HIPAA Privacy & HIPAA Security

Question:

What is the difference between HIPAA Privacy and HIPAA Security?

Answer:

HIPAA regulations cover both security and privacy of protected health information. Security and privacy are distinct, but go hand-in-hand.

• The Privacy rule focuses on the right of an individual to control the use of his or her personal information. Protected health information (PHI) should not be divulged or used by others against their wishes. The Privacy rule covers the confidentiality of PHI in all formats including electronic, paper and oral. Confidentiality is an assurance that the information will be safeguarded from unauthorized disclosure. The physical security of PHI in all formats is an element of the Privacy rule.
• The Security rule focuses on administrative, technical and physical safeguards specifically as they relate to electronic PHI (ePHI). Protection of ePHI data from unauthorized access, whether external or internal, stored or in transit, is all part of the security rule. Typically ePHI is stored in:
  • Computer hard drives
  • Magnetic tapes, disks, memory cards
  • Any kind of removable/transportable digital memory media
  • All transmission media used to exchange information such as the Internet, leased lines, dial-up, intranets, and private networks

NOTE: Your agency/bureau/department/division may have specific requirements – always check your policies and procedures. If you have questions, contact your Privacy Official.

U.S. Department of Health & Human Services - FAQs