HIPAA FAQs

If the information is truly de-identified under HIPAA, it is not PHI and you do not need an Authorization to use it for classroom and other educational presentations, publications, promotions or other purposes.

Ask these questions:

• Does the information include the patient’s name, initials, social security number or medical record number?
• Does the information include any dates relating to the patient, such as patient date of birth, date of treatment, dates of appointments?
• Does the information include geographic identifiers, such as the patient’s address, or even the patient’s town or zip code?
• Does an image (photo or video) show the patient’s face?
• If the image does not show the patient’s face, is it possible to identify the patient from what is shown?
• Does the information or image include any of the 18 HIPAA identifiers? See complete list in BU HIPAA Policy 1.4.
• Does the information include any other element that may be used alone or together with other available information to identify the patient?

If you answer yes to any of these questions, you need an Authorization.

• Video showing patient’s gait when showing only from the shoulders down
• Photo or video of the patient walking that shows only patient’s back
• Images of body parts that are not identifiable

73-year-old, active woman underwent a routine cardioversion for atrial fibrillation but developed multiple complications, including sepsis and respiratory failure, resulting in weakness.

Patient is a 30-year-old female with a history of right-sided headaches, after a motor vehicle accident, which occurred 1 month ago. Since the accident she reports having constant headaches. Her pain is described as a dull ache. The pain is located in the neck, back of the head, and it sometimes travels to the front of the head and into the eye. She reports daily headaches that can last anywhere from 30 minutes to hours

Ms. Wilson was born in July of 1953 and has worked for 40 years as a welder. Her COPD was first diagnosed in 2007. In the last quarter of 2017, she had a series of 3 COPD exacerbations. These exacerbations required medical intervention with antibiotic treatment and oral steroids; she was hospitalized at Boston Medical Center briefly during the last event.

PHI: For this purpose, assume PHI is any information a clinic has about any of its patients. This includes registration and payment data, demographics, the patient medical record, oral information, photos, other images and audio/video records.
De-identified PHI: PHI from which you have removed patient name, dental record number, address, contact information and all dates (DOB, treatment dates, etc.). See complete list at BU HIPAA Policy 1.4.
Patient Authorization: A signed form in which the patient gives authorization for his/her PHI to be used for a purpose other than treatment, payment and health care operations.
Minimum Necessary Rule: Always use the minimum amount of patient information needed.

No. Your response may be an impermissible disclosure of patient information and a violation of HIPAA and state privacy laws.

Absolutely, not. You should reach out to the patient offline to let them know you saw their review. You can do this at their next appointment. If the review was positive, you can tell them how much you appreciated their kind words. If the review is negative, you can hear what they have to say, and see if you can address their concerns. Although negative reviews are never enjoyable to hear, it may be an opportunity for improvement.

Unfortunately, you cannot respond to the patient’s review to say it is untrue. However, you can reach out to the website that hosts the review and ask them to remove it, since it is false.

Even if a patient identifies themselves in a review, it does not give you the ability to respond and acknowledge that they are a patient. There is no exception under HIPAA or state law for responding to a patient’s review without the patient’s authorization.

The Office of Civil Rights (OCR) has entered into settlement agreements for responding to online reviews, which include fines and monitoring by the government, with several healthcare providers. This issue is on OCR’s radar and is something they are enforcing.

We strongly recommend that no one at your clinic respond to online reviews. It is challenging to provide a meaningful response to a review when you can’t acknowledge that the person giving the review is a patient. However, if the clinic feels a response is necessary, an individual at the clinic can be specifically designated to respond to online reviews. Such person can only respond to the online review with a generic statement, which says something like, “Our office strives to provide excellent service to all patients, and we do our best to meet this goal. We encourage any patient who would like to discuss their experience to contact us directly,” or “Thank you!”

You can always reach out to hipaa@bu.edu with any questions you have about responding to online reviews or any other health privacy matters.