Hipaa Laws: Beyond Health, What Else?

The Health Insurance Portability and Accountability Act (HIPAA) of 1996 establishes federal standards to protect sensitive health information from disclosure without a patient's consent. The US Department of Health and Human Services (HHS) issued the HIPAA Privacy Rule to implement HIPAA requirements, and the HIPAA Security Rule to protect specific information covered by the Privacy Rule. The Privacy Rule standards address the use and disclosure of individuals' protected health information (PHI) by entities subject to the rule, which are called covered entities.

Covered entities include health plans, health care clearinghouses, and health care providers that conduct certain transactions electronically. The Security Rule applies to covered entities and their business associates, which are non-members of a covered entity's workforce that use individually identifiable health information to perform functions for the covered entity.

The Privacy Rule also contains standards for individuals' rights to understand and control how their health information is used. It protects individual health information while allowing necessary access to promote high-quality healthcare and protect the public's health. The rule permits important uses of information while protecting the privacy of people who seek care.

The Privacy Rule establishes national standards to protect individuals' medical records and other health information

The HIPAA Privacy Rule establishes national standards to protect individuals' medical records and other individually identifiable health information. This includes information such as an individual's past, present, or future physical or mental health condition, the provision of their health care, and the payment for the provision of their health care.

The Privacy Rule applies to health plans, health care clearinghouses, and health care providers that conduct certain health care transactions electronically. It requires appropriate safeguards to protect the privacy of protected health information and sets limits and conditions on how this information can be used and disclosed without an individual's authorization.

The Rule gives individuals rights over their protected health information, including the right to examine and obtain a copy of their health records, to direct a covered entity to transmit their protected health information to a third party, and to request corrections.

Covered entities must also have procedures in place to limit who can access an individual's health information and must implement training programs for employees on how to protect this information.

The Privacy Rule permits covered entities to use and disclose protected health information without an individual's authorization for specific purposes, including:

• Treatment, payment, and healthcare operations
• Public interest and benefit activities, including public health activities, health oversight activities, and judicial and administrative proceedings
• Research, under certain conditions
• To prevent or lessen a serious threat to health or safety
• Essential government functions, such as military missions and protective services for government officials
• Workers' compensation

The Security Rule establishes a national set of security standards for protecting health information held or transferred in electronic form

The Security Rule does not apply to PHI transmitted orally or in writing. It defines "confidentiality" as e-PHI not being available or disclosed to unauthorized persons. It also promotes the two additional goals of maintaining the integrity and availability of e-PHI. "Integrity" means that e-PHI is not altered or destroyed in an unauthorized manner, while "availability" means that e-PHI is accessible and usable on demand by an authorized person.

Covered entities must review and modify their security measures to continue protecting e-PHI in a changing environment. They must also perform risk analysis as part of their security management processes. A risk analysis process includes evaluating the likelihood and impact of potential risks to e-PHI, implementing appropriate security measures, documenting the chosen security measures, and maintaining continuous, reasonable, and appropriate security protections.

The Security Rule is designed to be flexible and scalable so that covered entities can implement policies, procedures, and technologies that are appropriate for their particular size, organizational structure, and risks to consumers' e-PHI. When deciding which security measures to use, covered entities must consider their size, complexity, and capabilities, their technical, hardware, and software infrastructure, the costs of security measures, and the likelihood and possible impact of potential risks to e-PHI.

The Security Rule establishes a set of national standards for confidentiality, integrity, and availability of e-PHI. The Department of Health and Human Services (HHS), Office for Civil Rights (OCR) is responsible for administering and enforcing these standards and may conduct complaint investigations and compliance reviews.

The Privacy Rule gives individuals rights over their health information, including the right to examine and obtain a copy of their health records

The Privacy Rule, a Federal law, gives individuals rights over their health information and sets rules and limits on who can look at and receive their health information. The Privacy Rule applies to all forms of individuals' protected health information, whether electronic, written, or oral.

The Privacy Rule gives individuals the right to:

• Ask to see and get a copy of their health records
• Have corrections added to their health information
• Receive a notice that tells them how their health information may be used and shared
• Decide if they want to give their permission before their health information can be used or shared for certain purposes, such as for marketing
• Request that a covered entity restrict how it uses or discloses their health information
• Get a report on when and why their health information was shared for certain purposes

The Privacy Rule also contains standards for individuals' rights to understand and control how their health information is used. It protects individual health information while allowing necessary access to health information, promoting high-quality healthcare, and protecting the public's health.

Covered entities include:

• Health plans, including health insurance companies, HMOs, company health plans, and certain government programs that pay for health care, such as Medicare and Medicaid.
• Most health care providers—those that conduct certain business electronically, such as electronically billing your health insurance—including most doctors, clinics, hospitals, psychologists, chiropractors, nursing homes, pharmacies, and dentists.
• Health care clearinghouses—entities that process nonstandard health information they receive from another entity into a standard format or vice versa.

The Privacy Rule permits the use and disclosure of health information without an individual's authorization for 12 national priority purposes

The Privacy Rule, a Federal law, gives individuals rights over their health information and sets rules and limits on who can look at and receive their health information. The Privacy Rule permits the use and disclosure of health information without an individual's authorization for 12 national priority purposes. These 12 purposes are:

• When required by law
• Public health activities
• Victims of abuse, neglect or domestic violence
• Health oversight activities
• Judicial and administrative proceedings
• Functions concerning deceased persons
• Cadaveric organ, eye, or tissue donation
• Research, under certain conditions
• To prevent or lessen a serious threat to health or safety
• Essential government functions
• Workers' compensation
• Limited data set for research, public health or healthcare operations

The Privacy Rule was established to protect individuals' medical records and other individually identifiable health information. It applies to health plans, health care clearinghouses, and those health care providers that conduct certain health care transactions electronically.

The Security Rule requires covered entities to maintain reasonable and appropriate administrative, technical, and physical safeguards for protecting electronic protected health information

The Health Insurance Portability and Accountability Act of 1996 (HIPAA) required the US Department of Health and Human Services (HHS) to develop regulations protecting the privacy and security of certain health information. The HIPAA Security Rule establishes a national set of security standards for protecting certain health information that is held or transferred in electronic form.

Administrative Safeguards

Covered entities must implement administrative actions, policies, and procedures to manage the selection, development, implementation, and maintenance of security measures to protect e-PHI. This includes:

• Developing and implementing security policies and procedures.
• Designating a security official responsible for security policies and procedures.
• Implementing policies and procedures for authorizing access to e-PHI based on the user's role.
• Providing appropriate authorization and supervision for workforce members who work with e-PHI.
• Training all workforce members on security policies and procedures.
• Applying appropriate sanctions against workforce members who violate security policies and procedures.
• Performing periodic assessments of security policies and procedures to ensure compliance with the Security Rule.
• Limiting physical access to facilities while ensuring authorized access.
• Implementing policies and procedures for the proper use of and access to workstations and electronic media.
• Implementing policies and procedures for the transfer, removal, disposal, and reuse of electronic media to ensure the protection of e-PHI.

Technical Safeguards

Technical safeguards refer to the technology and the policies and procedures for its use that protect e-PHI and control access to it. Covered entities must implement technical security measures that:

• Allow only authorized persons to access e-PHI.
• Record and examine access and other activity in information systems containing e-PHI.
• Ensure that e-PHI is not improperly altered or destroyed.
• Guard against unauthorized access to e-PHI transmitted over an electronic network.

Physical Safeguards

Physical safeguards are the physical measures, policies, and procedures to protect a covered entity's electronic information systems, buildings, and equipment from natural and environmental hazards and unauthorized intrusion. This includes implementing policies to limit physical access to electronic information systems and facilities, as well as policies for the proper use of and access to workstations and electronic media.

Frequently asked questions