UPI Study › Courses › Healthcare Organization and Management › Free lessons › Lesson 2.1 Free with a free account
HIPAA, Antitrust, and Legal Frameworks in Healthcare
Healthcare Organization and Management · Chapter 2: Legal Frameworks and Compliance in HealthcareSection 2.1 · lesson 8 of 10512 min · free with a free account
Free preview
Create a free account to keep watching
It takes a minute and costs nothing. Your free account unlocks all of Chapter 1 and 3 more lessons of Healthcare Organization and Management.
Lesson complete
Earn the 3 college credits for Healthcare Organization and Management
Enrolling adds a quiz after each lesson, the graded work and the official transcript. Recommended for credit by NCCRS.
Next lesson: Healthcare Fraud and Employment Discrimination Laws →← Policy Frameworks Shaping Modern Healthcare DeliveryNext lesson: Healthcare Fraud and Employment Discrimination Laws →
In this lesson
HIPAA privacy duties and antitrust limits on dealing with competitors.
- Define protected health information, covered entities, and business associates
- Explain HIPAA's permitted uses, minimum necessary rule, and breach notification timelines
- Identify conduct that antitrust law treats as per se unlawful
- Describe how managers should route privacy incidents and pay talk with rivals
Free study notes
Get this lesson's notes by email
The key points and 4 practice questions with answers, in your inbox. One email, free.
One email. Unsubscribe in one click.
Transcript
Everything said in the video, section by section (1,507 words). Read along, or search it.
Opening Case
A Messaging App and a Regional Meeting
Monday at Larkfield. Kenji Watanabe, the chief information officer, finds that 4 North's charge nurses have been coordinating bed moves in a free messaging app. The messages hold patient names and diagnoses. Nobody signed anything with the app's company. The same week, the emergency department's nurse manager heads to a regional meeting of emergency managers, rivals included. Samuel Ndiaye, the compliance officer and in-house counsel, sees two ordinary situations, and two bodies of law. Which rules apply, and what should each manager do?
Five Sources
Where Legal Requirements Come From
First, where requirements come from. There are five sources, and they're easy to confuse, because they all arrive sounding the same: you must. Statute is law passed by a legislature. Regulation is an agency rule with the force of law. Common law is principle built through court decisions; negligence law comes from there. Contract binds you to terms you agreed to: payer, vendor, and employment agreements. It's often the most demanding, because no statute imposes it. Licensure sets the conditions for operating at all. Place a requirement in one of these, and you can judge how firm it is, how it might change, and who can grant relief from it.
HIPAA Overview
Privacy, Security, Breach, and Enforcement Rules
The first body of law is HIPAA, the Health Insurance Portability and Accountability Act of 1996. The HITECH Act of 2009 strengthened it. Business associates became directly liable, breach notification was added, and penalties rose. Four rules matter. The Privacy Rule governs using and disclosing protected health information, in any form, spoken, written, or electronic, and patients' rights over it. The Security Rule requires administrative, physical, and technical safeguards for electronic health information. The Breach Notification Rule covers what happens after an impermissible disclosure. The Enforcement Rule covers investigations and penalties.
Key Terms
Protected Information and Business Associates
On 4 North, Kenji shows Ellen Murphy, the charge nurse, why the app matters. Protected health information is identifiable information about a person's health, care, or payment for care. It isn't only clinical. A bed list or an appointment schedule counts. Identifiability matters, not sensitivity: a trivial detail with a name is protected, a detailed record properly stripped of identifiers isn't. Larkfield is a covered entity: a provider that bills electronically. A business associate creates, receives, keeps, or sends that information on Larkfield's behalf: billing firms, transcription services, shredding contractors, consultants. The line is drawn by what a vendor does with the information, not what kind of company it is. The app company, holding patient messages, is doing a business associate's job. That requires a business associate agreement: safeguard the data, use it only as permitted, report incidents, bind subcontractors, and return or destroy it at the end. Without one, Larkfield is exposed.
Quick Check
Which Vendor Needs an Agreement
Quick check. Three outside parties: a firm that stores Larkfield's scanned medical records online, the firm that washes the hospital's windows, and a cardiologist at another hospital treating a shared patient. Which one needs a business associate agreement? Pause, and decide. The records-storage firm. It keeps protected information on Larkfield's behalf, so it's a business associate. The cardiologist is tempting, because she gets the most clinical detail. But she's a provider receiving information for treatment, not working on Larkfield's behalf. And the window washers never handle records.
Breach Notification
The Sixty-Day Clock Starts at Discovery
Back on 4 North: is the app a breach? An impermissible disclosure of unsecured information is presumed to be one, unless a documented risk assessment shows a low probability it was compromised. If it is a breach, affected patients must be told without unreasonable delay, and no later than 60 days after discovery. More than 500 residents of a state means telling the media too. The federal government hears at the same time for 500 or more, and through an annual log for smaller breaches. The clock starts at discovery, including when Larkfield should have known. So Ellen's duty is to report a suspected incident at once, not to investigate it on the unit first.
Permitted Uses
Treatment, Payment, Operations, and Minimum Necessary
Samuel adds the everyday rules. Without a patient's authorization, information may be used for treatment, payment, and health care operations, and for listed public-interest purposes, like required public health reports. Nearly everything else needs the patient's written authorization, with extra limits on marketing and on selling information. So 'we can't release that' is wrong as often as releasing it would be. The minimum necessary rule limits a use or disclosure to the least information needed. It doesn't apply to disclosures for treatment, but it covers almost everything else, including staff access inside Larkfield. Most everyday risk lives here: a report sent too widely, access left on after a role change, a whole record pulled when one result would do. Patients have rights too: to see and copy their records, within 30 days, with one 30-day extension. To request amendments, an accounting of certain disclosures, and a notice of privacy practices. The access right is the one most often mishandled, usually not by refusal, but by delay, and by demands the rule doesn't make.
Penalties
Four Tiers of Culpability
When things go wrong, civil penalties follow four tiers of culpability, not the size of the incident: didn't know, reasonable cause, willful neglect corrected within 30 days, and willful neglect left uncorrected. Amounts rise sharply by tier, with annual caps. Knowing wrongful disclosure can be a crime. Federal cases often end in a resolution agreement and corrective action plan. State attorneys general can enforce too. So one incident lands in different tiers depending on what Larkfield did before and after. A risk that was assessed, dated, and being fixed sits very differently from one found and ignored.
Antitrust Law
Sherman, Clayton, and FTC Acts
Now the regional meeting. Antitrust law protects competition. The Sherman Act bans agreements that unreasonably restrain trade, and monopolization. The Clayton Act covers mergers that may substantially lessen competition. The Federal Trade Commission Act bans unfair methods of competition, and state antitrust laws apply alongside. At the break, Jamal Carter, Larkfield's emergency department nurse manager, talks with Glen Porter, who runs the emergency department at Northgate Medical Center, a rival hospital. Both hospitals struggle to hire respiratory therapists. Glen asks what Larkfield will offer next round. If neither of us raises pay first, he says, we're both better off. Some conduct is per se unlawful, meaning no justification is even considered: price fixing, dividing markets or customers, rigging bids, and jointly refusing to deal with a payer. So are agreements between competing employers to fix wages, or not to recruit each other's staff. Federal agencies treat those like price fixing, and have prosecuted them as crimes.
Case Response
Declining to Discuss Pay With a Rival
Jamal sees two exposures. Swapping planned pay between competing employers can support an inference of agreement, even if nobody says the word. And an understanding not to raise offers is wage-fixing. So he says plainly that pay isn't something they can discuss, and goes back to the clinical agenda. Afterward, he tells Samuel what was said. A record of declining beats a memory of it. Most other collaboration is judged under the rule of reason, which weighs harm to competition against real benefits: joint ventures, shared services, and data exchanges with safeguards.
Mergers and Collaboration
Local Markets and Clinical Integration
Mergers are reviewed for whether they'd substantially lessen competition in a defined service and area. Hospital markets are local, since patients won't travel far, so two small hospitals can dominate one town. Merging parties argue efficiency and quality. Regulators ask whether those benefits are specific to the merger and verifiable, not just asserted. Independent physicians may not jointly negotiate prices with payers. That's per se unlawful, unless their collaboration is genuinely integrated, clinically or financially. Clinical integration means shared protocols, joint performance measurement, common systems, and real investment. Shared financial risk is the other route. Then joint negotiation can be judged under the rule of reason. And quality collaboratives put competitors in one room. So use a written clinical agenda, a chair who stops talk of prices, contracts, or wages, minutes, and a neutral third party for any benchmarking.
Quick Check
Rival Hospitals Splitting Services
Quick check. Two rival hospitals in one county agree that one will stop delivering babies, and the other will stop doing heart surgery. How would that agreement be judged? Pause, and decide. Per se unlawful. Agreeing which hospital serves which patients is dividing a market between competitors, so no justification is considered. The rule of reason is tempting, since both could claim efficiencies. But that weighing is for genuinely integrated ventures, and two rivals splitting services isn't one.
Case Resolution
Recognize the Situation and Route It
Back to Monday. Kenji shuts the app off, moves 4 North to Larkfield's approved messaging system, and files an incident report the same day. Samuel's team runs the breach risk assessment, and notification follows if it can't show a low probability of compromise. Jamal's note sits in Samuel's file. Neither manager had to be a lawyer. Each had to recognize the situation, and route it to the right person, fast.
Key Takeaways
Business Associates, Breaches, and Wage Talk
To recap: requirements come from five sources, and placing each one tells you how firm it is. Protected health information is anything identifiable, in any form. Vendors that handle it on your behalf need business associate agreements. Report suspected incidents at once, because notification clocks start at discovery. And never discuss prices or wages with rivals: the agencies treat it like price fixing.
About Healthcare Organization and Management at UPI Study
Healthcare Organization and Management (Health 302) is a self-paced online course of 105 video lessons in 18 chapters, from health systems and the law to ethics, leadership, teams, strategy, informatics, finance, quality, human resources, marketing and evidence-based practice. It carries a NCCRS credit recommendation for 3 semester credits.
Every lesson transcript is free on pages like this one, and the videos are free with a free UPI Study account. Enrolling adds a practice quiz after each lesson, the graded work and final exam that earn the credit, lifetime access, and an official transcript on completion. UPI Study has helped over 130,000 students with college credits. ACE and NCCRS have over 2,100 cooperating colleges that will consider accepting credits; the final decision is with the universities.
Enroll now → Course details Download the syllabus All Health courses Every course with PRO →
Why take it here
Why students take Healthcare Organization and Management with UPI Study
Where the credit goes
Universities that work with NCCRS
Healthcare Organization and Management carries a NCCRS credit recommendation. These universities work with NCCRS; some are UPI Study's signed partners. ACE and NCCRS have over 2,100 cooperating colleges that will consider accepting credits; the final decision is with the universities.
Thomas Edison State UniversitySigned partner
University of the PeopleSigned partner
Charter Oak State CollegeSigned partner
Strayer UniversitySigned partner
Columbia Southern UniversitySigned partner
Indiana TechSigned partner
Penn StateWorks with NCCRS
Southern New Hampshire UniversityWorks with NCCRS
SUNYWorks with NCCRS
+many more cooperating universitiesFind my college →Find my college → Not listed? Ask Athena in the corner of this page, or book a 15-minute call.
FAQ
Questions students ask us
About HIPAA, Antitrust, and Legal Frameworks in Healthcare
What is a business associate under HIPAA?
How long does a hospital have to notify patients of a HIPAA breach?
What is the HIPAA minimum necessary rule?
Why are wage-fixing and no-poach agreements treated like price fixing?
About the Healthcare Organization and Management course
How many college credits is Healthcare Organization and Management?
How much does Healthcare Organization and Management cost and what is included?
Which universities accept UPI Study credits?
How long does Healthcare Organization and Management take?
How are the exams done?
How do my credits reach my college?
Ready for the full course? Earn 3 credits in Healthcare Organization and Management.
105 video lessons, a quiz after each one, and the graded work that earns the credit. Recommended for credit by NCCRS.
3 credits · NCCRSEnroll →