Hippa: Health Insurance Portability and Accountability Act

Health Insurance Portability and Accountability Act. A major goal of the Privacy Rule is to assure that individuals’ health information is properly protected while allowing the flow of health information needed to provide and promote high quality health care and to protect the public’s health and well being. The Rule strikes a balance that permits important uses of information, while protecting the privacy of people who seek care and healing. Given that the health care marketplace is diverse, the Rule is designed to be flexible and comprehensive to cover the variety of uses and disclosures that need to be addressed.

All those who meet the definition of a ‘covered entity’ under HIPAA must comply with HIPAA requirements to protect the privacy and security of health information.  They must also provide individuals with certain rights with respect to accessing their health information.

Those defined as covered entities are:

• Health care providers
• Health plans
• Healthcare clearinghouses

Until recently, only covered entities were required to comply with the HIPAA Privacy Rule and the Security Rule.  In 2009, HITECH extended HIPAA rules to apply to those who assist covered entities, known as ‘business associates.’  The proposed HIPAA rule would change HIPAA’s definition of business associates to include:

• Entities or persons that provide data transmission services to a covered entity and require routine access to protected health information (PHI)
• Subcontractors that create, receive, maintain, or transmit PHI on behalf of a business associate
• Vendors that offer personal health records to one or more individuals on behalf of a covered entity

HITECH also strengthens enforcement penalties for healthcare professionals who are guilty of willful neglect.  It extends HIPAA’s penalties to business associates as well.

Further, covered entities must ensure that their workforce members receive training on and follow the disposal policies and procedures of the covered entity, as necessary and appropriate for each workforce member. See 45 CFR 164.306(a)(4), 164.308(a)(5), and 164.530(b) and (i). Therefore, any workforce member involved in disposing of PHI, or who supervises others who dispose of PHI, must receive training on disposal. This includes any volunteers. See 45 CFR 160.103 (definition of “workforce”).