Can PHI be transferred outside of the United States?

Under the HIPAA privacy rule, there are restrictions on disclosing protected health information (PHI) to locations outside the United States. Healthcare providers must pay attention to these restrictions, exceptions, and considerations to ensure the protection of an individual's privacy and the secure handling of their health information.

Can PHI be transferred outside of the United States? The short answer is yes, according to the Office for Civil Rights, "provided the covered entity (or business associate) enters into a business associate agreement (BAA) and otherwise complies with the applicable requirements of the HIPAA Rules." 

HIPAA Rules do not include requirements specific to electronic protected health information (ePHI) processed or stored outside the United States. However, the OCR stresses that the risks to such ePHI may vary greatly depending on its geographic location.

The HIPAA privacy rule and transferring data outside the United States

The HIPAA privacy rule is the foundation for protecting PHI in the United States. It applies to covered entities and their business associates. The general rule is that PHI should not be disclosed to locations outside the United States without the appropriate safeguards.

Exceptions to disclosure requirements

Several exceptions allow the disclosure of PHI to foreign entities under specific circumstances:

1. Authorization: Individuals can provide written authorization for the disclosure of their PHI to specific foreign entities. Individuals can also revoke the authorization at any time. 
2. Business associate agreement (BAA): When engaging foreign business associates, covered entities must have a signed business associate agreement (BAA) in place. The BAA establishes a legal framework that obligates the foreign business associate to implement appropriate safeguards and handle PHI consistent with HIPAA regulations. 
3. Limited data set (LDS): PHI can be disclosed to foreign entities in the form of an LDS, which excludes direct identifiers such as names and addresses. This can be done for research, public health, and healthcare operations purposes. A data use agreement must be in place, specifying the permitted uses and ensuring the recipient's protection of the information. 
4. Exceptions: Limited exceptions exist for public health activities, law enforcement purposes, and national security situations. These exceptions enable covered entities to disclose PHI without individual authorization when required by law or for public interests. 

Safeguards and considerations

To protect PHI when transferring it outside the United States, covered entities must implement appropriate safeguards:

• Assessing capabilities: Covered entities should assess the capabilities and compliance of foreign entities before disclosing PHI. This ensures that the receiving entity has the necessary safeguards to protect the information. Verify that the foreign entity has adequate technical and organizational measures to safeguard PHI, such as encryption, access controls, regular audits, and staff training.
• International privacy laws: Seek legal expertise to understand the specific regulations in the foreign jurisdiction and ensure alignment with HIPAA principles. 
• Types of PHI: Consider the types of PHI being transferred. Sensitive information, such as mental health or genetic information, requires heightened protection and precautions. Covered entities must exercise extra caution when disclosing such information, ensuring strict adherence to privacy and security protocols. They should also assess the necessity of transferring sensitive information and explore alternatives that minimize risk, such as de-identification or using aggregated data that does not compromise individual privacy.
• Minimum necessary principle: Apply the minimum necessary principle when disclosing PHI. Only the minimum amount of information necessary to achieve the intended purpose should be shared. Covered entities should conduct thorough analyses of the information needed for the intended purpose and ensure that any extraneous or unnecessary information is excluded from the transfer.

Specific Restrictions and considerations

Certain types of PHI have specific restrictions and considerations:

• Sensitive PHI: PHI related to mental health, substance abuse treatment, HIV/AIDS, sexually transmitted diseases, and genetic information requires heightened protection due to its sensitivity. Implement encryption, anonymization, and strict access controls to safeguard the privacy of individuals and prevent unauthorized access or disclosure.
• Genetic information: Disclosing genetic information outside the United States must comply with the Genetic Information Nondiscrimination Act (GINA) and HIPAA requirements. GINA prohibits health insurance discrimination and employment-related discrimination based on genetic information. Informed consent processes should be robust, clearly explaining the purpose and implications of sharing genetic information and providing individuals with options to control the use and disclosure of their data.
• Special categories: PHI related to minors or individuals with disabilities may require additional safeguards and compliance with applicable laws and regulations. Depending on the circumstances, obtaining consent from parents or legal guardians may be necessary before disclosing PHI related to minors. For individuals with disabilities, adherence to relevant laws and regulations, such as the Americans with Disabilities Act (ADA), should be ensured to protect their privacy rights. Covered entities should also be sensitive to cultural or legal differences that may impact the transfer and handling of PHI for individuals in vulnerable populations.

The HIPAA privacy rule provides a framework for protecting PHI, with specific exceptions and considerations for cross-border transfers. Covered entities must understand the rules and regulations, assess the capabilities of foreign entities, and implement appropriate safeguards to protect PHI throughout the transfer process. 

Related: HIPAA compliant email: The definitive guide