A Refresher on the HIPAA and PIPEDA
No matter what country you operate out of, the regulations that govern personal information are a big deal. As healthcare providers, you are trusted and expected to store patient data securely, and the consequences are immense if you don’t.
The HIPAA (Standards for Privacy of Individually Identifiable Health Information) is the enacted rule in the United States that regulates the protection of patients’ personal or protected health information. The PIPEDA (Personal Information and Protection of Electronic Documents Act) is the legislation that governs the gathering of consent when practices want to use or disclose a patient’s collected information, in Canada.
This blog is only meant to serve as a guide and does not replace or supersede the legislature it discusses. Please refer to the original laws to ensure you understand the full scope of each and seek legal counsel if you have questions.
Keeping track of the guidelines and laws surrounding the collection of your patients’ information can get confusing and at worst, overwhelming. We’ve put together a quick overview of the legislation in North America so you can make sure that all your marketing endeavours are within the law.
All Federally regulated organizations that conduct business in Canada are subject to PIPEDA. The act also applies to their employees’ information.
Under PIPEDA, personal information includes any factual or subjective information, recorded or not, about an identifiable individual. This includes information in any form, such as:
- age, name, ID numbers, income, ethnic origin, or blood type;
- opinions, evaluations, comments, social status, or disciplinary actions; and
- employee files, credit records, loan records, medical records, the existence of a dispute between a consumer and a merchant, intentions (for example, to acquire goods or services, or change jobs).
Business’ responsibilities under PIPEDA are outlined in the 10 fair information principles. They are:
- Identifying Purposes
- Limiting Collection
- Limiting Use, Disclosure, and Retention
- Individual Access
- Challenging Compliance
HIPAA (United States of America)
HIPAA is part of the Health Insurance Portability and Accountability Act, passed in 1994 that serves to enforce privacy standards relating to individually identifiable health information. That information includes:
- The patient’s name, address, birthday, or social insurance number
- The patient’s past, present, or future mental or physical health condition
- Any services or care you’ve provided to the patient in the past or are currently providing the patient
- Any other information that one might reasonably believe could be used to identify your patient
You need a patient’s written consent to include them in marketing campaigns, so be careful that your patient is not just implying their consent.
One More Caution
While the federal legislation applies to all federally regulated businesses (like eye care practices), many provinces, territories, and states have their own legislation that deals with privacy and the use of personal information. Keeping up to date with your location’s legislation is pivotal in your efforts to keep your patients’ information safe while keeping them informed of the information they need. As always, if you want guidance on your marketing efforts, or just want to speak to the experts, contact us here.
HIIPAA na PIPEDA: Haijalishi ni nchi gani unayofanya kazi, kanuni zinazosimamia habari za kibinafsi ni jambo kubwa. Kama watoa huduma za afya, unategemeka na unatarajiwa kuhifadhi data ya mgonjwa kwa usalama, na matokeo ni makubwa ikiwa hautaki kufanya hivyo. HIPAA (Standard for Privacy of Individually Identifiable Health Information) ni sheria iliyopitishwa nchini Marekani ambayo inasimamia ulinzi wa habari za kibinafsi au za kinga za afya za wagonjwa. Sheria ya Ulinzi wa Hati za Elektroniki na Habari za Kibinafsi (PIPEDA) ni sheria inayosimamia kukusanya idhini wakati mazoezi yanataka kutumia au kufichua habari zilizokusanywa za mgonjwa. Blogi hii inakusudiwa tu kutumika kama mwongozo na haibadilishi au kuchukua nafasi ya bunge linalozungumzia. Tafadhali tazama sheria za awali ili kuhakikisha unaelewa kikamilifu wigo wa kila moja na kutafuta ushauri wa kisheria kama una maswali. Kufuatilia miongozo na sheria zinazozunguka ukusanyaji wa habari za wagonjwa wako inaweza kuwa ya kutatanisha na mbaya zaidi, yenye nguvu. Tumeweka pamoja muhtasari wa haraka wa sheria katika Amerika ya Kaskazini ili uweze kuhakikisha kwamba juhudi zako zote za uuzaji ziko ndani ya sheria. Shirika lolote linalofanya kazi nchini Canada linapaswa kufuata sheria ya PIPEDA. Sheria hiyo inatumika pia kwa habari za wafanyakazi wao. Chini ya PIPEDA, habari ya kibinafsi inajumuisha habari yoyote ya kweli au ya kibinafsi, iliyoandikwa au isiyoandikwa, kuhusu mtu anayeweza kutambuliwa. Hii inajumuisha habari katika fomu yoyote, kama vile: umri, jina, nambari za kitambulisho, mapato, asili ya kikabila, au kundi la damu; maoni, tathmini, maoni, hali ya kijamii, au hatua za nidhamu; na faili za wafanyikazi, rekodi za mkopo, rekodi za mkopo, rekodi za matibabu, kuwepo kwa mzozo kati ya mteja na mfanyabiashara, nia (kwa mfano, kupata bidhaa au huduma, au kubadilisha kazi). Uwajibikaji wa biashara chini ya PIPEDA umeelezwa katika kanuni kumi za habari ya haki. Hizi ni: - Kutambua Malengo - Kupunguza Mkusanyiko - Kupunguza Matumizi, Kufunua, na Uhifadhi - Upatikanaji wa Mtu binafsi - Kushindana na Ufuatiliaji - HIPAA (Mataifa ya Marekani) - HIPAA ni sehemu ya Sheria ya Uhamisho wa Bima ya Afya na Uwajibikaji, iliyopitishwa mnamo 1994, ambayo hutumika kutekeleza viwango vya faragha vinavyohusiana na habari ya afya inayoweza kutambuliwa. Habari hizo ni pamoja na: jina la mgonjwa, anwani, siku ya kuzaliwa, au nambari ya bima ya kijamii, hali ya afya ya akili au ya mwili ya mgonjwa ya zamani, ya sasa, au ya baadaye, huduma yoyote au huduma ambayo umempa mgonjwa hapo awali au unampa mgonjwa sasa, habari nyingine yoyote ambayo mtu anaweza kuamini inaweza kutumika kutambua mgonjwa wako, unahitaji idhini ya mgonjwa kwa maandishi ili kujumuisha katika kampeni za uuzaji. Sheria ya shirikisho inatumika kwa biashara zote zinazodhibitiwa na shirikisho (kama mazoezi ya huduma ya macho), majimbo mengi, maeneo, na majimbo yana sheria zao wenyewe zinazohusiana na faragha na matumizi ya habari za kibinafsi. Kuendelea na sheria ya eneo lako ni muhimu katika juhudi zako za kuweka habari za wagonjwa wako salama wakati wa kuwajulisha habari wanayohitaji. Kama kawaida, kama unataka ushauri juu ya juhudi zako za uuzaji, au unataka tu kuzungumza na wataalamu, wasiliana nasi hapa.