HIPAA Privacy, Security, and the EHR Audit Trail

HIPAA and the Electronic Health Record

The Health Insurance Portability and Accountability Act of 1996 (HIPAA) establishes national standards for protecting patient health information. As a medical billing and coding professional, you will handle protected health information (PHI) every day inside an electronic health record (EHR) system. Understanding your legal and ethical obligations under HIPAA is not optional — violations can result in civil and criminal penalties for both individuals and covered entities, and, most importantly, they can harm patients.

Who Must Follow HIPAA?

HIPAA applies to covered entities — health care providers who transmit health information electronically, health plans, and health care clearinghouses. It also applies to business associates, which are vendors or contractors who create, receive, maintain, or transmit PHI on behalf of a covered entity. A medical billing company, for example, is typically a business associate and must sign a Business Associate Agreement (BAA) before accessing PHI.

The Privacy Rule: What It Protects

The HIPAA Privacy Rule, administered by the HHS Office for Civil Rights (OCR), protects protected health information (PHI) in any form — paper, oral, or electronic. Electronic PHI is often written as ePHI. PHI is individually identifiable health information that relates to a person's past, present, or future physical or mental health condition, the provision of health care to that individual, or payment for that care.

Permitted Disclosures

The Privacy Rule allows covered entities to use and disclose PHI without patient authorization for treatment, payment, and health care operations (TPO). Examples include:

• Sending a claim to an insurance payer (payment)
• Sharing a record with a consulting specialist (treatment)
• Conducting quality improvement reviews (operations)

Required Disclosures

Covered entities must disclose PHI in two situations: (1) to the patient or their personal representative upon request, and (2) to HHS during a compliance investigation or enforcement action.

Prohibited Disclosures and the Minimum Necessary Standard

Any disclosure not covered by a specific permission or a valid patient authorization is prohibited. Even when disclosure is permitted, the minimum necessary standard applies: share only the PHI that is needed for the stated purpose. As a coder, you should access only the records required to complete your assigned work — curiosity about a coworker's or celebrity's record is never a valid reason to open a chart.

Patient Authorization

When TPO or another specific permission does not apply, a written patient authorization is required before PHI can be released. A valid authorization must include, among other elements: a description of the information to be released, the name or class of person authorized to make the disclosure, the name or class of person who will receive the information, a description of the purpose of the requested use or disclosure, an expiration date or event, and the patient's signature and date. Missing any required element makes the authorization defective and the release impermissible.

The Security Rule: Protecting ePHI

The HIPAA Security Rule applies specifically to ePHI and requires covered entities and business associates to implement administrative, physical, and technical safeguards.

• Administrative safeguards include workforce training, risk analysis, and access management policies.
• Physical safeguards include workstation controls and device disposal procedures.
• Technical safeguards include access controls, encryption, automatic logoff, and — critically for coders — audit controls.

The EHR Audit Trail

Every compliant EHR system maintains an audit log (also called an audit trail) that automatically records who accessed a record, what they viewed or changed, and when. Audit logs are a required technical safeguard under the Security Rule because they allow a covered entity to detect unauthorized access and investigate potential breaches.

Typical data fields captured in an audit log include:

| Field | Why It Matters |

|---|---|

| User ID / username | Identifies the individual who accessed the record |

| Date and time stamp | Establishes when access occurred |

| Patient record accessed | Shows which PHI was viewed or modified |

| Action performed | Documents whether the user viewed, edited, printed, or exported data |

| Workstation or IP address | Helps locate where the access originated |

If a breach is suspected — for example, an employee accessing records of patients they are not treating — the audit log provides the evidence needed to investigate and, if required, report the breach under the HIPAA Breach Notification Rule.

Release of Information (ROI) in Practice

In the HIM or billing department, release-of-information requests arrive from attorneys, insurers, patients, and other providers. Your role is to verify that the request is legitimate before any records leave the organization. Key steps:

1. Confirm the identity of the requestor.

2. Verify that a valid authorization exists, or that a TPO or other legal permission applies.

3. Apply the minimum necessary standard — send only what is requested and permitted.

4. Document the disclosure in the patient's record or a disclosure log.

5. Never release psychotherapy notes, HIV/AIDS test results, substance use disorder treatment records, or other specially protected categories without specific, separate authorization as required by applicable law.

Safety and Scope-of-Practice Reminder

As a coder, you access PHI to assign codes and support billing — not to make clinical decisions. If you notice a potential documentation error while coding, report it through proper channels rather than altering records yourself. Unauthorized alteration of medical records is illegal and endangers patient safety. Always log off your EHR session when stepping away from your workstation, and never share login credentials.