The Health Insurance Portability and Accountability Act of 1996 (HIPAA) is a federal law that required the creation of national standards to protect sensitive patient health information from being disclosed without the patient’s consent or knowledge. The US Department of Health and Human Services (HHS) issued the HIPAA Privacy Rule to implement the requirements of HIPAA. The HIPAA Security Rule protects a subset of information covered by the Privacy Rule.
HIPAA Privacy Rule
The Privacy Rule standards address the use and disclosure of individuals’ health information (known as protected health information or PHI) by entities subject to the Privacy Rule. These individuals and organizations are called “covered entities.”
The Privacy Rule also contains standards for individuals’ rights to understand and control how their health information is used. A major goal of the Privacy Rule is to make sure that individuals’ health information is properly protected while allowing the flow of health information needed to provide and promote high-quality healthcare, and to protect the public’s health and well-being. The Privacy Rule permits important uses of information while protecting the privacy of people who seek care and healing.
Covered Entities
The following types of individuals and organizations are subject to the Privacy Rule and considered covered entities:
- Healthcare providers: Every healthcare provider, regardless of size of practice, who electronically transmits health information in connection with certain transactions. These transactions include:
-
- Claims
- Benefit eligibility inquiries
- Referral authorization requests
- Other transactions for which HHS has established standards under the HIPAA Transactions Rule.
- Health plans:
Health plans include:
-
- Health, dental, vision, and prescription drug insurers
- Health maintenance organizations (HMOs)
- Medicare, Medicaid, Medicare+Choice, and Medicare supplement insurers
- Long-term care insurers (excluding nursing home fixed-indemnity policies)
- Employer-sponsored group health plans
- Government- and church-sponsored health plans
- Multi-employer health plans
Exception: A group health plan with fewer than 50 participants that is administered solely by the employer that established and maintains the plan is not a covered entity.
- Healthcare clearinghouses: Entities that process nonstandard information they receive from another entity into a standard (i.e., standard format or data content), or vice versa. In most instances, healthcare clearinghouses will receive individually identifiable health information only when they are providing these processing services to a health plan or healthcare provider as a business associate.
- Business associates: A person or organization (other than a member of a covered entity’s workforce) using or disclosing individually identifiable health information to perform or provide functions, activities, or services for a covered entity.These functions, activities, or services include:
-
- Claims processing
- Data analysis
- Utilization review
- Billing
Permitted Uses and Disclosures
The law permits, but does not require, a covered entity to use and disclose PHI, without an individual’s authorization, for the following purposes or situations:
- Disclosure to the individual (if the information is required for access or accounting of disclosures, the entity MUST disclose to the individual)
- Treatment, payment, and healthcare operations
- Opportunity to agree or object to the disclosure of PHI
- An entity can obtain informal permission by asking the individual outright, or by circumstances that clearly give the individual the opportunity to agree, acquiesce, or object
- Incident to an otherwise permitted use and disclosure
- Limited dataset for research, public health, or healthcare operations
- Public interest and benefit activities—The Privacy Rule permits use and disclosure of PHI, without an individual’s authorization or permission, for 12 national priority purposes:
- When required by law
- Public health activities
- Victims of abuse or neglect or domestic violence
- Health oversight activities
- Judicial and administrative proceedings
- Law enforcement
- Functions (such as identification) concerning deceased persons
- Cadaveric organ, eye, or tissue donation
- Research, under certain conditions
- To prevent or lessen a serious threat to health or safety
- Essential government functions
- Workers’ compensation
HIPAA Security Rule
While the HIPAA Privacy Rule safeguards PHI, the Security Rule protects a subset of information covered by the Privacy Rule. This subset is all individually identifiable health information a covered entity creates, receives, maintains, or transmits in electronic form. This information is called electronic protected health information, or e-PHI. The Security Rule does not apply to PHI transmitted orally or in writing.
To comply with the HIPAA Security Rule, all covered entities must:
- Ensure the confidentiality, integrity, and availability of all e-PHI
- Detect and safeguard against anticipated threats to the security of the information
- Protect against anticipated impermissible uses or disclosures that are not allowed by the rule
- Certify compliance by their workforce
Covered entities should rely on professional ethics and best judgment when considering requests for these permissive uses and disclosures. The HHS Office for Civil Rights enforces HIPAA rules, and all complaints should be reported to that office. HIPAA violations may result in civil monetary or criminal penalties.
For more information, visit HHS’s HIPAA website.
Additional Resource
HIPAA Enforcement. US Department of Health and Human Services.
What kind of doctor is a D.O.? Does a D.O. have the same training as an M.D.?
Answer From Brent A. Bauer, M.D.
A doctor of osteopathic medicine, also known as a D.O., is a fully trained and licensed doctor. A doctor of osteopathic medicine graduates from a U.S. osteopathic medical school. A doctor of medicine, also known as an M.D., graduates from a traditional medical school.
A major difference between D.O.s and M.D.s is that some doctors of osteopathic medicine use manual medicine as part of treatment. Manual medicine can include hands-on work on joints and tissues and massage.
After medical school, both kinds of doctors must complete training as residents in the specialty they choose. They also must pass the same licensing exam before they can treat people and prescribe medicines.
There is a problem with information submitted for this request. Review/update the information highlighted below and resubmit the form.
From Mayo Clinic to your inbox
Sign up for free, and stay up to date on research advancements, health tips and current health topics, like COVID-19, plus expertise on managing health.
ErrorEmail field is required
ErrorInclude a valid email address
To provide you with the most relevant and helpful information, and understand which information is beneficial, we may combine your email and website usage information with other information we have about you. If you are a Mayo Clinic patient, this could include protected health information. If we combine this information with your protected health information, we will treat all of that information as protected health information and will only use or disclose that information as set forth in our notice of privacy practices. You may opt-out of email communications at any time by clicking on the unsubscribe link in the e-mail.
Thank you for subscribing!
You’ll soon start receiving the latest Mayo Clinic health information you requested in your inbox.
Sorry something went wrong with your subscription
Please, try again in a couple of minutes
- What is a D.O.? American Osteopathic Association https://osteopathic.org/what-is-osteopathic-medicine/what-is-a-do/. Accessed Oct. 27, 2022.
- Roberts A, et al. Osteopathic manipulative medicine: A brief review of the hands-on treatment approaches and their therapeutic uses. Medicines. 2022; doi:10.3390/medicines9050033.
- Chin J, et al. Assessing the knowledge of the osteopathic profession in New York City’s Easter European communities. Cureus. 2022; doi:10.7759/cureus.21664.
See more Expert Answers 
Have you ever wondered what the “KVC” in KVC Health Systems stands for? You’re not alone; it’s one of the most frequently asked questions we get.
Answering this question gives us a chance to tell you about our history and our future… both where we’ve been and where we’re going.
Do you believe every child deserves to be safe and connected to a strong family? Join us to receive a few inspiring stories each month and help end childhood adversity. Subscribe here!
The Original “KVC”
The organization that is now KVC Health Systems began in 1970 as a multi-story brick home in downtown Kansas City, Kansas called Wyandotte House. A group of caring women from the Junior League of Wyandotte and Johnson Counties created Wyandotte House because they saw children in need.
“I could see that there were kids being detained [at the Kaw View Detention Home] who didn’t belong,” said Ellen McCarthy, a founding mother of KVC. “They were good kids who were in detention because there was nowhere else for them to go.” (Notably, JoAnn Ball — a Junior League member at the time — and her family personally picked up the torch. Her children and grandchildren remain active in KVC’s leadership to this day.)
When Ellen became Junior League President, she had an opportunity to make a difference. She and three other Junior League members took out personal loans in order to buy a home. They created Wyandotte House, a home for boys. A married couple was hired to parent the boys sent to them by the courts. “Dad” went off to work each day. “Mom” stayed home and provided the stability the children so desperately needed. Besides providing a home for the adolescents, the “parents” were teaching the children what a healthy family life might look like.
Wyandotte House grew and in 1994, the name was changed to Kaw Valley Center (yes – that’s what “KVC” originally meant). During the 1980-90s, KVC grew to represent one of the strongest child welfare and behavioral healthcare continuums of care in the nation, allowing KVC to meet the needs of any child and family requiring behavioral healthcare. KVC has emphasized research and education, drawing upon national experts and evidence-based practices to serve all children and families.
One thing that’s interesting is that, while KVC started as a small group home for boys, we’ve since learned that residential group home care is not the ideal living situation for most children. We know now that “Children grow best in families,” so we’ve helped the state of Kansas recruit and train thousands of relatives and foster families in order to support children in the context of a close-knit family. When we started providing foster care case management services in Kansas in 1996, 30% of children were in congregate care placements. 
Today the national average is 14%, yet KVC’s rate is far better than the national average; less than 4% of children KVC serves in Kansas live in congregate care. Of those few that do live in a congregate/residential care setting, most are there for the specific purpose of receiving acute psychiatric treatment. (Learn more about our consulting on reducing congregate care and other national child welfare topics.)
Check out this video about KVC’s history:
What KVC “stands for” today
The Kaw Valley is a particular region in the U.S. It refers to the land surrounding the Kansas River in northeastern Kansas, which is where KVC has its roots.
But today, KVC’s reach extends thousands of miles beyond the Kaw Valley. KVC serves children and families in five states (Kansas, Missouri, Nebraska, Kentucky and West Virginia). KVC’s work even extends beyond U.S. borders, as child welfare leaders from Canada, Singapore and other countries have requested consulting and training from KVC.
So in 2003, to bring our name in line with the scope of our work, Kaw Valley Center became simply KVC Behavioral Healthcare. A few years later, the parent organization KVC Health Systems was created, which has several subsidiaries such as KVC Kansas and KVC Hospitals that provide direct services to children and families.
The letters in KVC are no longer an acronym, but they are still a useful guide to some of the values that make us unique and effective. These are the types of values that KVC “stands for” these days:
- Knowledge – We help children and families who have experienced trauma such as abuse, neglect, substance abuse and loss. It’s important that instead of offering help that we think will work, we do what we know will work: use treatment approaches that are rooted in research and validated by evidence.
Trauma Systems Therapy (TST) and Positive Behavioral Intervention and Supports (PBIS) are just two of the many evidence-based practices that make up the unique KVC Family-Centered Practice Model. Through the new KVC Institute for Health Systems Innovation, we are advancing research in the fields of child welfare and behavioral healthcare. Our goal is to expedite evidence-based practices into the real-world lives of children and families across the U.S. Knowledge is central to who we are, what we do, and how we make a measurable difference.
- Values – One way that KVC shapes its staff and culture is through the use of “KVCisms” or values. You’ve probably heard some of our values before such as, “What would you want for your child?,” “Excellence is not an act; it’s a habit,” and “There’s no magic answer down the street.” These values cause us to frame each decision with urgency and help us pursue each child’s best interests. Our performance on national child welfare outcomes helps validate that these values produce good results for children and families. Read more about our values.
KVC in 30 Seconds
So there you have it – KVC was once Kaw Valley Center, but the letters are now just a way to think about what drives us forward as an international leader in behavioral healthcare, child welfare, and community health and wellness: Knowledge, Values and Connections. Learn more about our leadership, direct services, consulting and training, research projects and more!
Still want to know more about KVC? Sign up to receive the latest news by subscribing to our newsletter (at bottom), and follow us on Facebook and Twitter!
