HIPAA and the Privacy Act

The Privacy Act is also a federal law in the United States that applies broadly to all federal government agencies, such as the HHS. This allows for the protection of individual data, which is not limited to health information.

What is the Privacy Act?

The Privacy Act is a federal law designed to safeguard the privacy rights of individuals by regulating the collection, use, and dissemination of personal information held by federal agencies. The law aims to ensure that individuals have some control over the information collected about them by government agencies and that these agencies are transparent in their handling of personal data.

How is the Privacy Act similar to HIPAA?

One notable niche similarity between HIPAA and the Privacy Act is their emphasis on providing individuals with the right to access their personal information held by covered entities. Under HIPAA's Privacy Rule, patients have the right to access their protected health information (PHI) held by healthcare providers and health plans. Similarly, the Privacy Act grants individuals the right to access records maintained by federal agencies that contain personally identifiable information (PII) about them. In both cases, individuals can request copies of their records, review the information, and request corrections if they identify any inaccuracies. 

See also: What is a Notice of Privacy Practices?

How do HIPAA and the Privacy Act differ?

HIPAA primarily focuses on protecting individuals' health information held by healthcare providers, health plans, and related entities. Its main goal is to safeguard sensitive health data and ensure the confidentiality of patient information within the healthcare industry. On the other hand, the Privacy Act is more comprehensive and applies to federal government agencies. It regulates the handling of PII by government entities and aims to protect the privacy of all personal data held in federal records systems. Furthermore, the Privacy Act does not apply to private sector entities.

See also: HIPAA Compliant Email: The Definitive Guide

HHS Privacy Act regulations 

There are regulations of the Department of Health and Human Services (HHS) for the implementation of the Privacy Act of 1974, specifically related to the maintenance, access, correction, and disclosure of records containing personal information. These regulations apply to all components of the HHS and certain non-Federal entities operating as agents of the HHS for federal functions. 

Maintenance of records (§ 5b.4)

Records maintained by the HHS must be relevant and necessary for a Department function required by statute or Executive Order. The record must be acquired, to the extent possible, from the subject individual when it may affect their rights, benefits, or privileges under federal programs. Medical records related to the exercise of First Amendment rights are only maintained with specific authorization or in the scope of authorized law enforcement activities.

Notification and access to records (§ 5b.5) 

Individuals have the right to request notification of or access to their records. Requests should be made to the responsible Department official, and identity verification may be required. A designated representative may review the record and inform the subject individual of its contents. Special procedures are defined for medical records and records of minors.

Correction or amendment of records (§ 5b.7)

Subject individuals may request corrections or amendments to their records if they believe the information is inaccurate, incomplete, or irrelevant. Requests should be made in writing to the responsible Department official. If the responsible official agrees that corrections are necessary, the record will be amended, and previous recipients of the record will be informed. If the official disagrees, the subject individual has the right to appeal the decision.

Appeals of refusals (§ 5b.8) 

Subject individuals who disagree with a refusal to correct or amend their records may appeal the decision in writing to the appropriate appeal authority. The appeal will be processed within a specified timeframe.

Disclosure of records (§ 5b.9)

Generally, records cannot be disclosed without the consent of the subject individual. However, there are exceptions, such as disclosures to HHS employees with a legitimate need, disclosures required under the Freedom of Information Act, disclosures for routine uses as defined in the regulations, disclosures to certain government agencies for specific purposes, and disclosures under court orders.

Exempt systems of records

The Privacy Act allows certain systems of records to be exempt from some of its requirements. HHS exercises this authority only in compelling cases.

Contractor compliance

All contracts entered into or amended by HHS, where a contractor maintains a system of records to accomplish an HHS function, must include a provision requiring compliance with the Privacy Act.

See also: Can PHI be transferred outside of the United States?