Protecting Health Information Through Privacy and Security Requirements
A payment poster opens an unfamiliar patient account to investigate a remittance. A billing representative receives a call from someone claiming to be a patient’s spouse. A department discovers that a shared spreadsheet containing account information was emailed to the wrong recipient. These situations involve different workflows, but all raise the same practical question: what information may be accessed, used, shared, or retained, and how should it be protected?
HIPAA establishes federal standards for protecting certain health information while permitting legitimate healthcare operations. Understanding those rules requires more than memorizing that patient information is confidential. Employees need to recognize who is regulated, when a use or disclosure is permitted, what safeguards apply, and when a possible incident must be escalated.
The rules intersect in everyday revenue cycle work, yet privacy permissions, security safeguards, and breach-response duties answer different questions. The situations below separate those questions before considering what a team may access, share, store, or disclose.
What HIPAA Protects in Revenue Cycle Work
The Health Insurance Portability and Accountability Act of 1996 (HIPAA) includes Administrative Simplification provisions. Regulations adopted under those provisions address privacy, security, standard transactions, and other aspects of healthcare information exchange. The U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR) administers and enforces the HIPAA Privacy, Security, and Breach Notification Rules. HHS Privacy Rule overview
Protected health information (PHI) is individually identifiable health information held or transmitted by a HIPAA-regulated covered entity or business associate, subject to exclusions in the regulatory definition. PHI can appear in paper documents, conversations, and electronic records. Electronic PHI (ePHI) is the electronic subset subject to the HIPAA Security Rule.
For example, an account number linked to a patient’s laboratory visit may be PHI when used within a covered healthcare organization. A bare procedure count without identifying information might be suitable for reporting, but the privacy assessment depends on whether individuals could reasonably be identified and which de-identification method is used.
Who must comply?
HIPAA applies to covered health plans, healthcare clearinghouses, and healthcare providers that transmit health information electronically in connection with covered standardized transactions. Business associates performing specified functions involving PHI on behalf of covered entities also have direct regulatory responsibilities, and written business associate agreements are generally required when applicable.
A healthcare company doesn't become a covered entity solely because it is healthcare-related, and every employee is not personally a covered entity. Workforce members follow their organization’s HIPAA-compliant policies and role-based obligations. State privacy laws and other federal requirements may provide additional protections.
Privacy, Security, and Breach Notification Are Different Rules
A permitted disclosure can still be insecurely handled. Conversely, an encrypted file isn't automatically permissible to share with anyone. Staff must consider both the purpose of accessing the information and the safeguards used to protect it.
When PHI May Be Used or Disclosed
The Privacy Rule generally permits covered entities to use or disclose PHI for treatment, payment, and healthcare operations (TPO) without a separate HIPAA authorization, subject to the Rule’s applicable conditions. It also permits or requires certain other disclosures, including specified public health activities and disclosures required by law. Not all disclosures fit into TPO, and special rules apply to some information or purposes. HHS TPO guidance
The minimum-necessary standard
When it applies, minimum necessary generally requires reasonable efforts to limit PHI used, requested, or disclosed to what is needed for the intended purpose. It is not a universal “one field at a time” rule. HHS identifies exceptions, including disclosures to or requests by providers for treatment, disclosures to the person who is the subject of the information, uses or disclosures pursuant to an individual’s authorization, and certain legally required disclosures. HHS minimum-necessary guidance
A payment posting analyst investigating a single EFT discrepancy may need the remittance, account identifier, transaction history, and applicable payer information. Exporting an entire patient population into an unapproved workbook would demand a separate justification and safeguards. The right scope depends on the assigned task, role, and organization’s procedures.
Verifying people and communication channels
Requests arriving by telephone, fax, email, portal, or mail need reasonable identity and authority verification as applicable. A person claiming to be a spouse, parent, attorney, or insurance representative isn't automatically entitled to the information requested. The Privacy Rule includes rules addressing personal representatives and disclosures to persons involved in care or payment; staff should use the organization’s verification and authorization process rather than improvising.
Individual Rights and Operational Responsibilities
Individuals generally have HIPAA rights to access and obtain copies of their PHI in a designated record set, request amendments, receive a notice of privacy practices, request certain restrictions and confidential communications, and obtain an accounting of certain disclosures. Each right has qualifications and procedures. Staff should identify the request and route it appropriately instead of assuming ordinary billing access grants authority to decide every request.
For revenue cycle teams, patient record integrity and privacy often intersect. Correcting a wrong patient identifier, responding to an access request, and investigating a privacy incident may involve different departments and authorization levels.
How the Security Rule Protects ePHI
The Security Rule requires regulated entities to implement reasonable and appropriate safeguards protecting the confidentiality, integrity, and availability of ePHI. Its provisions include required and addressable implementation specifications. “Addressable” does not mean optional by default: an organization must assess whether a specification is reasonable and appropriate and implement it, or document an appropriate alternative or rationale under the rule.
Risk analysis and risk management
A Security Rule risk analysis evaluates risks and vulnerabilities affecting ePHI; risk management is the process of selecting and implementing safeguards to reduce those risks to a reasonable and appropriate level. A scanner sending confidential reports to a shared destination, for example, may require an assessment of access privileges, routing, storage, and auditability. An informal assumption that “our software is secure” is not a risk analysis. HHS risk-analysis guidance
Technology changes and proposed requirements
HHS published proposed changes to strengthen the HIPAA Security Rule in January 2025. As of this guide’s October 2026 preparation, HHS’s Security Rule overview continues to distinguish the currently effective rule from the proposed modifications. A proposed requirement should not be represented as already binding. Organizations must review finalized regulations and effective dates before revising compliance claims or procedures. Current HHS Security Rule overview
Applying HIPAA During Revenue Cycle Work
A typical revenue cycle employee may encounter PHI while verifying eligibility, preparing claims, posting payments, handling denials, or assisting patients. The information must be accessible for legitimate work without becoming freely available to anyone who asks.
A practical review before sharing or exporting information
- Identify the business purpose. Determine whether the task is permitted and within your assigned responsibilities.
- Confirm the person and destination. Validate the recipient, account, payer, workqueue, or approved shared location.
- Determine the information needed. Apply minimum necessary where required and avoid unnecessary extracts.
- Use approved safeguards. Choose authorized applications, file-transfer methods, and storage locations.
- Keep transaction history intact. Maintain records or audit trails under applicable policies rather than changing source information to hide an error.
- Escalate anomalies promptly. Report suspected misdirected PHI, unauthorized access, or system exposure through established channels.
Billing and remittance examples
Example: A payer requests proof of a service. Authorized billing staff may provide appropriately limited supporting information for payment, using approved channels and applicable policy. They should not send a full unrelated medical record merely because it is available.
Example: A posting analyst creates a reconciliation file. If claim identifiers and patient information are necessary for approved research, the file should be stored and transmitted only in approved environments with suitable access limits. For general educational examples or external presentations, fictional or properly de-identified records are preferable.
Example: A supervisor requests an exception report. Whether named account details are necessary depends on the operational task. An aggregate trend report may meet one purpose, while an authorized account correction legitimately requires transaction-level details.
Recognizing Incidents and Potential Breaches
A security incident can include an attempted or successful unauthorized access, use, disclosure, modification, destruction, or interference involving information or systems. An impermissible use or disclosure of PHI may require a separate breach assessment. Neither label alone proves that legally required breach notification is due.
Under HIPAA’s Breach Notification Rule, an impermissible use or disclosure of unsecured PHI is generally presumed a breach unless an applicable exception or documented risk assessment establishes a low probability that the PHI was compromised. The assessment considers the nature of the information, the unauthorized person, whether it was actually acquired or viewed, and mitigation. The designated privacy/security personnel should determine the regulatory response. HHS breach notification guidance
Breach notification timing
For qualifying breaches of unsecured PHI, covered entities generally notify affected individuals without unreasonable delay and no later than 60 calendar days after discovery. Breaches involving 500 or more individuals generally require notification to HHS within 60 days; reports involving fewer than 500 individuals may be submitted to HHS annually, no later than 60 days after the end of the calendar year in which they were discovered. Certain breaches also require media notification. Business associates must notify covered entities under applicable requirements. These are regulatory outside limits, not instructions to wait until the last day.
An internal event should be reported promptly even when staff are uncertain whether it is a reportable breach. Delayed reporting can impair containment, factual review, and legal deadline compliance.
Troubleshooting Common HIPAA Workflow Problems
Worked Scenarios and Decision-Making
Scenario A: A claim report goes to the wrong recipient
Illustrative example: A representative exports 35 claim rows containing names, dates of service, and balances. An email autocomplete entry selects an unrelated external recipient. The sender notices the mistake two minutes later.
The first response isn't to assume there's no breach because only 35 records were involved, nor to send a second email requesting that the recipient ignore the first. The employee should promptly report the event, document the known circumstances, and follow authorized containment instructions. Privacy and security staff assess recipient status, whether the contents were accessed, mitigation evidence, and notification obligations. A small number of affected individuals does not eliminate the need for assessment.
Scenario B: A spouse calls about a balance
Illustrative example: A caller states that they are the patient’s spouse and wants the patient’s entire itemized statement and diagnosis history. They know the patient’s address and account balance.
The representative should use approved verification and disclosure procedures. HIPAA has provisions allowing certain disclosures to persons involved in an individual’s care or payment, but the degree of information and circumstances matter. Knowing an address is not itself a universal authorization. If the request exceeds what the employee can validate, route it to the designated department rather than disclosing or making an unsupported denial of all assistance.
Scenario C: Unauthorized account browsing
Illustrative example: An employee who normally posts insurance payments opens an acquaintance’s medical account out of curiosity, without a work purpose. No information is downloaded or shared.
An unauthorized access may still violate policy and require investigation even without copying the record. Access audit records, work assignments, information viewed, and potential additional uses should be preserved and evaluated by authorized privacy/security personnel. A breach assessment is fact-specific; the employee should not decide that “nothing happened” solely because a file was not emailed.
Scenario D: An automated export sends too much information
Illustrative example: A scheduled revenue cycle report meant to summarize denial counts begins attaching patient identifiers and detailed clinical notes to a distribution list.
Containment may require pausing the distribution through approved change controls, securing copies already sent, determining authorized recipients, and involving privacy/security. The longer-term fix could involve revising the export query, field-level permissions, recipient lists, test cases, and monitoring. Correcting the report does not substitute for assessing any prior unauthorized disclosures.
Compliance Practices, Responsibilities, and Audit Readiness
HIPAA compliance is an organizational responsibility involving privacy officers, security personnel, HIM, IT, compliance, supervisors, and the workforce. Staff members are expected to follow training, policies, role-based access rules, and incident-reporting procedures. Whether an activity requires formal documentation or an organizational safeguard depends on the applicable provision and setting.
Organizations should distinguish implementation evidence from assertions that a policy exists. Relevant records may include training documentation, access-review histories, risk assessments, incident logs, business associate agreements, audit logs, procedures, and corrective-action evidence. Retention requirements vary by record type; for example, the HIPAA Security Rule generally requires specified policies, procedures, and required documentation to be maintained for six years from creation or last effective date, whichever is later. This is not a universal six-year retention mandate for every medical record.
Practical Privacy and Security Review Checklist
- Identify whether the information is PHI or ePHI and whether HIPAA applies to the organization and activity.
- Confirm the business purpose and your authorization to access the account or information.
- Verify recipients and authority before disclosing patient information.
- Apply minimum necessary to requests, uses, or disclosures where the standard applies.
- Use approved systems, storage, messaging, and file-sharing channels.
- Review whether exports or reports include unnecessary patient identifiers.
- Safeguard devices, workstations, credentials, and printed material.
- Escalate any suspected misdirected PHI, unauthorized access, or security incident promptly.
- Document facts and follow-up under approved policies, without independently declaring an event reportable or harmless.
- Verify corrective changes and monitoring when a recurring problem is identified.
The central skill is recognizing the right boundary: what information is required to complete the work, who may receive it, which protections apply, and when a concern belongs with privacy or security professionals. Revenue cycle work depends on patient information, but legitimate access and responsible handling must go together.
References and Further Learning
These resources support the guide and provide opportunities for additional learning. Check applicability, publication dates, and current requirements before using a resource operationally.
References
Additional Learning
Educational Disclaimer
Revenue Cycle Uncovered is an independent educational resource. Content is provided for general informational purposes and does not represent the policies, practices, or positions of any employer or organization. Workflows, payer requirements, regulations, and operational practices may vary. Information should be independently verified when applied to specific situations.
Continue Exploring Revenue Cycle Uncovered
Explore related guides or return to the complete revenue cycle educational library.