Frequently asked questions and support documentation for Accountable

• How can I distinguish between activities for treatment or health care operations versus marketing activities?
• Who must comply with HIPAA?
• Since the HIPAA Privacy Rule protects a decedent’s health information for 50 years following the individual’s death, am I required to keep the decedent’s information for that period of time?
• May a covered entity share protected health information directly with another covered entity's business associate?
• Is a covered entity liable for, or required to monitor, the actions of its business associates?
• Does the HIPAA Privacy Rule protect genetic information?
• Do the HIPAA Privacy Rule protections apply to the health information of deceased individuals?
• Can covered entities continue to disclose adverse event reports that contain protected health information to the Department of Health and Human Services (HHS) Office for Human Research Protections?
• Are tissue repositories covered entities?
• When an individual reaches the age of majority or becomes emancipated, who controls the protected health information concerning health care services rendered while the individual was an unemancipated minor?

Browse all articles

• Do the standards of the Security Rule require use of specific technologies?
• Is a software vendor a business associate of a covered entity?
• Instead of entering into a contract, can business associates self-certify or be certified by a third party as compliant with the HIPAA Privacy Rule?
• What is required to De-Identify PHI?
• Who is considered a 'Business Associate'?
• Has the Secretary exceeded the HIPAA statutory by requiring "business associates" to comply with the Privacy Rule, even if that requirement is through a contract?
• Does the HIPAA Privacy Rule require a business associate to create a notice of privacy practices?
• Is a physician required to have business associate contracts with technicians such as plumbers, electricians or photocopy machine repairmen who provide repair services in a physician's office?
• Under the HIPAA Privacy Rule, may a covered entity contract with a business associate to create a limited data set the same way it can use a business associate to create de-identified data?
• In providing legal services to a covered entity, must a lawyer who is a business associate require that those persons to whom it discloses protected health information agree to abide by the privacy restrictions and conditions that apply to the lawyer?

Browse all articles

• Who must comply with HIPAA privacy standards?
• Does the HIPAA Privacy Rule allow a health care provider to disclose protected health information (PHI) about a student to a school nurse or physician?
• What is encryption?
• If my family or friends call my health care provider to ask about my condition, will they have to give my provider proof of who they are?
• Is a health information organization (HIO) covered by the HIPAA Privacy Rule?
• Does the HIPAA Privacy Rule apply to an elementary or secondary school?
• Are communications about government programs or government-sponsored programs “marketing” under the HIPAA Privacy Rule?
• Can health care information be shared in a severe disaster?
• Does FERPA or HIPAA apply to records on students who are patients at a university hospital?
• Are physicians and doctor's offices prohibited from maintaining patient medical charts at bedside or outside of exam rooms, or from engaging in other customary practices where the potential exists for patient information to be incidentally disclosed to others?

Browse all articles