Describe the security and privacy components of HIPAA

What will be an ideal response?

The HIPAA security rule attempts to assure patient confidentiality by securing administrative, physical, and technical office procedures. Psychologists and physicians restrict information to only those people who have a right to know it. The security rule also requires keeping information received on fax machines, written on telephone message pads, and even on sign-in sheets from being viewed by an unauthorized person, usually defined as someone who does not work in the office.
Protected Health Information (PHI) is information about your health or health care that is maintained as a medical record or transmitted to another person. The HIPAA privacy rule requires that psychologists must obtain a patient’s consent before using any PHI to carry out treatment, payment, or health care operations. In other words, when you sign the HIPAA consent form, you agree to allow your clinician to share your health information with (a) other health care professionals who may be involved in your treatment; (b) companies responsible for billing your insurance or paying your physician for services; and (c) companies responsible for arranging medical or legal reviews of services and auditing of medical care facilities. It also covers some other business related functions, but these are less relevant to psychology. HIPAA consent does not include permission to share records with an employer or a school. Similarly, the psychologist’s patient notes (called psychotherapy notes or process notes) are not considered part of the information included in the general HIPAA consent.