Health Insurance Portability and Accountability Act (HIPAA)

PHI is health information that:

• Identifies an individual directly or includes detailed information that could be used to identify an individual;
• Relates to past, present or future mental or physical health care, conditions, treatments, and billing/payment;
• Is created, received, or maintained by a Vanderbilt University covered entity

Covered Entities as defined by the Privacy Rule may include:

• Health plan (insurance companies, government programs (i.e., Medicare, etc.)
• Health care provider (doctors, clinics, dentists, pharmacies, etc.)
• Business associate (involved in the administration of plans or patient care)

The HIPAA Privacy Rule regulates the use and disclosure of Protected Health Information (PHI) providing standards for businesses to follow that protects sensitive patient health information from being disclosed in any manner without the patient’s knowledge or consent.

The HIPAA Privacy Rule was issued by the US Department of Health and Human Services (HHS) to implement the requirements of HIPAA.

The HIPAA Security Rule insures the confidentiality, integrity, and availability of electronic PHI (ePHI) as covered by the Privacy Rule.

The Vanderbilt University HIPAA Privacy & Security Official should be your first point of contact should you have any questions, concerns or if you suspect a HIPAA disclosure breach has occurred:

Julie Hanna
(615) 373-6624 (phone)
hipaa@vanderbilt.edu (email)

Employees with direct access to Protected Health Information (PHI) are automatically scheduled for HIPAA training through Oracle Learning. If you have an employee that should be scheduled for training, please email hipaa@vanderbilt.edu and include the employee’s name, ID and the reason training is needed.

• US Department of Health and Human Services Office for Civil Rights
• Your Rights Under HIPAA
• VU HIPAA Privacy Manual
• VU HIPAA Privacy Notice