Virginia Prescription Monitoring Program

HIPPA Frequently Asked Questions

How does the HIPAA Privacy Rule affect the Prescription Monitoring Program?

45 C.F.R. §164.512 provides a set of exceptions to the general rules that require consent or authorization by a patient before protected health information may be disclosed and used. Specifically, a covered entity such as a pharmacy may disclose protected health information for certain public health activities and purposes. In addition, disclosure may be made to a health oversight agency for oversight activities authorized by law. These two exceptions allow for the disclosure of information to the prescription monitoring program.

Do I have to identify the contractor for the Prescription Monitoring Program as a “business associate” under HIPAA?

The contractor is acting as an agent of the Department of Health Professions, which, with regard to its responsibility to implement the Prescription Monitoring Program, may be considered both a health oversight agency and a public health authority. Accordingly, neither the Department of Health Professions nor its agent contractor need be considered a “business associate” of any provider.

Under the HIPAA definitions health oversight agency means an agency or authority of the United States, a State, a territory, a political subdivision of a State or territory, or an Indian tribe, or a person or entity acting under a grant of authority from or contract with such public agency, including the employees or agents of such public agency or its contractors or persons or entities to whom it has granted authority, that is authorized by law to oversee the health care system (whether public or private) or government programs in which health information is necessary to determine eligibility or compliance, or to enforce civil rights laws for which health information is relevant (45 CFR §164.501).

Public health authority means an agency or authority of the United States, a State, a territory, a political subdivision of a State or territory, or an Indian tribe, or a person or entity acting under a grant of authority from or contract with such public agency, including the employees or agents of such public agency or its contractors or persons or entities to whom it has granted authority, that is responsible for public health matters as part of its official mandate (45CFR §164.501).