Assembling the HIPAA privacy puzzle.

Abstract

With the exception of small health plans, covered entities have less than four months to come into compliance with the final HIPAA privacy rule. Instead of obtaining written consent, providers must make a good-faith effort to obtain a patient's signed acknowledgment of receipt of the provider's notice of privacy practices. A covered entity may use patient information to market its own healthcare services without violating the privacy rule. A research institution may continue to use protected health information obtained with a valid authorization to maintain the integrity of a study even if authorization is revoked.