l)) | As authorized by workers' comp laws |
-| Decedents (§164.512(g)) | To coroners, medical examiners, funeral directors |
-| Limited data set (§164.514(e)) | Remove direct identifiers; require Data Use Agreement (DUA) |
-
-### Incidental Disclosures (§164.502(a)(1)(iii))
-Permitted if:
-- Reasonable safeguards are in place
-- Minimum necessary standard is met
-- Example: A patient overhearing another patient's conversation in a waiting room
-
----
-
-## 4. Patient Rights
-
-### Right of Access (§164.524)
-- Individuals have the right to inspect and obtain a copy of their PHI in a **designated record set**
-- **Timeline**: Provide access within **30 days** (one 30-day extension permitted with written notice)
-- **Format**: Must provide in format requested if readily producible; electronic if requested
-- **Fees**: May charge a reasonable, cost-based fee (labor + supplies + postage only); no retrieval fees
-- **Denials**: Permitted for psychotherapy notes, information compiled for legal proceedings, PHI that could endanger life/safety; some denials are reviewable
-
-> **2021 Rule Update**: HHS reinforced that fees must be limited; EHR patient portal access must be free.
-
-### Right to Amend (§164.526)
-- Individual may request amendment to their PHI in a designated record set
-- **Timeline**: 60 days to act (one 60-day extension)
-- May deny if: CE did not create the record; record is accurate and complete; not part of designated record set
-
-### Right to Accounting of Disclosures (§164.528)
-- Right to list of disclosures made in prior 6 years
-- **Excludes**: TPO disclosures, to the individual, authorized disclosures, incidental, national security
-- **Timeline**: 60 days (one 60-day extension)
-
-### Right to Request Restrictions (§164.522(a))
-- Individual may request restrictions on uses/disclosures for TPO or to family/friends
-- CE is **not required** to agree — **except**: must honor restriction on disclosure to health plan for service paid out-of-pocket in full
-
-### Right to Confidential Communications (§164.522(b))
-- Individual may request alternative means or locations for communications
-- CE must accommodate **reasonable requests**; no explanation required from individual
-- Health plans must accommodate if individual states disclosure could endanger them
-
-### Right to Notice (§164.520)
-- Right to receive a Notice of Privacy Practices (see Section 5)
-
-### Right to Opt Out of Fundraising (§164.514(f))
-- Must include opt-out mechanism in every fundraising communication
-
----
-
-## 5. Notice of Privacy Practices (NPP)
-
-### Required for: All Covered Entities (not BAs)
-
-### Must Be Provided (§164.520(c)):
-- At first service delivery (in-person)
-- On request
-- On CE's website (if one exists)
-- Health plans: at enrollment and every 3 years if material changes
-
-### Required NPP Contents (§164.520(b)):
-1. **Header**: "THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY."
-2. Description of how CE may use/disclose PHI (with examples of TPO + other)
-3. Description of other uses requiring authorization
-4. Individual rights (access, amendment, accounting, restrictions, confidential comms, opt-out of fundraising)
-5. CE's duties (maintain privacy, notify of breaches, abide by NPP)
-6. How to complain (to CE and to HHS; no retaliation)
-7. Contact person/office for more information
-8. Effective date
-
-### Electronic NPP:
-- Can be provided electronically if individual agrees
-- Must be in plain language
-
----
-
-## 6. Minimum Necessary Standard
-
-### Rule (§164.502(b), §164.514(d)):
-When using or disclosing PHI, or requesting from another CE, make reasonable efforts to limit PHI to the **minimum necessary** to accomplish the intended purpose.
-
-### Applies To:
-- Routine disclosures → Establish policies identifying persons who need access + type of PHI
-- Non-routine disclosures → Review on case-by-case basis
-- Requests from others → Limit requests to minimum necessary
-
-### Does NOT Apply To:
-- Disclosures to or requests by a treating provider
-- Disclosures to the individual
-- Pursuant to individual's authorization
-- Required by law
-- For HHS compliance activities
-
-### Practical Implementation:
-- Role-based access controls in EHR systems
-- Need-to-know training for workforce
-- De-identify data where full PHI isn't required
-
----
-
-## 7. Authorization Requirements
-
-### When Required (§164.508):
-- Most uses/disclosures not covered by TPO or §164.512 permitted disclosures
-- **Always required for**: psychotherapy notes (with limited exceptions), marketing involving financial remuneration, sale of PHI
-
-### Valid Authorization Must Contain (§164.508(c)):
-1. Description of PHI to be used/disclosed (specific, meaningful)
-2. Name/class of person(s) authorized to make the disclosure
-3. Name/class of person(s) to whom disclosure may be made
-4. Description of each purpose of the use/disclosure
-5. Expiration date or event
-6. Individual's signature and date
-7. If signed by personal representative: description of authority
-8. Statement that individual may revoke
-9. Statement about re-disclosure risk (if applicable)
-10. Conditioning statement (if authorization is conditioned on treatment/payment)
-
-### Defective Authorization (§164.508(b)(2)):
-Authorization is defective if:
-- Expiration date has passed
-- Not filled out completely
-- CE knows it has been revoked
-- Compound authorization (combining with another document) when not permitted
-
----
-
-## 8. Special Categories of PHI
-
-These categories receive **heightened protection** (often under state law as well):
-
-| Category | Notes |
-|----------|-------|
-| **Psychotherapy notes** | Stored separately; require specific authorization for almost all uses/disclosures |
-| **HIV/AIDS information** | Most states have additional restrictions beyond HIPAA |
-| **Substance use disorder** (42 CFR Part 2) | Separate federal law with stricter rules than HIPAA |
-| **Mental health records** | State law often adds restrictions |
-| **Reproductive health** | Post-Dobbs guidance; HHS issued rules limiting disclosure for lawful reproductive care |
-| **Genetic information** (GINA) | Cannot be used for underwriting by health plans |
-| **Minors** | Generally parents are personal representatives; exceptions for emancipated minors, sensitive services |
-
-> **Important**: State laws can be MORE protective than HIPAA. HIPAA sets a floor. Always check state law.
-
----
-
-## 9. Administrative Requirements
-
-### Policies & Procedures (§164.530(i)):
-- Must implement written policies and procedures complying with Privacy Rule
-- Must document policies; retain for 6 years from creation or last effective date
-
-### Workforce Training (§164.530(b)):
-- Train all workforce members on privacy policies as necessary for them to carry out their functions
-- Train new members within reasonable time after joining
-- Document training
-
-### Sanctions (§164.530(e)):
-- Apply appropriate sanctions against workforce members who violate privacy policies
-- Document sanctions
-
-### Complaint Process (§164.530(d)):
-- Provide process for individuals to make complaints
-- Document all complaints and their disposition
-
-### Privacy Official (§164.530(a)):
-- Designate a Privacy Official responsible for developing and implementing policies
-- Designate a contact person for receiving complaints
-
-### Retaliation Prohibition (§164.530(g)):
-- May not retaliate against individuals for exercising HIPAA rights
-- May not retaliate against workforce members for filing complaints or participating in investigations
-
-### Waiver Prohibition (§164.530(h)):
-- May not require individuals to waive HIPAA rights as condition of treatment/payment/enrollment
-
----
-
-## 10. Marketing & Fundraising
-
-### Marketing Definition (§164.501):
-Communication about a product/service that encourages recipients to purchase or use the product/service.
-
-### Marketing Requires Authorization EXCEPT:
-- Face-to-face communication with individual
-- Promotional gifts of nominal value
-- Refill reminders (if financial remuneration is reasonably related to CE's cost)
-- Communications about health-related products/services offered by CE (own services, treatment alternatives, case management) — if no financial remuneration from third party
-
-### Sale of PHI (§164.502(a)(5)(ii)):
-- Generally prohibited without authorization
-- Exceptions: public health, research, treatment, sale/merger of business, BAA, providing individual access
-
-### Fundraising (§164.514(f)):
-- May use demographic info + dates of service without authorization
-- Must include opt-out mechanism in each communication
-- Cannot condition treatment on making a donation
+# HIPAA Privacy Rule Reference
+## 45 CFR Part 164, Subparts A and E
+
+---
+
+## Table of Contents
+1. [Applicability & Scope](#1-applicability--scope)
+2. [Uses and Disclosures — General Rules](#2-uses-and-disclosures--general-rules)
+3. [Permitted Uses Without Authorization](#3-permitted-uses-without-authorization)
+4. [Patient Rights](#4-patient-rights)
+5. [Notice of Privacy Practices (NPP)](#5-notice-of-privacy-practices-npp)
+6. [Minimum Necessary Standard](#6-minimum-necessary-standard)
+7. [Authorization Requirements](#7-authorization-requirements)
+8. [Special Categories of PHI](#8-special-categories-of-phi)
+9. [Administrative Requirements](#9-administrative-requirements)
+10. [Marketing & Fundraising](#10-marketing--fundraising)
+
+---
+
+## 1. Applicability & Scope
+
+**Covered Entities (CEs)** subject to Privacy Rule:
+- Health plans (insurance companies, HMOs, employer-sponsored plans with 50+ participants)
+- Healthcare clearinghouses
+- Healthcare providers who transmit health information electronically
+
+**Business Associates (BAs):**
+- Entities that create, receive, maintain, or transmit PHI on behalf of a CE
+- Must sign a **Business Associate Agreement (BAA)** before PHI is shared
+- Subject to Security Rule; portions of Privacy Rule apply via BAA
+
+**PHI Definition** (§164.501):
+Protected Health Information = health information that:
+- Is created or received by a CE/BA
+- Relates to past/present/future physical or mental health condition, healthcare provision, or payment
+- Identifies or could reasonably identify the individual
+
+**Does NOT apply to:**
+- Employers acting in their employer capacity
+- Life insurers (unless also a health plan)
+- Workers' comp carriers (in most states, not subject to HIPAA directly)
+- Education records (FERPA applies instead)
+
+---
+
+## 2. Uses and Disclosures — General Rules
+
+### General Prohibition (§164.502(a))
+A CE/BA may not use or disclose PHI except as permitted or required by the Privacy Rule.
+
+### Required Disclosures (§164.502(a)(2))
+- To the **individual** (upon request for access or accounting)
+- To **HHS** for compliance investigations/enforcement
+
+### Consent vs. Authorization vs. Agreement
+| Mechanism | When Required | Notes |
+|-----------|--------------|-------|
+| Written Authorization | Uses/disclosures beyond TPO, marketing, sale of PHI | Must meet §164.508 requirements |
+| Opportunity to agree/object | Facility directories, to family/friends involved in care | Informal; oral ok |
+| No permission needed | TPO, public health, law enforcement (limited), etc. | See §164.512 |
+
+---
+
+## 3. Permitted Uses Without Authorization
+
+### Treatment, Payment, Operations (TPO) (§164.506)
+- **Treatment**: Providing, coordinating, managing healthcare
+- **Payment**: Billing, claims processing, utilization review
+- **Operations**: Quality assessment, training, auditing, legal, business planning
+
+### Other Permitted Disclosures (§164.512)
+| Purpose | Requirements |
+|---------|-------------|
+| Public health (§164.512(b)) | To authorized public health authorities |
+| Abuse/neglect reporting (§164.512(c)) | To government authorities authorized to receive |
+| Health oversight (§164.512(d)) | Audits, inspections, licensure by oversight agencies |
+| Judicial/administrative (§164.512(e)) | Court order or subpoena with satisfactory assurance |
+| Law enforcement (§164.512(f)) | Limited; specific conditions apply (e.g., court order, crime on premises) |
+| Research (§164.512(i)) | With IRB/Privacy Board waiver or individual authorization |
+| Serious threat (§164.512(j)) | To prevent imminent serious harm to individual or others |
+| Workers' comp (§164.512(l)) | As authorized by workers' comp laws |
+| Decedents (§164.512(g)) | To coroners, medical examiners, funeral directors |
+| Limited data set (§164.514(e)) | Remove direct identifiers; require Data Use Agreement (DUA) |
+
+### Incidental Disclosures (§164.502(a)(1)(iii))
+Permitted if:
+- Reasonable safeguards are in place
+- Minimum necessary standard is met
+- Example: A patient overhearing another patient's conversation in a waiting room
+
+---
+
+## 4. Patient Rights
+
+### Right of Access (§164.524)
+- Individuals have the right to inspect and obtain a copy of their PHI in a **designated record set**
+- **Timeline**: Provide access within **30 days** (one 30-day extension permitted with written notice)
+- **Format**: Must provide in format requested if readily producible; electronic if requested
+- **Fees**: May charge a reasonable, cost-based fee (labor + supplies + postage only); no retrieval fees
+- **Denials**: Permitted for psychotherapy notes, information compiled for legal proceedings, PHI that could endanger life/safety; some denials are reviewable
+
+> **2021 Rule Update**: HHS reinforced that fees must be limited; EHR patient portal access must be free.
+
+### Right to Amend (§164.526)
+- Individual may request amendment to their PHI in a designated record set
+- **Timeline**: 60 days to act (one 60-day extension)
+- May deny if: CE did not create the record; record is accurate and complete; not part of designated record set
+
+### Right to Accounting of Disclosures (§164.528)
+- Right to list of disclosures made in prior 6 years
+- **Excludes**: TPO disclosures, to the individual, authorized disclosures, incidental, national security
+- **Timeline**: 60 days (one 60-day extension)
+
+### Right to Request Restrictions (§164.522(a))
+- Individual may request restrictions on uses/disclosures for TPO or to family/friends
+- CE is **not required** to agree — **except**: must honor restriction on disclosure to health plan for service paid out-of-pocket in full
+
+### Right to Confidential Communications (§164.522(b))
+- Individual may request alternative means or locations for communications
+- CE must accommodate **reasonable requests**; no explanation required from individual
+- Health plans must accommodate if individual states disclosure could endanger them
+
+### Right to Notice (§164.520)
+- Right to receive a Notice of Privacy Practices (see Section 5)
+
+### Right to Opt Out of Fundraising (§164.514(f))
+- Must include opt-out mechanism in every fundraising communication
+
+---
+
+## 5. Notice of Privacy Practices (NPP)
+
+### Required for: All Covered Entities (not BAs)
+
+### Must Be Provided (§164.520(c)):
+- At first service delivery (in-person)
+- On request
+- On CE's website (if one exists)
+- Health plans: at enrollment and every 3 years if material changes
+
+### Required NPP Contents (§164.520(b)):
+1. **Header**: "THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY."
+2. Description of how CE may use/disclose PHI (with examples of TPO + other)
+3. Description of other uses requiring authorization
+4. Individual rights (access, amendment, accounting, restrictions, confidential comms, opt-out of fundraising)
+5. CE's duties (maintain privacy, notify of breaches, abide by NPP)
+6. How to complain (to CE and to HHS; no retaliation)
+7. Contact person/office for more information
+8. Effective date
+
+### Electronic NPP:
+- Can be provided electronically if individual agrees
+- Must be in plain language
+
+---
+
+## 6. Minimum Necessary Standard
+
+### Rule (§164.502(b), §164.514(d)):
+When using or disclosing PHI, or requesting from another CE, make reasonable efforts to limit PHI to the **minimum necessary** to accomplish the intended purpose.
+
+### Applies To:
+- Routine disclosures → Establish policies identifying persons who need access + type of PHI
+- Non-routine disclosures → Review on case-by-case basis
+- Requests from others → Limit requests to minimum necessary
+
+### Does NOT Apply To:
+- Disclosures to or requests by a treating provider
+- Disclosures to the individual
+- Pursuant to individual's authorization
+- Required by law
+- For HHS compliance activities
+
+### Practical Implementation:
+- Role-based access controls in EHR systems
+- Need-to-know training for workforce
+- De-identify data where full PHI isn't required
+
+---
+
+## 7. Authorization Requirements
+
+### When Required (§164.508):
+- Most uses/disclosures not covered by TPO or §164.512 permitted disclosures
+- **Always required for**: psychotherapy notes (with limited exceptions), marketing involving financial remuneration, sale of PHI
+
+### Valid Authorization Must Contain (§164.508(c)):
+1. Description of PHI to be used/disclosed (specific, meaningful)
+2. Name/class of person(s) authorized to make the disclosure
+3. Name/class of person(s) to whom disclosure may be made
+4. Description of each purpose of the use/disclosure
+5. Expiration date or event
+6. Individual's signature and date
+7. If signed by personal representative: description of authority
+8. Statement that individual may revoke
+9. Statement about re-disclosure risk (if applicable)
+10. Conditioning statement (if authorization is conditioned on treatment/payment)
+
+### Defective Authorization (§164.508(b)(2)):
+Authorization is defective if:
+- Expiration date has passed
+- Not filled out completely
+- CE knows it has been revoked
+- Compound authorization (combining with another document) when not permitted
+
+---
+
+## 8. Special Categories of PHI
+
+These categories receive **heightened protection** (often under state law as well):
+
+| Category | Notes |
+|----------|-------|
+| **Psychotherapy notes** | Stored separately; require specific authorization for almost all uses/disclosures |
+| **HIV/AIDS information** | Most states have additional restrictions beyond HIPAA |
+| **Substance use disorder** (42 CFR Part 2) | Separate federal law with stricter rules than HIPAA |
+| **Mental health records** | State law often adds restrictions |
+| **Reproductive health** | Post-Dobbs guidance; HHS issued rules limiting disclosure for lawful reproductive care |
+| **Genetic information** (GINA) | Cannot be used for underwriting by health plans |
+| **Minors** | Generally parents are personal representatives; exceptions for emancipated minors, sensitive services |
+
+> **Important**: State laws can be MORE protective than HIPAA. HIPAA sets a floor. Always check state law.
+
+---
+
+## 9. Administrative Requirements
+
+### Policies & Procedures (§164.530(i)):
+- Must implement written policies and procedures complying with Privacy Rule
+- Must document policies; retain for 6 years from creation or last effective date
+
+### Workforce Training (§164.530(b)):
+- Train all workforce members on privacy policies as necessary for them to carry out their functions
+- Train new members within reasonable time after joining
+- Document training
+
+### Sanctions (§164.530(e)):
+- Apply appropriate sanctions against workforce members who violate privacy policies
+- Document sanctions
+
+### Complaint Process (§164.530(d)):
+- Provide process for individuals to make complaints
+- Document all complaints and their disposition
+
+### Privacy Official (§164.530(a)):
+- Designate a Privacy Official responsible for developing and implementing policies
+- Designate a contact person for receiving complaints
+
+### Retaliation Prohibition (§164.530(g)):
+- May not retaliate against individuals for exercising HIPAA rights
+- May not retaliate against workforce members for filing complaints or participating in investigations
+
+### Waiver Prohibition (§164.530(h)):
+- May not require individuals to waive HIPAA rights as condition of treatment/payment/enrollment
+
+---
+
+## 10. Marketing & Fundraising
+
+### Marketing Definition (§164.501):
+Communication about a product/service that encourages recipients to purchase or use the product/service.
+
+### Marketing Requires Authorization EXCEPT:
+- Face-to-face communication with individual
+- Promotional gifts of nominal value
+- Refill reminders (if financial remuneration is reasonably related to CE's cost)
+- Communications about health-related products/services offered by CE (own services, treatment alternatives, case management) — if no financial remuneration from third party
+
+### Sale of PHI (§164.502(a)(5)(ii)):
+- Generally prohibited without authorization
+- Exceptions: public health, research, treatment, sale/merger of business, BAA, providing individual access
+
+### Fundraising (§164.514(f)):
+- May use demographic info + dates of service without authorization
+- Must include opt-out mechanism in each communication
+- Cannot condition treatment on making a donation