title: Assembling the HIPAA privacy puzzle.
abstract: With the exception of small health plans, covered entities have less than four months to come into compliance with the final HIPAA privacy rule. Instead of obtaining written consent, providers must make a good-faith effort to obtain a patient's signed acknowledgment of receipt of the provider's notice of privacy practices. A covered entity may use patient information to market its own healthcare services without violating the privacy rule. A research institution may continue to use protected health information obtained with a valid authorization to maintain the integrity of a study even if authorization is revoked.
authors.affiliation: Arent Fox Kintner Plotkin & Kahn, PLLC, Washington, D.C., USA.
authors.forename: William A
authors.initials: WA
authors.lastname: Sarraille
authors.forename: Anna L
authors.initials: AL
authors.lastname: Spencer
mesh_terms: D003219:Confidentiality / Q000331:legislation & jurisprudence*; D030881:Disclosure / Q000331:legislation & jurisprudence; D019983:Guideline Adherence; D020408:Health Insurance Portability and Accountability Act; D040541:Marketing / Q000331:legislation & jurisprudence; D008499:Medical Records / Q000331:legislation & jurisprudence; D028701:Patient Rights / Q000331:legislation & jurisprudence*; D014481:United States; D014486:United States Food and Drug Administration