The Health Insurance Portability and Accountability Act (HIPAA).
HIPAA was enacted by Congress in 1996 to protect the personal privacy of any individual’s condition as it relates to their mental or physical health. This also includes health treatments that are past, present or future. All health treatments should be considered Protected Health Information (PHI). As an employer, it is important that you know that according to HIPAA, all medical records and data are PHI when they contain individual identifiers of an employee (see list of individual identifiers in article block below). In this post, we will review some key HIPAA guidelines.
Individual Identifiers
According to HIPAA, all medical records and data are Protected Health Information when they contain individual identifiers, such as:
- Names
- Contact information (street or email address, telephone or fax number)
- Dates directly relating to an individual (birth or death, admission or discharge)
- Geographic subdivisions smaller than a state (county, city, zip code)
- Account numbers (Social Security, medical record, insurance)
- Biometric identifiers (fingerprint, retinal scan, full-face photograph)
- Other unique identifiers (certificate or license number, vehicle license plate, Web URL, IP address)
Compliance Requirements
HIPAA requires an employer to “apply appropriate sanctions against members of its workforce who fail to comply with the privacy policies and procedures” [45 CFR §164.530(e)]. Thus, organizations are required by law to discipline staff for violating HIPAA’s privacy regulations. The HIPAA Privacy Rule requires organizations to:
- Adopt privacy policies and procedures
- Notify patients and clients about their privacy rights
- Institute safeguards to secure Protected Health Information (PHI)
- Train staff (employees and volunteers) on their responsibility for privacy
- Appoint a Privacy Officer responsible for enforcing privacy requirements
- Set up procedures to respond to complaints about privacy
- Take steps to minimize any unauthorized access or use of PHI
Key HIPAA Terms
Consent:
Informal authorization presumed to be granted by an individual when they’re given an opportunity to, but do not, object to a use or disclosure of their PHI.
Covered entities:
HIPAA applies to covered entities, which includes any person or business that provides, bills, or receives payment for medical care, including health care providers, clearinghouses that process medical information, and health plans and health insurance issuers.
Protected Health Information (PHI):
Protected health information is individually identifiable health information, in any form or media, about a person’s mental or physical health, condition, or treatment.
Security Rule:
The Security Rule (or “Security Standards for the Protection of Electronic Protected Health Information”) is a part of HIPAA designed to secure Electronic Protected Health Information (E-PHI) from disclosure, alteration, or loss.
In our next post, we will provide two sample scenarios as they relate to HIPAA compliance.
Disclaimer
Source: Lawroom.com