Hipaa: From Inception To Law

The Health Insurance Portability and Accountability Act (HIPAA) was signed into law by President Bill Clinton on August 21, 1996. The act was designed to improve the portability and accountability of health insurance coverage and introduced measures to ensure the continuity of coverage between jobs, guarantee coverage for employees with pre-existing conditions, and prevent job lock.

HIPAA also includes Title II, better known as the Administrative Simplification Act, which requires the healthcare industry to increase efficiency by encouraging the use of electronic media for transmitting patient administrative data. To complement this, the government developed privacy and security rules to ensure the public felt secure with the electronic transmission of data.

The Kennedy-Kassebaum Act

HIPAA was created to improve the portability and accountability of health insurance coverage and introduced measures to ensure the continuity of coverage between jobs and guarantee coverage for employees with pre-existing conditions. To prevent increased costs for health insurers from being passed on to plan members and employers, Congress enacted further measures to combat waste, fraud, and abuse in health insurance and simplify the administration of health insurance transactions. The Secretary of Health and Human Services (HHS) was instructed to develop standards to safeguard health information, particularly when maintained or transmitted electronically, and recommend standards for the privacy of individually identifiable health information. These instructions resulted in the HIPAA compliance guidelines of the Security and Privacy Rules.

The US Department of Health and Human Services set about creating the first HIPAA Privacy and Security Rules after the act was signed into law. The first "proposed" Privacy Rule was published in November 1999, but due to the volume of comments from stakeholders, the "final" Privacy Rule was not published until August 2002. The Privacy Rule defines Protected Health Information (PHI), stipulates permissible uses and disclosures, and gives individuals rights over their PHI. The Security Rule, which deals with the subset of PHI that is created, collected, used, maintained, or transmitted electronically, includes three sets of safeguards that must be complied with by covered entities and business associates: Administrative, Physical, and Technical.

Administrative Simplification Act

The Health Insurance Portability and Accountability Act (HIPAA) of 1996 was signed into law by President Bill Clinton on August 21, 1996. It consists of five titles, with Title II being the Administrative Simplification (AS) provisions.

The AS provisions require the establishment of national standards for electronic health care transactions and national identifiers for providers, health insurance plans, and employers. This is to reduce paperwork and streamline business processes across the healthcare system. The aim is to reduce the burden and lower costs by standardizing how business is done.

The AS provisions govern how providers, health plans, and clearinghouses must conduct electronic, administrative transactions and set standards for transmitting electronic health information. This includes the format and content of electronic, administrative health care transactions, such as claims and payment.

The U.S. Department of Health and Human Services (HHS) has promulgated five rules regarding Administrative Simplification: the Privacy Rule, the Transactions and Code Sets Rule, the Security Rule, the Unique Identifiers Rule, and the Enforcement Rule.

The Privacy Rule establishes a set of national standards for the protection of certain health information, called Protected Health Information (PHI). It addresses the use and disclosure of individuals' health information by covered entities and standards for individuals' privacy rights to understand and control how their health information is used.

The Transactions and Code Sets Rule standardizes health care transactions by requiring all health plans to engage in health care transactions in a standardized way. This includes the use of standard transactions, code sets, and identifiers to ensure consistent electronic communication across the U.S. healthcare system.

The Security Rule deals specifically with Electronic Protected Health Information (EPHI) and lays out three types of security safeguards required for compliance: administrative, physical, and technical.

The Unique Identifiers Rule requires the use of national identifiers for providers, health plans, and employers. An example is the National Provider Identifier (NPI) for healthcare providers.

The Enforcement Rule sets civil money penalties for violating HIPAA rules and establishes procedures for investigations and hearings for HIPAA violations.

Privacy Rule

The HIPAA Privacy Rule establishes national standards to protect individuals' medical records and other individually identifiable health information. It applies to health plans, health care clearinghouses, and healthcare providers that conduct certain health care transactions electronically.

The Rule requires appropriate safeguards to protect the privacy of protected health information and sets limits and conditions on the uses and disclosures that may be made of such information without an individual's authorization. It also gives individuals rights over their protected health information, including rights to examine and obtain a copy of their health records, to direct a covered entity to transmit to a third party an electronic copy of their protected health information in an electronic health record, and to request corrections.

The Privacy Rule was published in 2002 and is one of several sets of standards that evolved from HIPAA. It stipulates permissible uses and disclosures of Protected Health Information and individuals' rights.

Most health plans, health care clearinghouses, and healthcare providers are required to comply with the Privacy Rule. Business Associates may also be required to comply with the Privacy Rule depending on the service being provided.

The Privacy Rule defines Protected Health Information to include identifiers maintained in the same designated record set. All patients and plan members must be given a HIPAA Notice of Privacy Practices on the first encounter or as soon as reasonable.

The Notice of Privacy Practices must explain what Protected Health Information may be disclosed, to whom, and why. It must also explain an individual's right to access, amend, or transfer their Protected Health Information.

Who is Covered by the Privacy Rule?

The Privacy Rule, as well as all the Administrative Simplification rules, apply to health plans, health care clearinghouses, and any health care provider that transmits health information in electronic form in connection with transactions for which the Secretary of HHS has adopted standards under HIPAA.

Any individually identifiable health information relating to an individual's past, present, or future physical or mental condition, treatment for the condition, or payment for the treatment is protected by the HIPAA Privacy Rule, along with individually identifiable non-health information maintained in the same "designated record set".

Information maintained in a designated record set is known as Protected Health Information (PHI), even though elements of the set may not contain health information.

The HIPAA Privacy Rule protects information by stipulating when uses and disclosures or Protected Health Information are required, permitted, or subject to an individual's authorization. There are only two occasions when uses and disclosures are required – when an individual exercises their access rights and when access is required by HHS's Office for Civil Rights for an investigation or compliance review.

Permissible uses and disclosures include those necessary to carry out treatment, payment, or health care operations, those required by law or for public health activities, and those necessary to avert a serious threat to health or safety.

Other than the uses and disclosures required or permitted by the HIPAA Privacy Regulations – and some for which the individual should be given an opportunity to object when feasible – all other uses and disclosures of Protected Health Information are prohibited unless they are authorized by the individual who is the subject of the Protected Health Information or their personal representative.

The HIPAA Privacy Standards ensure individuals' rights by first requiring covered health plans and healthcare providers to give a HIPAA Notice of Privacy Practices to new patients or plan members on the "first encounter" whenever possible or as soon as reasonable afterwards.

The Notice must describe the ways in which the Covered Entity may use or disclose Protected Health Information and describe how individuals can exercise their rights to access copies of their Protected Health Information.

Who Enforces the Privacy Rule?

The Department of Health and Human Services' Office for Civil Rights (OCR) is the enforcer of the HIPAA Privacy Rule. Non-compliance could lead to civil and criminal penalties, highlighting the importance of rigorous adherence.

Security Rule

The Security Rule is a component of the Health Insurance Portability and Accountability Act (HIPAA) of 1996, which was signed into law by President Bill Clinton on August 21, 1996. HIPAA was created to improve the portability and accountability of health insurance coverage and introduced measures to guarantee coverage for employees with pre-existing conditions and prevent "job lock".

The Security Rule establishes national standards to protect individuals' electronic personal health information (ePHI) that is created, received, used, or maintained by a covered entity. It requires appropriate administrative, physical, and technical safeguards to ensure the confidentiality, integrity, and security of ePHI. The rule is designed to be flexible and scalable, allowing covered entities to implement policies, procedures, and technologies that are appropriate for their specific size, structure, and risks.

The Security Rule applies to health plans, health care clearinghouses, and health care providers who transmit health information electronically in connection with transactions covered by HIPAA. It requires covered entities to maintain reasonable and appropriate administrative, technical, and physical safeguards to protect ePHI. Specifically, they must ensure the confidentiality, integrity, and availability of all ePHI, protect against reasonably anticipated threats, and ensure compliance by their workforce.

The Security Rule incorporates the concepts of scalability, flexibility, and generalization, recognizing that security is an evolving target. It consists of a three-tiered system of requirements, including a series of standards, legal requirements, and implementation specifications. Covered entities must conduct a risk assessment to determine the threats to the security of ePHI and implement measures to protect against these threats.

The Security Rule also defines "confidentiality," "integrity," and "availability." Confidentiality refers to restricting access to ePHI to authorized persons. Integrity means that ePHI is not altered or destroyed without authorization, while availability ensures that authorized persons can access ePHI on demand.

Overall, the Security Rule plays a crucial role in protecting individuals' electronic personal health information and ensuring that covered entities have appropriate safeguards in place.

Enforcement Rule

The HIPAA Enforcement Rule of 2006 details the procedures for investigating violations of HIPAA and the penalties that the HHS Office for Civil Rights can impose on Covered Entities and Business Associates for failing to comply with the Privacy, Security, and Breach Notification Rules. The rule contains provisions relating to compliance and investigations, the imposition of civil monetary penalties for violations of the HIPAA Administrative Simplification Rules, and procedures for hearings.

The rule was established because, despite receiving more than 13,000 complaints in the first two years after HIPAA was passed, the Office for Civil Rights failed to bring a single enforcement action. This gave Covered Entities the impression that HIPAA compliance was optional rather than mandatory.

The rule was codified at 45 CFR Part 160, Subparts C, D, and E. It was published as a Final Rule on February 16, 2006, and became effective on March 16, 2006.

The rule sets civil monetary penalties for violating HIPAA rules and establishes procedures for investigations and hearings for HIPAA violations. For many years, there were few prosecutions for violations. This may have changed with the fining of $50,000 to the Hospice of North Idaho as the first entity to be fined for a potential HIPAA Security Rule breach affecting fewer than 500 people.

Frequently asked questions