How the Health Insurance Portability and Accountability Act (HIPAA) and Other Privacy Laws Affect Public Transportation Operations

TRB’s Transit Cooperative Research Program (TCRP) Legal Research Digest 46: How the Health Insurance Portability and Accountability Act (HIPAA) and Other Privacy Laws Affect Public Transportation Operations explores whether the privacy and security rules established by HIPAA apply to transit agencies that possess patrons’ health information.

The first seven sections of this digest discuss HIPAA and whether various entities are subject to HIPAA’s privacy and security provisions applicable to the protection of protected health information, as defined by HIPAA. This digest also analyzes how protected health information is defined by HIPAA and discusses HIPAA’s Privacy Rule and Security Rule as defined by the U.S. Department of Health and Human Services in its most recent final rule.

This digest summarizes other important aspects of HIPAA including whether protected health information must be produced in response to a subpoena, discovery request, or a request under a freedom of information act (FOIA) or similar law. The remainder of the digest discusses the privacy of health information under other federal and state laws. The digest also covers industry standards and best practices used by transit agencies to protect the privacy of patrons’ health information.