The Health Insurance Portability and Accountability Act (HIPAA) has a rich and complex history that spans over two decades. HIPAA was signed into law by President Bill Clinton on August 21, 1996.
The main goal of HIPAA was to improve the portability and continuity of health insurance coverage for workers and their families. This was a major concern at the time, as many people were losing their health insurance coverage due to job changes or other life events.
HIPAA also aimed to reduce healthcare fraud and abuse, which was a significant problem in the 1990s. According to the article, the Office of Inspector General estimated that healthcare fraud cost the US government over $60 billion annually.
The law was a major overhaul of the healthcare industry, and it had a significant impact on the way healthcare providers and insurers interact with patients' protected health information (PHI).
Suggestion: Hipaa Law in Nj
HIPAA Rule
The HIPAA Rule protects individual health information while allowing necessary access to health information, promoting high-quality healthcare, and protecting the public's health.
See what others are reading: Health Insurance Cancellation Laws
The rule permits important uses of information while protecting the privacy of people who seek care and healing. This is achieved through standards for individuals' rights to understand and control how their health information is used.
The HIPAA Rule contains standards for security that guarantee the availability, integrity, and confidentiality of Electronic Protected Health Information (ePHI). This is because of the growth in the exchange of protected health information between covered and non-covered entities.
The Federal Security Rule establishes federal standards to ensure the availability, confidentiality, and integrity of ePHI. These standards are in addition to state laws that provide more stringent standards that apply over and above federal security standards.
Healthcare providers, health plans, and business associates have a strong tradition of safeguarding private health information. However, the old system of paper records locked in cabinets is not enough in today's world anymore.
The HIPAA Rule provides clear national standards for protecting electronic health information, which is essential in today's digital age.
For another approach, see: Hipaa Security Services
HIPAA Violations
A HIPAA violation is a serious issue that can have severe consequences, including substantial fines and potential jail time. A HIPAA violation occurs when there is an unpermitted use or disclosure of Protected Health Information (PHI) that compromises the security or privacy of the PHI.
One of the most common HIPAA violations involves the impermissible disclosure of PHI. This usually occurs when healthcare providers or their associates disclose PHI without patient's authorization or for non-health related purposes.
A HIPAA violation can be as simple as a healthcare worker discussing a patient's condition with a friend or as complex as a system-wide data breach resulting from a sophisticated cyberattack. Regardless of how they occur, depending on their escalation each violation can carry severe penalties.
In fact, some of the biggest HIPAA violations in recent years have resulted in substantial fines, including a $5.55 million payment by Advocate Health Care (AHC) in 2016 for lack of risk analysis, failure to implement policies and procedures, and failure to enter into a Business Associate Agreement.
Even a simple act such as sending an email containing PHI to the wrong recipient can lead to a violation. This highlights the importance of being mindful of PHI and taking steps to protect it.
AHC is not the only example of a significant HIPAA violation. Cignet Health was fined $4.3 million in 2010 for denying 41 patients access to their medical records and then failing to cooperate with OCR's investigations into the complaints.
Protected Health Information
Protected Health Information is any information about health status, provision of health care, or payment for health care that can be linked to a specific individual.
This type of information is sensitive and requires careful handling. Healthcare providers and their associates must ensure that PHI is not disclosed without patient's authorization or for non-health related purposes.
Impermissible disclosures of PHI can happen intentionally or unintentionally, such as when a medical practitioner talks about a patient's condition in a public area.
Protected Health Information Disclosures
Protected Health Information (PHI) is any information about a person's health status, provision of healthcare, or payment for healthcare that can be linked to a specific individual. This includes a wide range of information, such as medical records, test results, and billing information.
Disclosing PHI without authorization can lead to serious consequences, including HIPAA violations. This can happen intentionally or unintentionally, and even simple acts like sending an email with PHI to the wrong recipient can cause a problem.
Some common examples of impermissible disclosures include a medical practitioner discussing a patient's condition in a public area or a staff member losing documents containing PHI. These incidents can have serious consequences for both the patient and the healthcare provider.
The law permits covered entities to use and disclose PHI for certain situations, including treatment, payment, and healthcare operations. This is a key exception to the rule that PHI must be kept confidential.
Here are some examples of permitted uses and disclosures:
- Disclosure to the individual (if the information is required for access or accounting of disclosures, the entity MUST disclose to the individual)
- Treatment, payment, and healthcare operations
- Opportunity to agree or object to the disclosure of PHI
- Incident to an otherwise permitted use and disclosure
- Limited dataset for research, public health, or healthcare operations
- Public interest and benefit activities—The Privacy Rule permits use and disclosure of PHI, without an individual's authorization or permission, for 12 national priority purposes:
Some of these permitted uses and disclosures include:
- When required by law
- Public health activities
- Victims of abuse or neglect or domestic violence
- Health oversight activities
- Judicial and administrative proceedings
- Law enforcement
- Functions (such as identification) concerning deceased persons
- Cadaveric organ, eye, or tissue donation
- Research, under certain conditions
- To prevent or lessen a serious threat to health or safety
- Essential government functions
- Workers' compensation
Clinical Significance
Protected health information (PHI) is a serious matter, and its clinical significance cannot be overstated. HIPAA's definition of PHI includes demographic information, medical records, and billing information.
A healthcare provider's failure to protect PHI can result in significant financial penalties and reputational damage. The average cost of a data breach is $3.9 million.
In the event of a data breach, patients have the right to request a copy of their PHI. This right is guaranteed under the HIPAA Breach Notification Rule.
Discover more: Hipaa Data Classification
New York-Presbyterian/Columbia University Medical Center
New York-Presbyterian/Columbia University Medical Center had a data breach in 2010 that resulted in the electronic protected health information (ePHI) of 6,800 individuals being inadvertently disclosed.
The disclosure was due to the deactivation of a personal server, which could have been identified as a risk if a thorough risk analysis had been conducted.
Frequently Asked Questions
What was in place before HIPAA?
Before HIPAA, a patchwork of unclear and inconsistent federal and state regulations governed healthcare privacy, leading to confusion and inconsistent application. This lack of clarity made it difficult to ensure patient data was protected.
What is the primary reason for HIPAA?
The primary reason for HIPAA is to simplify health insurance, safeguard sensitive healthcare data, and reduce administrative costs in the healthcare industry. This law aims to make healthcare more accessible and efficient for everyone.
Has HIPAA been amended since 1996?
Yes, HIPAA has undergone hundreds of changes since 1996 through amendments to various Acts, including the Public Health Service Act and the Social Security Act. These updates have significantly impacted HIPAA regulations and compliance requirements.
What is the timeline of HIPAA?
HIPAA was signed into law in August 1996 and implemented in several stages, with key milestones including the effective dates of the Privacy Rule (April 2003), Security Rule (April 2005), and Breach Enforcement Rule (March 2006).
Sources
- https://www.cdc.gov/phlp/php/resources/health-insurance-portability-and-accountability-act-of-1996-hipaa.html
- https://en.wikipedia.org/wiki/United_States_Department_of_Health_and_Human_Services
- https://www.ncbi.nlm.nih.gov/books/NBK500019/
- https://www.dol.gov/agencies/oalj/PUBLIC/RULES_OF_PRACTICE/REFERENCES/REFERENCE_WORKS/HIPAA_REG_HISTORY_EMPLOYMENT_RECORDS
- https://www.exabeam.com/explainers/hipaa-compliance/hipaa-violations-types-examples-and-biggest-violations-in-history/
Featured Images: pexels.com
