HIPAA Privacy Standards - Submitters of PHI

Important message about HIPAA Privacy Standards to providers and entities that submit protected health information to the Texas Department of State Health Services

The Health Insurance Portability and Accountability Act of 1996 (HIPAA) privacy regulations implemented standards for how information that identifies a patient can be used and disclosed. (Title 45, Code of Federal Regulations (CFR), Parts 160 and 164)  The regulations apply to "covered entities" including health-care plans, health-care clearinghouses, and health-care providers. These privacy standards went into effect on April 14, 2003.

The regulations were amended in August 2002 deleting the requirement to obtain an individual’s consent for the use and disclosure of private health information for treatment, payment and health care operations. (45 CFR §164.506).

You can continue to submit information you currently submit to DSHS under one or more of the following exceptions in the HIPAA Privacy Standards:

• USE AND DISCLOSURE REQUIRED BY LAW:
  Section 164.512(a) allows covered entities to use and disclose private health information if the use or disclosure is required by law.  For example, DSHS rules require certain diseases, injuries and conditions to be reported to DSHS. Under the "required by law" exception you can continue to comply with these mandatory reporting rules.
• USE AND DISCLOSURE FOR PUBLIC HEALTH ACTIVITIES:
  Section 164.512(b) permits covered entities to release private health information to a public health authority that is authorized by law to collect and receive information for preventing and controlling disease, injury, or disability. This information includes reporting of; disease, injury, vital statistics like births, deaths, marriages, divorces, etc., public health investigations, and public health interventions. Under this exception you are authorized to release information to DSHS, or other public health authorities.  Disclosure can be initiated by either the public health authority or by you, if it is for one of the above reasons.
• USE AND DISCLOSURE FOR HEALTH OVERSIGHT ACTIVITIES:
  Section 164.512(d) permits covered entities to disclose private health information to a health oversight agency for oversight activities including audits, civil, administrative or criminal investigations, inspections, licensure or disciplinary actions, or other activities necessary for the oversight of the health-care system, government benefit programs, compliance with governmental regulation or compliance with civil rights laws.
• USE AND DISCLOSURE FOR LAW ENFORCEMENT PURPOSES:
  Section 164.512(f) permits disclosure of private health information to a law enforcement officer for certain law enforcement purposes.
• USE AND DISCLOSURE TO AVERT A SERIOUS THREAT TO HEALTH OR SAFETY:
  Section 164.512(j) permits disclosure of private health information if a covered entity in good faith believes the disclosure is necessary to prevent or lessen a serious and imminent threat to the health or safety of a person or the public. The disclosure must be made to a person who is reasonably able to prevent or lessen the threat, or for identification and apprehension of an individual.

THIS NOTICE IS YOUR AUTHORIZATION UNDER THE ABOVE EXCEPTIONS TO CONTINUE TO REPORT THE INFORMATION YOU CURRENTLY REPORT TO DSHS AND OTHER PUBLIC HEALTH, LAW ENFORCEMENT, AND REGULATORY AUTHORITIES.

Send questions via Email to: HIPAA Privacy Officer