ßÙßÇÂþ»­

HIPAA stands for the Health Insurance Portability and Accountability Act of 1996. Among other things, the law includes the Privacy rule, which creates national standards to protect privacy of individuals' protected health information (PHI).

The Privacy Rule has been in effect since April 2003. The ßÙßÇÂþ»­ has adopted policies that promote compliance with the Privacy Rule.
Show

PHI includes all individually identifiable health information (including information in research databases and tissue bank samples with identifiers) held or transmitted by a covered entity or its business associate, in any form or media, whether electronic, paper or oral.

Individually identifiable health information is information, including demographic data, which relates to:

1. The individual's past, present or future physical or mental health or condition;
2. The provision of health care to the individual, or
3. The past, present or future payment for the provision of health care to the individual;
   and that identifies the individual or for which there is a reasonable basis to believe it can be used to identify the individual.

Entities covered by HIPAA are health care providers, health plans (including employers' sponsored plans), and health care clearinghouses.

The following entities at USF are considered covered components:

• The USF Health Morsani College of Medicine and its constituent schools and departments (including the ßÙßÇÂþ»­ School of Physical Therapy and Rehabilitation Sciences)
• The ßÙßÇÂþ»­ St. Petersburg Family Study Center, Infant Family Center
• The USF College of Pharmacy
• The ßÙßÇÂþ»­ Student Health Services
• The Johnnie B. Byrd, Sr. Alzheimer's Center and Research Institute
• The USF College of Behavioral & Community Sciences Department of Communication Sciences and Disorders
• The University Medical Services Support Corporation (MSSC)
• The University Medical Service Association (UMSA)
• Any University administrative personnel or unit if and to the extent that the personnel or unit performs or assists in the performance of a function or activity involving the use or disclosure of individually identifiable health information or as otherwise regulated by the HIPAA Privacy Rule for, on behalf of, or in support of any of the above-listed components

HIPAA affects an investigator's ability to collect and access existing PHI. The Privacy Rule requires certain procedural steps prior to releasing PHI to any investigator for use in research. This is true whether or not the investigator is in or outside of a USF covered component. When PHI is to be used or disclosed for research purposes, a HIPAA Authorization must be obtained from the research subjects or a waiver of HIPAA Authorization must be obtained from the Privacy Board/IRB.

Recommended HIPAA Privacy Practices (Securing Electronic Research Data - As recommended by the USF Privacy Board) (MS Word)