Hipaa Law: Beyond Medical, What Else?

The Health Insurance Portability and Accountability Act (HIPAA) is a substantial piece of legislation passed by the US Congress in 1996. It addresses the portability of health insurance and the accountability of group health plans to provide benefits when members have pre-existing conditions.

HIPAA applies to health plans, health care clearinghouses, and healthcare providers that conduct certain transactions electronically. It also applies to business associates of covered entities, including contractors, subcontractors, and other external individuals and companies that provide services to covered entities.

However, HIPAA does not apply to everyone. For example, it does not apply to life insurance companies, most schools and school districts, law enforcement agencies, and municipal offices not involved in healthcare services.

While HIPAA is not solely for medical practitioners, it is important to note that it establishes national standards for the protection of personal health information.

HIPAA applies to all health insurance companies

The Health Insurance Portability and Accountability Act (HIPAA) applies to a wide range of entities, including health insurance companies. While the term "HIPAA" is often associated with medical professionals, the law's reach extends beyond just doctors and healthcare providers.

HIPAA-covered entities include healthcare providers, health plans, and healthcare clearinghouses that engage in electronic transactions. This means that health insurance companies fall under the purview of HIPAA and are required to comply with its regulations. The law establishes national standards for protecting individuals' medical records and other personally identifiable health information, ensuring that this sensitive data is handled securely and privately.

Health insurance companies, as covered entities, must adhere to the HIPAA Privacy Rule, which sets restrictions on the release of protected health information without patient authorization. This rule grants individuals rights over their health information, such as the right to examine and obtain their health records, request corrections, and decide how their information is used and shared.

In addition to health insurance companies, other entities covered by HIPAA include Health Maintenance Organizations (HMOs), government healthcare programs like Medicare and Medicaid, healthcare clearinghouses, and business associates such as billing companies and administrative service providers.

While HIPAA applies to a broad range of entities, it is important to note that it does not cover all organizations that possess health information. For example, life insurance companies, most schools and school districts, law enforcement agencies, and municipal offices are not required to follow HIPAA regulations.

To summarize, HIPAA applies to all health insurance companies as part of its broader scope of covered entities. The law sets national standards for protecting sensitive health information and grants individuals rights over their health data. By ensuring compliance, health insurance companies play a crucial role in safeguarding the privacy and security of their customers' health information.

It also applies to health maintenance organizations (HMOs)

The Health Insurance Portability and Accountability Act (HIPAA) applies to a wide range of entities in the healthcare industry, including health maintenance organizations (HMOs). HMOs are considered "covered entities" under HIPAA, which means they must comply with the regulations set forth in the Act.

Covered entities are individuals, organizations, and businesses that must follow the HIPAA rules and regulations. According to the Department of Health and Human Services (HHS), covered entities include healthcare providers, health plans, and healthcare clearinghouses that engage in electronic transactions.

HMOs fall under the category of health plans, which are defined as "including health insurance companies, HMOs, company health plans, and certain government programs that pay for healthcare, such as Medicare and Medicaid." As such, HMOs are subject to the privacy and security rules outlined in HIPAA.

The HIPAA Privacy Rule, which is a part of the Act, establishes national standards for protecting individuals' medical records and other identifiable health information. It gives individuals rights over their protected health information, such as the right to examine and obtain copies of their health records and request corrections. The Rule also sets limits and conditions on the use and disclosure of such information without the individual's authorization.

In addition to the Privacy Rule, HMOs must also comply with the Security Rule, which is a federal law that mandates security measures for health information in electronic form. This includes implementing appropriate safeguards to protect the privacy of protected health information.

Overall, while HIPAA applies to a broad range of entities in the healthcare industry, HMOs are specifically included as covered entities and must adhere to the regulations set forth in the Act to protect the privacy and security of individuals' health information.

Government healthcare programs like Medicare and Medicaid

The Health Insurance Portability and Accountability Act (HIPAA) of 1996 establishes federal standards to protect sensitive health information from disclosure without a patient's consent. The US Department of Health and Human Services (HHS) issued the HIPAA Privacy Rule to implement HIPAA requirements. The Privacy Rule standards address the use and disclosure of individuals' protected health information (PHI) by entities subject to the rule, which include government healthcare programs like Medicare and Medicaid.

HIPAA-covered entities include healthcare providers, health plans, and healthcare clearinghouses. Government healthcare programs such as Medicare and Medicaid fall under the category of health plans, which are defined as:

> "Health, dental, vision, and prescription drug insurers, health maintenance organizations (HMOs), Medicare, Medicaid, Medicare+Choice, and Medicare supplement insurers, long-term care insurers (excluding nursing home fixed-indemnity policies), employer-sponsored group health plans, government- and church-sponsored health plans, and multi-employer health plans."

The HIPAA Privacy Rule was created to limit the release of a patient's protected health information without authorization. The rule restricts any "covered entity" from releasing protected health information to third parties unless there is a valid authorization signed by the patient or the release of information fits within one of the regulatory exceptions.

In the context of government healthcare programs, the HIPAA Privacy Rule permits a covered entity to disclose protected health information (PHI) for its own payment purposes and for the payment purposes of another covered entity that receives the information. For example, a Medicaid state agency and a Medicare Advantage plan may disclose PHI to each other to identify enrollees who are dually eligible under both plans. However, such disclosures must comply with the Privacy Rule's minimum necessary standard.

It is important to note that while HIPAA establishes national standards for the protection of personal health information, it does not apply to everyone. Entities that are not required to follow HIPAA include life insurance companies, law enforcement agencies, most schools and school districts, health data aggregators (as long as the data does not contain identifiable information), and personal health fitness devices and apps not connected to healthcare providers or health plans.

Healthcare clearinghouses

The Health Insurance Portability and Accountability Act of 1996 (HIPAA) applies to covered entities, which include healthcare providers, health plans, and healthcare clearinghouses. Healthcare clearinghouses are defined by the Department of Health and Human Services (HHS) as:

> A public or private entity (including a billing service, repricing company, community health management information system or community health information system, and value-added networks and switches), that does either of the following functions:

>

> 1. Processes or facilitates the processing of health information received from another entity in a non-standard format or containing non-standard data content into standard data elements or a standard transaction; or

> 2. Receives a standard transaction from another entity and processes or facilitates the processing of health information into a non-standard format or non-standard data content for the receiving entity.

In simpler terms, healthcare clearinghouses act as intermediaries between healthcare providers and health plans. They ensure that claims from healthcare providers do not contain errors before forwarding them to health plans for payment. This process helps to reduce workloads and accelerate the payment of claims for both healthcare providers and health plans.

It is important for healthcare clearinghouses to understand when they qualify as a Covered Entity and when they qualify as a Business Associate to ensure compliance with HIPAA requirements.

Business associates and their subcontractors

The Health Insurance Portability and Accountability Act (HIPAA) applies to covered entities and their business associates. Covered entities include healthcare providers, health plans, and healthcare clearinghouses. Business associates are considered any service provider that handles protected health information (PHI) on behalf of a covered entity. This includes telehealth providers and practice management services.

If a covered entity engages a business associate, it must have a written contract or arrangement that establishes what the business associate has been hired to do. The contract must require the business associate to comply with the Rules' requirements to protect the privacy and security of PHI. Business associates are directly liable for compliance with certain provisions of the HIPAA Rules.

Business associates, in turn, may engage subcontractors to carry out some of their work. A subcontractor is a person or organization to whom a business associate delegates a function, activity, or service. The subcontractor does not have a direct relationship with the covered entity but is part of the chain of privacy and security responsibility. For example, if a covered entity contracts a billing company to perform a service, and the billing company hires individuals to perform that service, those individuals are considered subcontractors.

Covered entities do not need to enter into a business associate agreement (BAA) with subcontractors. Instead, it is the responsibility of the business associate to enter into a BAA with their subcontractors and ensure they understand and comply with HIPAA standards. This ensures there are no "weak links" in the chain of privacy and security.

Frequently asked questions