Compliance professionals and health care counsel regularly encounter a number of persistent misconceptions about HIPAA’s scope of applicability. Understanding these HIPAA Common Misconceptions — and the correct legal analysis that refutes them — is essential to advising clients accurately and building a compliance program on a sound foundation.
HIPAA Common Misconception 1: “We’re a Small Practice — HIPAA Doesn’t Apply to Us”
False. HIPAA does not have a small provider exception beyond the narrow category of health care providers who truly never transmit health information electronically in connection with covered transactions. A two-physician family medicine practice that accepts insurance, submits claims through a clearinghouse, and uses an electronic health record system is a covered entity subject to the full range of HIPAA requirements. OCR’s enforcement actions have targeted small practices, including solo practitioners, and the Right of Access Initiative has specifically targeted small providers who fail to respond to patient record requests. Size may affect the resources available for implementation, but it does not reduce compliance obligations.
HIPAA Common Misconception 2: “Our IT Vendor Is Not a BA Because We Have an NDA”
False. A non-disclosure agreement (NDA) is not a Business Associate Agreement and does not satisfy HIPAA’s BAA requirements. A BAA must contain specific elements enumerated at 45 CFR 164.504(e)(2), including provisions specifying the permitted uses and disclosures of PHI by the BA, requirements to implement appropriate safeguards, requirements to report breaches, and obligations upon termination of the agreement. NDAs generally do not address any of these HIPAA-specific requirements. An IT vendor who has access to PHI in the course of providing services to a covered entity (software implementation, system maintenance, remote access to systems, technical support) is a business associate, and a compliant BAA is required regardless of whether an NDA is also in place.
HIPAA Common Misconception 3: “HIPAA Only Applies to Electronic Records”
False. The Security Rule applies only to ePHI, but the Privacy Rule applies to PHI in all forms: electronic, paper, and oral. A covered entity’s obligations under the Privacy Rule — including the minimum necessary standard, the requirement for authorization for non-permitted uses and disclosures, and the requirement to honor individual rights requests — apply equally to a paper medical record filed in a filing cabinet and to an electronic record in an EHR system. The oral communication of PHI — a nurse discussing a patient’s condition in a hospital corridor — is governed by the Privacy Rule. Compliance programs that focus exclusively on electronic systems are failing to address a significant portion of their HIPAA obligations.
HIPAA Common Misconception 4: “A BAA Protects Us From Liability for the BA’s Violations”
False. A Business Associate Agreement is a necessary but not sufficient condition for managing BA-related HIPAA risk. Executing a BAA does not eliminate the covered entity’s responsibility to appropriately manage the BA relationship. Covered entities must: (a) not share PHI with a BA in a manner that violates the Privacy Rule; (b) take reasonable steps to cure violations if the covered entity knows of a material breach or violation by the BA; and (c) terminate the BAA if the violation cannot be cured and report the violation to HHS. 45 CFR 164.504(e)(1)(ii). In addition, the BAA itself must be a compliant document; a BAA that is missing required provisions fails to satisfy the Privacy Rule’s authorization requirements for sharing PHI with the BA. Covered entities should conduct periodic BA management reviews as part of their ongoing compliance program.
HIPAA Common Misconception 5: “HIPAA Doesn’t Apply Because We Only Use De-Identified Data”
Analyze carefully. De-identified health information is not PHI and is not subject to the HIPAA Privacy Rule. However, the determination that data is properly de-identified requires rigorous analysis, not assumption. Data is de-identified under HIPAA only if it was formally de-identified using one of the two approved methodologies (Expert Determination or Safe Harbor, discussed in Chapter 3). Self-styled “de-identification” that does not comply with the regulatory requirements does not create de-identified data; it creates improperly handled PHI. Organizations that use health data analytics, research programs, or data sharing arrangements should ensure that their de-identification methodology has been formally assessed and documented before treating data as non-PHI.
HIPAA Common Misconception 6: “Our App Developer Isn’t a BA Because They Only Build Software”
The determination of whether a software developer or technology vendor is a business associate depends not on whether they “build software” but on whether they create, receive, maintain, or transmit PHI on behalf of the covered entity in the course of their work. A developer who builds a custom EHR module without accessing any actual patient data is likely not a business associate.
A developer who accesses a test environment populated with real patient data, or who maintains a hosted application that stores PHI, or who provides ongoing technical support involving access to PHI systems, is almost certainly a business associate. The software-as-a-service (SaaS) model has made this question particularly acute: cloud-based health care applications typically store PHI in the vendor’s infrastructure, making the SaaS vendor a business associate even if the vendor’s engineers rarely or never intentionally review patient data.