The Health Insurance Portability and Accountability Act (HIPAA) is a landmark piece of legislation in the United States healthcare industry. Enacted by Congress in 1996 and signed into law by President Bill Clinton, HIPAA was initially designed to address the issue of health insurance coverage for people who were between jobs. Without HIPAA, individuals who found themselves in these circumstances would be left without health insurance, and potentially unable to pay for critical healthcare.
HIPAA is now more widely known in another context: the improvement of data privacy and data security in the healthcare industry. HIPAA Rule’s introduced critical changes to how organisations may store, handle and use sensitive patient information. HIPAA legislation covers healthcare providers, health plans, healthcare clearinghouses, and business associates of HIPAA-covered entities.
The importance of HIPAA for patients in the healthcare system cannot be understated. The legislation has introduced clear and strict guidelines on the management, storage, handling and safeguarding of protected health information (PHI). PHI is defined to include sensitive information such as names, addresses, credit card details, social security numbers, and details of medical procedures and conditions. PHI has a significant black market value due to its potential use in identity theft. HIPAA’s Privacy Rule ensures that HIPAA-covered entities must take measures to protect sensitive personal and health information. Furthermore, the Privacy Rule also gives individuals access to their healthcare information upon request.
Before HIPAA, there was no legal requirement for healthcare companies to place safeguards on patient data; it was up to the discretion of the organisations. Furthermore, there were no repercussions if an unauthorised individual gained access to PHI. HIPAA introduced sweeping new changes, requiring organisations to place many layers of safeguards on patient data. HIPAA’s enforcers have the power to levy financial penalties against organisations who violate HIPAA.
Technology has changed in unprecedented ways since 1996. New threats, such as phishing campaigns and malware attacks, place patient data at risk. HIPAA has been updated to account for technological advancement, and now stipulates that organisations should place technological safeguards stored on an electronic device. One of the most popular methods of securing ePHI is encryption. Even if an unauthorised individual steals encrypted data, they cannot read the data unless they have the correct key to decrypt them.
HIPAA rules state that organisations must control who can access patient data. HIPAA-compliant organisations must ensure that only authorised individuals may access patient health information, and that information may only be shared with other authorised individuals. HIPAA ensures that strict controls are placed on any information disclosed to healthcare providers and health plans. Similarly, any information that is created, transmitted, or stored by HIPAA CEs is tightly regulated.
HIPAA grants patients rights over their data, such as the authority to dictate with whom their information may be shared. HIPAA’s Privacy Rule allows patients to obtain copies of their healthcare information. Patients that can access their healthcare information have more autonomy and control over their treatment. If a patient decides to change healthcare provider, they can transfer the data themselves without extra levels of bureaucracy. HIPAA allows for the patient to achieve a more smooth transition, improving their healthcare experience.
HIPAA has reformed the way in which healthcare professionals operate. For example, HIPAA’s Rules have introduced measures to improve efficiency in administrative tasks. These measures included assisting covered entities of all sizes in the transition from paper records to electronic copies of health information, and ensuring that the safeguards placed on these were of an acceptable standard across the industry.
HIPAA-covered entities across the country must use the same code sets and nationally recognised identifiers, therefore ensuring a simple transfer of electronic health information between healthcare providers, health plans, and other entities.
As with many pieces of legislation, there have been many outspoken critics of HIPAA. Some say that it is too complicated, and it adds a further burden of bureaucracy to a strained healthcare system. Others claim that it is costly to implement all of the safeguards and training courses required by HIPAA, and failure to do so incurs crippling penalties.
HIPAA is still evolving to this day, so whether one is pro-HIPAA or against it, it is impossible to understate the significance of the legislation.
Even though it is now most associated with patient privacy, only one section of HIPAA itself is focused on patient privacy (Title II). The other sections focused on taxes and reform of the health insurance industry. The latter, in particular, was important to patients as it expanded access to health insurance and made it easier for employees to carry over benefits between jobs.
Only those with authorized access can access patient data. That is, only those who need to access health data for the provision or payment of healthcare, or other healthcare operations, can legally access PHI. If any other individual accesses PHI – either accidentally or deliberately – it is a violation of HIPAA.
Patients are able to submit a request to the CE or BA that holds their PHI. This request should be acted upon without “undue delay”. HIPAA permits the application of nominal fee for such requests, but the fee must only be associated with costs such as postage, and not procedures required by HIPAA such as the verification of the applicant’s identity or the cost of maintaining the PHI.
Yes – even though HIPAA is first and foremost concerned with patients and their rights, there have been some benefits to Covered Entities. For example, encouraging the move to electronic health records has streamlined some administrative procedures.
Copyright © 2022 ComplianceHome