Health Data Privacy and HIPAA Questions

Answer (Information Security Analyst perspective)

Main differences

• Privacy Rule: Governs patients’ rights and limits use/disclosure of PHI (who, when, why). Focuses on policies, consent, minimum necessary, access requests, and administrative obligations.
• Security Rule: Focuses specifically on protecting electronic PHI (ePHI) — confidentiality, integrity, availability — via administrative, physical, and technical safeguards.

Definitions

• Covered entity: Health plans, health care providers, or clearinghouses that create/transmit PHI.
• Business associate: Vendor or partner that accesses/handles PHI on behalf of a covered entity (e.g., cloud provider, billing vendor).

Three common technical safeguards (what to implement & document)

1. Access controls — unique user IDs, role-based access, MFA; document access control policy, user provisioning/deprovisioning logs.
2. Audit controls & logging — enable detailed event logging (login, file access, configuration changes); document log retention, monitoring rules, and SIEM correlation.
3. Encryption — encrypt data at rest and in transit (TLS, full-disk or database encryption); document encryption standards, key management, and validation tests.

As an analyst I’d implement these controls, create evidence (config screenshots, audit reports, runbooks), and include them in the Security Rule risk assessment and remediation plan.