Describe HIPAA privacy rules relevant to AHIP 4 exam topics (PHI protection, consent, disclosures).

• A. PHI can be shared freely without consent among team members.
• B. HIPAA governs protection of PHI, minimum necessary disclosures, and patient consent requirements; agents must safeguard information and only use or disclose as allowed.
• C. HIPAA applies only to hospitals.
• D. PHI must be disclosed to all plans.

Answer: (B)

HIPAA privacy rules focus on protecting PHI, limiting how it can be used or disclosed, and requiring safeguards by those who handle it. PHI is identifiable health information related to a person’s care or payment for care. The rule promotes the minimum necessary standard, so disclosures are limited to the smallest amount needed to accomplish the purpose. For routine treatment, payment, and health care operations, disclosures may occur without patient authorization to the appropriate people, but only when they’re allowed and kept to the minimum necessary. If a use or disclosure isn’t within those permitted categories, explicit patient authorization is needed. Those who handle PHI, including business associates and other agents acting on behalf of covered entities, must protect the information and only use or disclose it as allowed.

That view aligns with why HIPAA is described as governing PHI protection, the minimum necessary disclosures, and patient consent/authorization requirements, with safeguards extended to agents. Misconceptions people sometimes encounter include thinking PHI can be shared freely within a care team, that HIPAA only applies to hospitals, or that PHI must be disclosed to every plan. None of those are accurate in light of the protections and restrictions HIPAA establishes.