Law Firms And Hipaa: What's The Deal?

The Health Insurance Portability and Accountability Act (HIPAA) is a federal law that safeguards the privacy of individuals' health information. It applies to covered entities, including health plans, healthcare providers, and health care clearinghouses. Law firms are not considered covered entities but may be required to comply with HIPAA if they handle protected health information (PHI) on behalf of their clients. In such cases, law firms are classified as business associates and must implement appropriate administrative, technical, and physical safeguards to protect PHI. Non-compliance with HIPAA can result in severe penalties and negative consequences for law firms, including financial penalties, damage to reputation, and a breakdown of client relationships.

The Health Insurance Portability and Accountability Act of 1996 (HIPAA)

HIPAA's portability requirements promote greater continuity of health plan coverage, while its privacy and security rules govern how individuals' health information is used and disclosed. The law also includes Administrative Simplification provisions, which required HHS to adopt national standards for electronic health care transactions, unique health identifiers, and security. The Administrative Simplification provisions also address privacy requirements, governing how covered entities and business associates may access PHI, and security standards to protect electronic PHI through administrative, physical, and technical safeguards.

The Security Rule establishes a national set of security standards to protect health information held or transferred in electronic form. It operationalizes the protections in the Privacy Rule by addressing the technical and non-technical safeguards that covered entities must put in place to secure individuals' electronic protected health information (e-PHI). The Security Rule is designed to be flexible and scalable, allowing covered entities to implement policies, procedures, and technologies appropriate to their size, structure, and risks.

Covered entities under the Security Rule include health plans, healthcare clearinghouses, and healthcare providers who transmit health information electronically in connection with specific transactions. Business associates of covered entities are also subject to the Security Rule. Covered entities must ensure the confidentiality, integrity, and availability of all e-PHI, protect against anticipated threats and impermissible uses or disclosures, and ensure compliance by their workforce.

HIPAA non-compliance can result in severe penalties and correction requirements. HHS has taken an aggressive approach to enforcing HIPAA requirements in recent years, with enforcement actions resulting in significant monetary payments and corrective actions. Common compliance failures include failing to obtain business associate agreements, carry out enterprise-wide risk assessments, erase hard drives containing PHI, and provide breach notifications.

Law firms and HIPAA compliance

The Health Insurance Portability and Accountability Act (HIPAA) is a federal law enacted in 1996 to protect the privacy and security of individuals' health information. While HIPAA is typically associated with the healthcare industry, law firms that handle protected health information (PHI) on behalf of their clients are also subject to its requirements. As "business associates", law firms must comply with HIPAA to protect their clients' sensitive health data from inadvertent disclosure.

Understanding HIPAA

The Health Insurance Portability and Accountability Act (HIPAA) was established in 1996 to safeguard individuals' health information and give them rights to control how their health data is used. The US Department of Health and Human Services (HHS) issued the HIPAA Privacy Rule and the HIPAA Security Rule to enforce these requirements.

Who Must Comply with HIPAA?

HIPAA's requirements apply directly to "covered entities," which include health plans, healthcare providers that transmit health information electronically, and healthcare clearinghouses. However, law firms come into the picture as "business associates," which are organizations that perform services for covered entities. Business associates must also comply with HIPAA's privacy and security standards when handling PHI.

Law Firms as Business Associates

Law firms are considered business associates under HIPAA if they provide legal services to covered entities, such as health plans, and have access to PHI. In such cases, law firms must comply with HIPAA's requirements by implementing appropriate safeguards to protect PHI. This includes ensuring that employees are trained on HIPAA compliance and that access to PHI is limited within the firm.

Consequences of Non-Compliance

Violating HIPAA can have severe consequences for law firms, including significant financial penalties and damage to client relationships. The penalties for non-compliance vary based on the seriousness of the violation and the level of awareness of the violation. Non-compliance can also impact legal malpractice insurance and the firm's professional conduct obligations.

Ensuring Compliance

To ensure compliance with HIPAA, law firms should understand their obligations as business associates. This includes implementing administrative, technical, and physical safeguards:

• Administrative: Establishing policies and procedures to prevent and detect HIPAA violations, including staff training.
• Technical: Controlling access to systems containing PHI through passwords, encryption, and other technical measures.
• Physical: Securing offices, networks, data, and technology to limit physical access to PHI.

In conclusion, while HIPAA compliance is crucial for law firms handling PHI, it is just one aspect of a larger data security strategy. Law firms must also consider additional measures to protect their clients' sensitive information and maintain trust.

HIPAA Privacy Rule

The HIPAA Privacy Rule establishes a set of national standards to protect individuals' medical records and other individually identifiable health information. It applies to health plans, health care clearinghouses, and healthcare providers that conduct certain health care transactions electronically.

The Rule requires appropriate safeguards to protect the privacy of protected health information and sets limits and conditions on the use and disclosure of such information without an individual's authorization. It also gives individuals rights over their protected health information, including the right to examine and obtain a copy of their health records, to direct a covered entity to transmit their protected health information to a third party, and to request corrections.

The Privacy Rule is located at 45 CFR Part 160 and Subparts A and E of Part 164. It was issued by the US Department of Health and Human Services (HHS) to implement the requirements of the Health Insurance Portability and Accountability Act of 1996 (HIPAA).

The Privacy Rule standards address the use and disclosure of individuals' protected health information (PHI) by entities subject to the rule, known as "covered entities." These include healthcare providers, health plans, and health care clearinghouses, as well as business associates who perform certain functions or activities on behalf of covered entities.

Covered entities must implement reasonable and appropriate administrative, technical, and physical safeguards to protect PHI. They must also establish policies and procedures to restrict access to PHI and train their workforce on privacy policies and procedures.

The Privacy Rule gives individuals the right to control how their health information is used and disclosed, to request copies of their information, and to request corrections. They can also request an alternative means or location for receiving communications of their PHI.

The HHS's Office for Civil Rights (OCR) is responsible for enforcing the Privacy Rule and may impose civil monetary penalties and criminal penalties for non-compliance.

HIPAA Security Rule

The Health Insurance Portability and Accountability Act of 1996 (HIPAA) required the Secretary of the U.S. Department of Health and Human Services (HHS) to develop regulations protecting the privacy and security of certain health information. In response, HHS published the HIPAA Privacy Rule and the HIPAA Security Rule.

The HIPAA Security Rule establishes national standards to protect individuals' electronic personal health information (ePHI) that is created, received, used, or maintained by a covered entity. The Security Rule requires covered entities to maintain reasonable and appropriate administrative, physical, and technical safeguards to ensure the confidentiality, integrity, and security of ePHI.

Covered entities are defined as health plans, health care providers that carry out certain kinds of transactions electronically, and health care clearinghouses. Organizations that perform services for covered entities, known as "business associates", are also subject to the Security Rule.

The Security Rule defines "confidentiality" as ensuring that ePHI is not available or disclosed to unauthorized persons. "Integrity" means that ePHI is not altered or destroyed in an unauthorized manner, while "availability" means that ePHI is accessible and usable on demand by an authorized person.

To comply with the HIPAA Security Rule, covered entities must:

• Ensure the confidentiality, integrity, and availability of all ePHI they create, receive, maintain, or transmit.
• Identify and protect against reasonably anticipated threats to the security or integrity of the information.
• Protect against impermissible uses or disclosures of ePHI that are reasonably anticipated.
• Ensure compliance by their workforce.

The Security Rule incorporates the concepts of scalability, flexibility, and generalization, recognizing that security is an evolving target. It is designed to be flexible and scalable so that covered entities can implement policies, procedures, and technologies that are appropriate for their specific size, structure, and risks.

Covered entities must assess their security risks and implement administrative, physical, and technical safeguards to maintain compliance with the Security Rule. They must also document every security compliance measure, retaining policies and procedures for at least six years.

HIPAA Enforcement

The Health Insurance Portability and Accountability Act (HIPAA) of 1996 establishes federal standards to protect patients' sensitive health information from disclosure without their consent. The US Department of Health and Human Services (HHS) published the HIPAA Privacy Rule and the HIPAA Security Rule to implement HIPAA requirements. The HIPAA Enforcement Rule is codified at 45 CFR Part 160, Subparts C, D, and E.

The HIPAA Enforcement Rule authorises the HHS to conduct compliance investigations and impose civil penalties for HIPAA violations, especially those that compromise electronic Protected Health Information (ePHI). The Office for Civil Rights (OCR) within the HHS is responsible for enforcing the Privacy and Security Rules. The OCR works with the Department of Justice (DOJ) to review criminal violations of HIPAA.

The HIPAA Enforcement Rule establishes directives around compliance, investigation, and penalties for violation. This includes procedures and financial liabilities caused by non-compliance with HIPAA privacy and security requirements. In the case of non-compliance, a penalty is imposed depending on the severity of the breach. Financial penalties can be costly, going up to $1.5 million.

The OCR will review all complaints but will only take action if certain conditions are met:

• The alleged violation occurred within the past six years.
• The complaint is filed against subjects who are required to comply with HIPAA, such as Covered Entities (CE) or Business Associates (BA).
• The complaint should involve an activity that violates HIPAA rules if proven.
• The complaint should be filed within 180 days of the person filing it becoming aware of the alleged violation. The OCR will extend this time limit if there is a justifiable reason for not submitting the complaint within 180 days.

If the OCR accepts a complaint for investigation, they will notify both the individual who filed it and the concerned covered entity. Both parties must cooperate with any requests for information from the OCR. If the complaint involves any action that violates the criminal provision of HIPAA, the OCR will refer the case to the DOJ for further investigation.

The OCR will conduct an investigation based on the gathered evidence and notify the involved parties of the result in writing. If a violation is found, the OCR will resolve the issue through voluntary compliance, corrective action, or a resolution agreement. If the accused party fails to take appropriate action, the OCR can impose civil money penalties (CMP). In such cases, the CE can request a hearing where an HHS administrative law judge makes the final resolution.

Frequently asked questions