Within my organization our peer reviews are run with the intention of physicians holding one

another accountable for treatment and ethical standards. I agree that this process helps
maintain trust and promotes professionalism. The peer review process is paramount in
determining clinical guidelines and treatment plans for future patients and ultimately
improves quality care as well while implementing proper protocols. Our M&M meeting
allows for the above ideals to be explored in a professional and HIPAA compliant way to
improve patient outcomes. Great post!
I like how you stipulated that HIPAA allows for peer reviews within the same profession to
improve quality and performance. With anything in science, it is important to discuss one’s
findings with other like professionals to determine if the correct action was taken or what
course could have been investigated to improve care. Peer review allows for differing
opinions within an educated forum to determine the correct course of action for similar future
problems. HIPAA laws recognize this as being imperative for continuing healthcare standards.
The Peer Review process includes multiple physicians coming together are administrative
committees and ethics committees to review patient charts and activities of providers. The
goal of the peer review is to improve patient safety and the quality of care by determining if the
providing physician delivered the correct care at the correct time. Within my trauma department,
physicians hold Morbidity and Mortality (M&M) meetings each month to determine if death,
deterioration, and/or complications in our trauma patients was avoidable.
The Peer Review process does not violate HIPAA. “The Privacy, Security, and Breach
Notification Rules under the Health Insurance Portability and Accountability Act of 1996
(HIPAA) were intended to support information sharing by providing assurance to the public that
sensitive health data would be maintained securely and shared only for appropriate purposes or
with express authorization of the individual” (HHS, 2016, para 2). HHS along with the Office of
the National Coordinator for Health IT (ONC) and the Office for Civil Rights (OCR) have
developed a topical fact sheet to address specific questions surrounding authorizations called
Permitted Uses and Disclosures: Exchange for Health Care Operations, 45 Code of Federal
Regulations (CFR) 164.506(c)(4). This fact sheet lists where covered entities (CEs) are permitted
to use and disclose protected health information (PHI) for certain activities without first
obtaining an individual’s authorization (ONC & OCR, 2016). The ONC and OCR (2016) list the
following activities as being allowed:
o Conducting quality assessment and improvement activities
o Developing clinical guidelines
o Conducting patient safety activities as defined in applicable regulations
o Conducting population-based activities relating to improving health or reducing
health care cost
o Developing protocols
o Conducting case management and care coordination (including care planning)
o Contacting health care providers and patients with information about treatment
alternatives
 o Reviewing qualifications of health care professionals
o Evaluating performance of health care providers and/or health plans
o Conducting training programs or credentialing activities
o Supporting fraud and abuse detection and compliance programs.
The information above can be shared as long as the following three conditions are met:
 Both CEs must have or have had a relationship with the patient (can be a past or
present patient)
 The PHI requested must pertain to the relationship
 The discloser must disclose only the minimum information necessary for the
health care operation at hand.
Peer Review qualifies under this agreement as long as the above conditions are met. Sharing of
patient information through the peer review process must be monitored with assurance that only
the minimum information necessary is shared. With our M&M meeting, we use the information
gathered from the peer review process to determine where we can change our practices to better
care for our patients and improve morbidity and mortality rates.

Office of the National Coordinator for Health IT (ONC) & Office for Civil Rights (OCR). (2016,
January). Permitted Uses and Disclosures: Exchange for Health Care Operations. Retrieved from
https://www.hhs.gov/sites/default/files/exchange_health_care_ops.pdf
U.S. Department of Health and Human Services (HHS). (2016, February 12). Understanding
some of HIPAA’s Permitted Uses and Disclosures. Retrieved from
https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/permitted-uses/index.html
Office for Civil Rights (OCR). (2016, June 24). What personal health information do individuals
have a right under HIPAA to access from their health care providers and health plans? Retrieved
from https://www.hhs.gov/hipaa/for-professionals/faq/2042/what-personal-health-information-
do-individuals/index.html