Hipaa Laws: International Patients Included Or Exempt?

The applicability of the Health Insurance Portability and Accountability Act (HIPAA) to international patients is a complex issue that has been the subject of much debate and discussion. HIPAA, enacted in 1996, establishes standards for safeguarding patient Protected Health Information (PHI) and modernizing information flow in the healthcare industry. While it primarily applies to American citizens and organizations, its reach in the context of international patients and research has been questioned. Some researchers and institutions argue that HIPAA's requirements apply to the use and disclosure of foreign nationals' PHI by US-covered entities or researchers, even outside the US. Others, however, believe that HIPAA does not supersede foreign laws and is therefore inapplicable in such cases. The lack of clear guidance from the Department of Health and Human Services (HHS) on the scope of HIPAA's international application has led to concerns in the pharmaceutical, biotechnology, and medical device industries, potentially impacting outsourcing decisions and privacy protections for research subjects.

International research

The applicability of HIPAA laws to international patients is a complex and evolving issue. While HIPAA laws primarily focus on protecting the health records of American citizens, there are instances where they can apply to international patients, especially when they receive treatment from covered entities in the United States.

HIPAA, the Healthcare Insurance Portability and Accountability Act, was established in 1996 to modernise the flow of information within the healthcare industry and set standards for safeguarding patient health information. It applies to "covered entities" which include organisations or entities directly providing treatment, payment, and operations in healthcare, and their "business associates" like vendors and service providers who have access to patient information.

In the context of international patients, the Department of Health and Human Services (HHS) has clarified that the definition of an "individual" under HIPAA includes foreign military and diplomatic personnel, their dependents, and overseas foreign national beneficiaries. This suggests that HIPAA applies as long as a covered entity and protected health information (PHI) are involved. PHI refers to individually identifiable health information, which can include details such as names, addresses, social security numbers, and indirect identifiers such as zip codes or dates of birth.

However, the extent of HIPAA's reach outside of the United States is still a matter of debate. Some researchers and institutions conclude that HIPAA's requirements do attach to the use and disclosure of a foreign national's PHI by US covered entities or researchers, even if it occurs outside the US. On the other hand, others argue that HIPAA does not apply in such cases due to legal conflicts of law, and that foreign laws, such as the European Union's directives on data protection, would take precedence.

To address this ambiguity, the SACHRP (an advisory committee to HHS) has strongly urged the Department to develop and publish clear guidance on the scope of HIPAA's application in international contexts. They suggest that guidance be formulated to clarify how HIPAA's hybrid entity requirements can be applied to covered entities conducting international research. Additionally, SACHRP recommends addressing the complexity of HIPAA's privacy concepts in international settings, especially in developing countries, by allowing for a simplified version of the authorisation requirement for foreign subjects.

In the meantime, international patients seeking treatment from US-based covered entities or their business associates will likely be subject to HIPAA protections. This means that their PHI will be safeguarded according to HIPAA standards, and they will have certain rights regarding their health information.

Overall, while the applicability of HIPAA to international patients is still evolving, it is clear that US-based covered entities and their business associates must comply with HIPAA standards whenever they handle PHI, regardless of the patient's nationality.

Business Associate Agreements

The Healthcare Insurance Portability and Accountability Act (HIPAA) was signed into law in 1996 to modernise the flow of information within the healthcare industry and set standards for the privacy of health information. It applies to 'covered entities' and their 'business associates'. Covered entities are organisations or entities that provide treatment, payment, and operations in healthcare. Business associates are vendors and service providers who have access to patient information and provide support to covered entities.

• Determine what PHI the Business Associate will access and how it will safeguard that PHI.
• Require and log employee HIPAA training.
• Outline procedures to take in the event of a data breach.
• Detail the necessity of subcontractor compliance.
• Plan for the termination of the agreement, including the process for the destruction or return of PHI.

Business associates can be held liable for PHI exposure, just like covered entities. Entering into a BAA holds business associates accountable for complying with HIPAA or risking penalties associated with non-compliance.

Patient consent

The Health Insurance Portability and Accountability Act (HIPAA) was signed into law in 1996 to modernise the flow of information within the healthcare industry and set standards for the privacy of important health information. The HIPAA Privacy Rule permits but does not require covered healthcare entities to obtain patient consent before using or disclosing Protected Health Information (PHI) for treatment, payment, and healthcare operations.

Entities can share PHI digitally or by phone, fax, or mail. While HIPAA does not require that healthcare entities offer patients a choice about the sharing of their PHI, many entities and states have adopted policies or laws that require patient consent. In these cases, the entity is required to document the patient's basic consent preference, such as opting in or out of electronic exchange.

An authorization, as defined by the Privacy Rule, is required for uses and disclosures of PHI not otherwise allowed by the Rule. An authorization is a detailed document that gives covered entities permission to use PHI for specified purposes, generally other than treatment, payment, or healthcare operations, or to disclose PHI to a third party specified by the individual. An authorization must specify a number of elements, including a description of the PHI to be used and disclosed, the person authorised to make the use or disclosure, the person to whom the covered entity may make the disclosure, an expiration date, and, in some cases, the purpose for which the information may be used or disclosed. With limited exceptions, covered entities may not condition treatment or coverage on the individual providing an authorization.

Right to be forgotten

The Right to be Forgotten is a key difference between HIPAA and the EU's GDPR. While HIPAA does not give patients the right to be forgotten, GDPR does. This means that, under certain circumstances, patients can request that an organisation erases their data.

This right can be difficult to uphold for healthcare providers, as they will need complete visibility and control over where a patient's data is stored—not only by the healthcare provider itself but also by business associates and affiliates. For example, if data is stored in the cloud or with a third-party business associate, the provider must know what controls those third parties have in place to uphold the right to erasure.

HIPAA, the Healthcare Insurance Portability and Accountability Act, was signed into US law in 1996. It sets standards for safeguarding patient protected health information (PHI). Covered entities, such as healthcare providers, and their business associates, such as vendors and service providers, must meet HIPAA compliance.

Overseas organisations must also comply with HIPAA if they want to do business with American healthcare organisations. American healthcare systems will need guarantees that vendors are willing and able to safeguard PHI. This is achieved through Business Associate Agreements, which are legal contracts that outline the requirements for organisations to safeguard PHI.

Data security

The Healthcare Insurance Portability and Accountability Act (HIPAA) was signed into law in 1996 to modernise the flow of information within the healthcare industry and set standards for the privacy of health information. It applies to "covered entities" and their "business associates". Covered entities are organisations or entities that provide treatment, payment, and operations in healthcare. Business associates are vendors and service providers who have access to patient information and provide support in treatment, payment, or operations.

HIPAA's data security requirements apply to all covered entities and their business associates, regardless of whether they are based in the United States or overseas. This means that international companies that deal with protected health information (PHI) must have physical, technical, and administrative security measures in place to be considered compliant with HIPAA. PHI is defined as "individually identifiable health information", including information such as name, address, or social security number, as well as "indirect identifiers" such as zip codes or date of birth, when attached to any health information.

To ensure data security, covered entities and their business associates must implement appropriate security measures to protect PHI. This includes measures such as password protection, encryption, and other technical safeguards. Additionally, employees who have access to PHI must be trained on HIPAA security standards and the proper handling of sensitive information.

Business Associate Agreements are also crucial for data security under HIPAA. These agreements are legal contracts between covered entities and their business associates that outline the duties and responsibilities related to the protection of PHI. The agreements must address specific items, including determining what PHI the business associate will access and how it will be safeguarded, requiring and logging employee HIPAA training, outlining procedures in the event of a data breach, and detailing the necessity of subcontractor compliance.

Overall, the data security requirements of HIPAA are designed to protect the privacy and security of PHI, regardless of whether the covered entity or business associate is based in the United States or internationally. Non-compliance with HIPAA can result in legal consequences, loss of reputation, and difficulty recovering from data breaches.

Frequently asked questions