1. INFORMATION REQUIRED TO BE PROTECTED.
The privacy of all medical records and other information that may be directly linked to an individual patient must be protected at all times. Information relating to a patient’s health care history, diagnosis, condition, treatment, or evaluation is considered individually identifiable information and therefore is protected at all times. Confidentiality of this health information must be maintained at all times, and may only be disclosed with the express written consent of the patient.
Non-individually identifiable health information, (e.g. health information that cannot be linked to a specific patient) is not included within the definition of protected health information.
2. BOUNDARIES ON HEALTH INFORMATION USE AND RELEASE.
An individual’s health information can be used for health purposes only.
Protect individually identifiable health information. StatFile will never publish or otherwise make generally available any information or data that identifies a patient for purposes other than treatment, payment or other health care operations, without his or her express written consent. This does not restrict the internal use of such information or data that is required in the performance of the scope of work that StatFile has been engaged to perform for a client. StatFile also maintains physical, electronic, and procedural safeguards to protect individually identifiable health information. StatFile is continually assessing those safeguards and making ongoing improvements to maintain and enhance our level of security for individually identifiable health information.
StatFile ensures that health information is not used for non-health purposes. Patient information can be used or disclosed only for purposes of treatment, payment, and health care operations. Protected health information cannot be used for purposes not related to health care without explicit authorization from the patient. For example, StatFile may not access the personal health information obtained by an affiliate for any purpose other than to perform the services for which we were engaged, unless StatFile first obtains the explicit authorization of the patient.
StatFile will maintain health information in a manner to protect confidentiality. All individually identifiable health information shall be maintained by StatFile in a confidential manner that prevents unauthorized use and disclosure to third parties. For example, StatFile may share confidential information with a third party under contract or affiliated with StatFile for the same purpose of performing the services for which we were engaged, provided that the information shall remain confidential at all times and shall be shared with only those persons that have authority to receive such information.
Penalties For Misuse of Personal Health Information
There are serious penalties for violation of the confidentiality of protected health information. Please be advised of the following:
- State Penalties. Various state laws impose criminal and civil penalties on individuals who misuse or disclose individually identifiable health information without explicit consent by the patient.
- Federal Penalties. HIPAA (Health Insurance Portability and Accountability Act) is a piece of federal legislation that directly addresses the privacy and security protection of individually identifiable health information. HIPAA calls for civil and criminal penalties for privacy and security violations, including:
- Fines up to $25,000 for multiple violations of the same standard in a calendar year.
- Fines up to $250,000 and/or imprisonment up to 10 years for knowing misuse of individually identifiable health information.
- StatFile Penalties. Any employee who violates the privacy and confidentiality of patient health information, through disclosure or otherwise, may be subject to disciplinary action, including termination of his or her employment with StatFile.