The Health Insurance Portability and Accountability Act (HIPAA) was enacted by the U.S. Congress in 1996, because of the increasing need to address growing technological changes and the problems with standards that were arising from it. With the introduction of HIPAA, health standards and privacy protections for individually identifiable health information (PHI) were standardized federally, in a manner that would prevent the erosion of privacy owing to new technology.
Part of HIPAA regulates group health plans and some individual health insurance policies. But the most commonly referenced part provides policies, procedures, and guidelines for preserving the privacy and security of PHI. It also identifies offenses related to healthcare, and sets out penalties for violating the rules. Compliance with HIPAA is mandatory when organizations deal with PHI in any way. HIPAA exists to protect the security and the privacy of patients and their information. The act covers both protections from breaches and the necessary steps that must be taken if a violation does occur. The best way to ensure your organization is HIPAA compliant is to know what compliance entails. There are four important aspects of HIPAA compliance – the HIPAA Enforcement Rule, HIPAA Privacy Rule, HIPAA Security Rule, and HIPAA Breach Notification Rule.
In this guide we'll cover:
HIPAA is regulated by the US Department of Health and Human Services (HHS), and its privacy and security rules are enforced by the Office for Civil Rights. The Enforcement Rule sets out how HIPAA will be enforced and what will happen if non-compliance is discovered. The process of enforcement is handled by OCR, which investigates complaints filed with it. OCR also conducts compliance reviews of entities, and works with the Department of Justice if a possible criminal violation of HIPAA is discovered. Once a complaint has been accepted for investigation, OCR will notify the complainant and entity in question. Each party is able to present information about the issue, with OCR conducting fact-finding. Entities covered under HIPAA must comply with the investigation, by law. After reviewing information and evidence, OCR makes a decision, determining whether or not the entity breached HIPAA rules. If an entity is found to be non-compliant, OCR can implement various types of corrective action, including asking for voluntary compliance, effecting corrective action, or creating a resolution agreement. The complainant will be informed of the results. If the entity’s response is not satisfactory, OCR can impose fines for every HIPAA violation, which can be appealed before an administrative law judge. As an example of the way the Enforcement Rule works, consider this scenario, as outlined on the HHS website. A patient’s PHI, including her medical condition and treatment plan, was disclosed in an unauthorized way via a telephone message from a hospital employee. An OCR investigation looked at information from all sides of the situation and determined that the hospital, a covered entity, did not follow the requirements set out in HIPAA for dealing with confidential communications. In response, the hospital developed and implemented new procedures to handle telephone messages to avoid becoming non-compliant in the future.
Terms in the rule exist to cover informal authorization or authorization in emergency situations, as well as public interest and benefit activities – things like FDA regulation, judicial proceedings, and serious threats.
The Security Rule sets out what safeguards must be in place to protect electronic PHI (ePHI), which is health information that is held or transferred in electronic form. Entities covered under the Security Rule have to uphold the privacy of any ePHI in their care.
This means:
Essentially, ePHI has to be protected like PHI. It can’t be disclosed or used inappropriately. It can’t be altered or destroyed in an unauthorized way. And it must be accessible and usable by authorized people. However, because ePHI has additional vulnerabilities while it’s at rest or in transit, those technical factors need to be addressed. The Security Rule sets out required technical safeguards, physical safeguards, and administrative safeguards, covering everything from encryption, to use of mobile devices, to risk assessments. Technical safeguards cover all of the ways a covered entity has to protect ePHI across its networks. The entity must use policies and procedures that keep ePHI in the hands of only authorized persons, and they must have a way to record and examine access. Policies and procedures must also cover the integrity of ePHI, ensuring it is not altered or destroyed improperly. If ePHI is transmitted over an electronic network, safeguards must be in place to continue to guard the privacy of that ePHI. Physical safeguards address physical access to a covered entity’s facilities and electronic networks. Only authorized users may access areas where ePHI is kept, both within its facilities and across workstations and electronic media. Policies and procedures must be in place to govern transfer, removal, disposal, and reuse of electronic media in order to protect ePHI that may be in place on those media. Administrative safeguards keep all members of a workforce in compliance with HIPAA. There must be a security official in place who handles the development of all security policies and procedures. Again, only those who are authorized to access ePHI should be permitted to do so under an entity’s policies and procedures. All staff members must receive appropriate supervision and training in how to properly handle ePHI. There must be a system in place to sanction people who violate an entity’s policies and procedures. Period assessment must be done to ensure security measures are working correctly.
A HIPAA transaction is an exchange of electronic information between two covered entities to carry out financial or administrative activities related to healthcare. A good example would be when a healthcare provider sends a claim to a health plan to request payment for services.
These HIPAA transactions include:
HIPAA is complex. Even the most well-meaning healthcare providers and their business associates can inadvertently go astray when trying to maintain privacy and confidentiality of their patients’ data. More and more people and entities are using the Internet and emerging technology to deliver healthcare. At the same time, cyberattacks on healthcare entities are becoming commonplace. According to 2015 IBM statistics, the healthcare industry is being attacked at a higher rate than any other sector. Malicious people desperately want to access PHI and ePHI, and are finding ways to do so. This makes it all the more important for entities to take the time to fully understand HIPAA and how it applies to your organization, to protect yourself, your business, and your patients and clients from breaches. Be sure to use technology to your advantage, but be sure you have Business Associate Agreements in place with your vendors. Then document and implement processes to make sure you have the right Administrative and Physical safeguards in place.