The Office of Compliance

Compliance FAQ

What is the purpose of HIPAA?

HIPAA protects the privacy and security patient medical information and establishes safeguards that WCM must implement to protect that information. Also, it sets the terms on which medical information can be transmitted to other providers and heatlh insurers. Furthermore, it gives patients more control over, and access to, their medical information and sets limitations on the use and release of that information.

Is the University required to comply with HIPAA?

Yes. The University is a covered entity and HIPAA applies to all covered entities— Healthcare providers, Health plans, and healthcare clearinghouses. Often, contractors, subcontractors, third party service providers (vendors) and other outside persons that are not employees of the covered entity will need to have access to patients’ health information when providing services to the covered entity. These entities are called “Business Associates” and are required to comply with HIPAA.

What is a Business Associate (BA)?

A business associate (BA) can be any University third party service provider (vendor) that either:

  1. receives protected health information (PHI) from the University, another BA, or as part of an Organized Health Care Arrangement (OHCA);
  2. provides accounting, accreditation, actuarial, administrative, consulting, data aggregation, management, financial, or legal services for the University or OHCA; or
  3. one who performs a function or activity that involves the usesand/or disclosure ofes PHI on behalf of the University or OHCA.

What is PHI?

PHI is any individually identifiable health information created or received by the University. Such information may relate to past, present, or future physical or mental health of a patient or research study participant. PHI either identifies or could be used to identify the individual and has been transmitted or maintained in any form or medium (electronic, paper, or oral), such as patient demographics, medical record number, Social Security number, etc.

What is PHI and its 18 identifiers?

Protected Health Information (PHI) is any individually identifiable health information created or received by the University. Such information may relate to past, present, or future physical or mental health of a patient or research study participant. PHI is information that is used to identify the individual. PHI can be transmitted electronically, orally, or in writing.

  1. Patient Names
  2. Geographical Elements
  3. Dates
  4. Phone numbers
  5. Fax numbers
  6. Email addresses
  7. Social Security numbers
  8. Medical record numbers
  9. Health insurance beneficiary numbers
  10. Account numbers
  11. Certificate/license numbers
  12. Vehicle identifiers
  13. Device identifiers
  14. URLs
  15. IP address numbers
  16. Biometric identifiers
  17. Facial images
  18. Any other unique identifying number, characteristic, or code

Submit Compliance Incident

Weill Cornell Medicine The Office of Compliance 575 Lexington Avenue, 9th Fl New York, NY 10022 Phone: (866)-293-3077