Hipaa Laws: How Do They Affect Pharmacies?

The Health Insurance Portability and Accountability Act (HIPAA) applies to organizations and individuals who submit claims electronically. Pharmacies and pharmacists are covered entities under the HIPAA privacy and security rules as they submit claims electronically. This means they must comply with the Privacy, Security, and Breach Notification Rules.

HIPAA compliance for pharmacies is a complex subject because many may be subject to more stringent laws than HIPAA. HIPAA covers all forms of individuals' protected health information, whether electronic, written, or oral.

Pharmacies are HIPAA Covered Entities

Pharmacies are considered HIPAA Covered Entities and must comply with the Privacy, Security, and Breach Notification Rules. This means that they must adhere to stringent standards and regulations to protect patient information and ensure its proper use and disclosure.

The Health Insurance Portability and Accountability Act (HIPAA), enacted in 1996, established instructions for the Secretary of Health & Human Services to make recommendations regarding the privacy of health information and develop security standards. This led to the creation of the HIPAA Privacy Rule and the HIPAA Security Rule, which serve as the foundation for HIPAA compliance.

The definition of health care provided in §160.103 includes "the sale or dispensing of a drug, device, equipment, or other item in accordance with a prescription". This means that most pharmacies fall under the category of HIPAA Covered Entities. Pharmacies that transmit health information electronically and meet the definition of a healthcare provider are considered Covered Entities.

HIPAA compliance for pharmacies can be complex due to the interplay between state and federal laws. Pharmacies must comply with HIPAA's Administrative Simplification Regulations, which include the Privacy Rule, the Security Rule, and the Breach Notification Rule. The Privacy Rule ensures that all Protected Health Information (PHI) is kept confidential, and only the minimum necessary information is disclosed for healthcare operations and payment. The Security Rule establishes mandatory security measures to safeguard PHI in electronic form. The Breach Notification Rule outlines the procedures pharmacies must follow in the event of a data breach.

It is important to note that pharmacies may also be subject to more stringent state laws and federal legislation that impact their operations. For example, pharmacies in California may need to comply with the state's Confidentiality of Medical Information Act, Texas' Medical Records Privacy Act, and other cross-state laws.

To summarize, pharmacies are indeed HIPAA Covered Entities and must adhere to the Privacy, Security, and Breach Notification Rules to protect patient information and ensure compliance with HIPAA regulations.

HIPAA Privacy Rule

The HIPAA Privacy Rule establishes a set of national standards for the protection of certain health information. The U.S. Department of Health and Human Services (HHS) issued the Privacy Rule to implement the Health Insurance Portability and Accountability Act of 1996 (HIPAA). The Privacy Rule standards address the use and disclosure of individuals' health information—called "protected health information" (PHI) by organizations subject to the Privacy Rule—called "covered entities". The Privacy Rule also covers standards for individuals' privacy rights to understand and control how their health information is used.

The Privacy Rule permits a covered entity to disclose protected health information about an individual to the individual. For example, a pharmacist may provide advice to customers about over-the-counter medicines. In the context of HIPAA compliance for pharmacies, the HIPAA Privacy Rule is potentially the hardest rule to comply with. This is because retail environments are not suitable places to discuss health issues; when customers ask questions, it may be difficult to answer without being overheard and disclosing protected health information to members of the public.

To avoid unintentional violations of HIPAA, pharmacy employees need to be thoroughly trained on the permitted uses and disclosures of individually identifiable health information, the minimum necessary standard, and patients' rights under HIPAA. Pharmacy managers also need to put procedures in place to ensure every customer obtains and acknowledges receipt of a Notice of Privacy Practices, and that every employee understands the content of the Notice.

HIPAA Security Rule

The HIPAA Security Rule establishes national standards to protect individuals' electronic personal health information that is created, received, used, or maintained by a covered entity. The Security Rule requires appropriate administrative, physical, and technical safeguards to ensure the confidentiality, integrity, and security of electronic protected health information (ePHI).

The Security Rule covers the standards that Covered Entities must implement to safeguard the confidentiality, integrity, and availability of electronic Protected Health Information (PHI). To ensure compliance with the Security Rule, pharmacy managers (or the designated Compliance Officer) must identify reasonably anticipated threats to the security of data and protect the data and the systems it is stored on from unauthorized access, alteration, theft, or other impermissible uses and disclosures.

The HIPAA Security Rule provides a flexible framework for the implementation of security measures. Some requirements are mandatory, while others are "addressable", meaning that they can be implemented by the organization in a manner that is consistent with the organization's functionality, infrastructure, and resources. The security rule places a heavy emphasis on risk analysis, especially concerning electronic systems. Pharmacies should work with their vendors to identify and address appropriate security options.

The Security Rule incorporates the concepts of scalability, flexibility, and generalization. In other words, the regulations do not expect the same security precautions from small or rural providers as are demanded of large covered entities with significant resources. Security is recognized as an evolving target, and so HIPAA's security requirements are not linked to specific technologies or products. The Department of Health and Human Services (HHS) has stated that it is focused more on what needs to be done than how it should be accomplished.

To comply with the Security Rule's implementation specifications, covered entities are required to conduct a risk assessment to determine the threats or hazards to the security of ePHI and implement measures to protect against these threats and such uses and disclosures of information that are not permitted by the Privacy Rule. A risk assessment should be tailored to the covered entity's circumstances and environment, including the size, complexity, and capabilities of the covered entity, the technical infrastructure, hardware, and software security capabilities, the probability and criticality of potential risks to ePHI, and the costs of security measures.

HIPAA Compliance for Pharmacies

The Health Insurance Portability and Accountability Act (HIPAA) sets minimum federal standards for privacy and security of protected health information (PHI). HIPAA applies to organisations and individuals who submit claims electronically. As most pharmacies and pharmacists submit claims electronically, they are covered entities under the HIPAA privacy and security rules.

Most pharmacies transmit health information in connection with transactions for which the Department of Health and Human Services (HHS) has adopted standards, and this would qualify them as HIPAA Covered Entities. However, this is complicated by the fact that health care providers are defined as:

> "...a provider of services (as defined in 42 U.S.C. 1395x(u)), a provider of medical or health services (as defined in 42 U.S.C. 1395x(s)), and any other person or organisation who furnishes, bills, or is paid for health care in the normal course of business.”

The references to 42 U.S.C. 1395x are of no value as most pharmacies do not provide services that meet the criteria of these parts. However, as a “person or organisation who furnishes, bills, or is paid for health care”, most pharmacies qualify as Covered Entities because health care is defined in the Administrative Simplification Regulations as including “ [the] sale or dispensing of a drug, device, equipment, or other item in accordance with a prescription.”

The HIPAA Rules for Pharmacies

When pharmacies qualify as Covered Entities, they are required to comply with the Administrative Requirements of HIPAA, the HIPAA Privacy Rule, the HIPAA Security Rule, and – if a breach of unsecured Protected Health Information occurs – the HIPAA Breach Notification Rule.

The Administrative Requirements of HIPAA

An often-overlooked area of HIPAA compliance for pharmacies is the Administrative Requirements of HIPAA (45 CFR §162). This section of the Administrative Simplification Regulations relates to unique health identifiers, the general provisions for covered transactions, the operating rules for ASC X12/NCPDP eligibility and claim status transactions, code sets, and Medicaid pharmacy subrogation transactions.

The HIPAA Privacy Rule

In the context of HIPAA compliance for pharmacies, the HIPAA Privacy Rule is potentially the hardest Rule to comply with. This is because retail environments are not suitable places to discuss health issues; and, when customers ask questions, it may be difficult to answer the questions without being overheard and disclosing Protected Health Information to members of the public. Pharmacy employees need to be thoroughly trained on the permitted uses and disclosures of individually identifiable health information, the minimum necessary standard, and patients' rights under HIPAA. Pharmacy managers also need to put procedures in place to ensure every customer obtains and acknowledges receipt of a Notice of Privacy Practices.

The HIPAA Security Rule

The HIPAA Security Rule covers the standards Covered Entities must implement to safeguard the confidentiality, integrity, and availability of electronic Protected Health Information. To ensure compliance with the Security Rule, pharmacy managers (or the designated Compliance Officer) must identify reasonably anticipated threats to the security of data and protect data – and the systems data is stored on – from unauthorized access, alteration, theft, or other impermissible uses and disclosures.

The Breach Notification Rule

The Breach Notification Rule mandates the procedures pharmacies have to follow if unsecured Protected Health Information is exposed to a third party (i.e., overheard in a retail environment). Generally, these involve notifying the individual(s) and the HHS' Office for Civil Rights of the breach, explaining what happened, what information was exposed, and what actions the pharmacy is taking to mitigate harm.

Best Practices for HIPAA Compliance for Pharmacies

• Appoint privacy and security officers – Any member of staff can be designated a privacy and/or security officer. Their primary responsibilities are to conduct risk analyses, identify threats to the confidentiality, integrity, and availability of Protected Health Information and develop policies and procedures to mitigate the risks to a reasonable and appropriate level.
• Ensure PHI is not impermissibly disclosed – Accidentally or deliberately disclosing PHI for reasons not permitted by the Privacy Rule can cause considerable harm to patients. Policies and procedures must be developed and implemented to reduce the risk of impermissible disclosures.
• Obtain authorizations when necessary – HIPAA requires the disclosure of PHI when requested by a patient or HHS' Office for Civil Rights. It also permits the use of PHI for treatment purposes, requesting or receiving payment, and pharmacy operations. Any other use or disclosure of PHI must be authorized by the patient in writing prior to PHI being used or disclosed.
• Obtain business associate agreements – A third party that needs access to PHI or copies of PHI to perform a service on behalf of the pharmacy is classed as a business associate. A business associate must provide reasonable assurances to the pharmacy, by means of a business associate agreement, that the requirements of HIPAA have been understood and that HIPAA Rules will be followed.
• Inform patients of privacy practices – All HIPAA covered entities must document their privacy practices and share that information with patients. Signatures should be obtained from patients confirming they have received the notice of privacy practices, which should also inform them of how they can make a complaint if they feel their HIPAA rights have been violated.

HIPAA Violations

Pharmacies are considered "Covered Entities" under HIPAA and must comply with its Privacy and Security Rules. However, there are exceptions. For instance, a pharmacy that does not transmit health information electronically or does not dispense prescription drugs or equipment may not be subject to HIPAA.

• Unauthorized access to patient health records: Intentionally or unintentionally accessing patient health records without proper authorization or a legitimate need violates patient privacy rights.
• Improper disposal of patient information: Pharmacies must dispose of patient records, prescription labels, and medication information securely and completely. Inadequate disposal methods, such as throwing them in regular trash bins, can expose sensitive data to unauthorized individuals.
• Inadequate physical security: Failure to implement appropriate physical safeguards, such as leaving patient records or prescription pads unattended in accessible areas, compromises the confidentiality of patient information.
• Mishandling of prescriptions: Disclosing patient prescription information to third parties without proper consent or following established verification procedures breaches patient confidentiality.
• Lack of employee training: Pharmacies are required to educate their staff and volunteers about HIPAA's privacy, security, and breach notification rules. Inadequate training increases the risk of inadvertent mishandling of patient information.

Violating HIPAA can result in civil penalties imposed by the Health and Human Services (HHS) Office for Civil Rights (OCR). The penalties vary based on the severity and level of culpability, ranging from $127 to $1,919,173 per violation. In some cases, violations may be referred to the US Department of Justice if criminal activity is involved.

Frequently asked questions