Health Insurance Portability and Accountability Act of 1996

Health Insurance Portability and Accountability Act of 1996

In 1996, the U.S. Congress passed the Health Insurance Portability and Accountability Act (HIPAA). The act includes two sections. The first, Title I, provides health insurance coverage after employees have lost or changed jobs. The second section, Title II, deals with administrative actions intended to simplify and standardize health information. The IT component of Title II deals with security and handling of health information in an electronic age. When the topic of HIPAA arises, particularly among IT staff, it is the implications of this section that are most prevalent .

The IT components of the act prescribe a standard methodology for security. Further, HIPAA standardizes formats for health- related information. The standards encompass methods that ensure patient confidentiality and data integrity for any information that can be associated with an individual patient.

The most commonly identified component of the act is a body of data collectively known as protected health information (PHI) . These data represents the entire spectrum of individually identifiable health-related information. Any entity that maintains and uses individually identifiable PHI is subject to the act. The effective scope of HIPAA encompasses everyone from hospitals , to insurers, to doctors (of all types), to laboratories, and to companies that operate or participate in health plans. Organizations affected by HIPAA are referred to by the act as covered entities .

HIPAA Privacy and Security Rules

Two rules were published in the Federal Register by the Department of Health and Human Services after HIPAA was passed. The HIPAA Privacy Rule was published in December 2000, and the HIPAA Security Rule was published in February 2003.

The HIPAA Privacy Rule is focused mostly on administrative controls designed to protect patient privacy, such as securing or masking medical charts , locking file cabinets , and establishing privacy policies. The HIPAA Privacy Rule was enforced beginning April 2003.

The HIPAA Security Rule is focused on technical controls such as network perimeter protection encryption and workstation security. The HIPAA Security Rule is broken out into high-level standards and implementation specifications that support each standard. Implementation specifications are either required (mandatory) or addressable (required unless justified otherwise ). Table 14-1 that outlines the implementation specifications required by the HIPAA Security Rule. The implementation specifications with (R) next to them are required; those with (A) are addressable. Organizations were given until April 2005 to comply with the HIPAA Security Rule.

Similar products