HIPAA Privacy Information and Guidance Papers*

• Accounting of Disclosures of PHI (Updated May 2022)
• Amendment of PHI (Updated May 2022)
• American Recovery and Reinvestment Act (ARRA) of 2009 (Updated May 2022)
• Best Practices for Disposing PHI (Updated September 2011)
• Best Practices for Safeguarding Laptops (Updated June 2022)
• Best Practices for Verification of Identity (Updated June 2022) 
• Camera and Video Use in a Covered Entity (Updated February 2015)
• Disclosures in Emergency Situations (Updated January 2012)
• Disclosure of PHI to DOD Safety Offices (February 2012)
• DOD's Structure under HIPAA and its Impact on Various DOD Components (April 2017)
• Health Information Technology (HIT) Initiatives
• Incidental Uses and Disclosures of PHI (Updated September 2024)
• Inspector General (November 2021)
• Judicial and Administrative Proceedings (Updated May 2015)
• Lost Medical Records (October 2021)
• Medical Facility Directory: Use and Disclosure (Updated August 2010)
• Medical Training and Education (Updated January 2012)
• The Military Command Exception and Disclosing PHI of Armed Forces Personnel (December 2021)
• Minimum Necessary Rule (Updated January 2012)
• New Guidance on De-Identification Methods under the HIPAA Privacy Rule
• Obtaining Military Records (Updated May 2010)
• Oral Communication of PHI (Updated July 2015
• Organized Health Care Arrangements (Updated July 2011)
• The Privacy Rule and Documentation
• Protected Health Information Management Tool (PHIMT) (Updated August 2010)
• The Release of PHI to Congressional Office (Updated August 2015)
• Requests for Restrictions on the Use & Disclosure of PHI (Updated January 2012)
• Role-Based Access (Updated February 2012)
• Sending and Receiving PHI by Facsimile (Updated August 2010)
• Special Rules for Alcohol and Drug Abuse Program Patient Records (Updated September 2011)
• Telehealth Information Paper (September 2021)
• Transporting PII or PHI (Updated July 2015)
• Use and Disclosure of Psychotherapy Notes (Updated September 2021)
• Uses and Disclosures When an Authorization is Required
• Uses and Disclosures of PHI for Family Members and Friends (Updated July 2015)
• Uses and Disclosures of PHI for Health Oversight Activities (Updated September 2011)
• Uses and Disclosures of PHI for Law Enforcement Purposes (Updated February 2011)
• Uses and Disclosures of PHI for Payment Purposes (Updated July 2011)
• Uses and Disclosures When an Authorization is Not Required (Updated June 2015)
• Victims of Abuse, Neglect, or Domestic Violence (Updated June 2015)
• Women, Infants, and Children Program (WIC) (Updated March 2010)

*The information papers listed are currently under review. If you have any questions, please contact the DHA Privacy Office.

HIPAA Security Information and Guidance Papers

• Access Controls (Updated June 2022)
• Administrative Safeguards (Updated June 2022)
• American Recovery and Reinvestment Act (ARRA) of 2009 (Updated April 2010)
• Assigned Responsibility (Updated March 2010)
• Audit Controls
• Business Associate Contracts and Other Arrangements
• Device and Media Controls
• Documentation of Security Actions (Updated September 2012)
• Encryption of E-Mail (Updated September 2012)
• Facility Access Controls
• HIPAA and the Acquisition Process
• Information Access Management (Updated March 2010)
• Integrity Standards
• Overview of the HIPAA Security Rule (Updated December 2014)
• Person or Entity Authentication For Access Controls (Updated March 2015)
• Physical Safeguards (Updated January 2015)
• Security Evaluation (Updated September 2012)
• Security Incident Procedures (Updated September 2012)
• Security Management (Updated February 2012)
• Specifications: Standards and Implementation (Updated January 2015)
• Technical Safeguards (Updated January 2015)
• Transmission Security
• Transporting PII or PHI (Updated July 2015)
• Who, What, When and Where of the Security Rule