HIPPA COMPLIANCE
The Health Insurance Portability and Accountability Act of 1996 (HIPAA) is a federal legislation that mandates the establishment of national standards for safeguarding confidential patient health information, ensuring it remains undisclosed without the patient's consent or awareness. To enforce HIPAA's provisions, the US Department of Health and Human Services (HHS) introduced the HIPAA Privacy Rule, which outlines the necessary measures to be taken. Additionally, the HIPAA Security Rule offers protection to a specific subset of information covered by the Privacy Rule.
PERMITTED USES AND DISCLOSURES
The law provides the option for a covered entity to use and disclose Protected Health Information (PHI) without the individual's authorization, but it is not mandatory. The permissible purposes or situations include:
1. Disclosure to the individual: If the information is necessary for the individual's access or accounting of disclosures, the entity must disclose it to the individual.
2. Treatment, payment, and healthcare operations.
3. Opportunity to agree or object to the disclosure of PHI: The entity can obtain informal permission by directly asking the individual or through circumstances that clearly allow the individual to agree, acquiesce, or object.
4. Incidental to an otherwise permitted use and disclosure.
5. Limited dataset for research, public health, or healthcare operations.
6. Public interest and benefit activities: The Privacy Rule allows the use and disclosure of PHI for
12 national priority purposes without the individual's authorization or permission. These purposes include:
- When required by law.
- Public health activities.
- Assisting victims of abuse, neglect, or domestic violence.
- Health oversight activities.
- Judicial and administrative proceedings.
- Law enforcement.
- Functions related to deceased individuals (such as identification).
- Organ, eye, or tissue donation for transplantation.
- Research, with specific conditions.
- To prevent or mitigate a serious threat to health or safety.
- Essential government functions.
- Workers' compensation.
HIPAA SECURITY RULE
While the HIPAA Privacy Rule is responsible for safeguarding Protected Health Information (PHI), the Security Rule focuses on protecting a specific subset of information covered by the Privacy Rule. This subset encompasses all individually identifiable health information that a covered entity generates, receives, maintains, or transmits in electronic form, commonly known as electronic protected health information (e-PHI). It is important to note that the Security Rule does not extend to PHI transmitted orally or in writing.
To ensure compliance with the HIPAA Security Rule, all covered entities are required to:
1. Safeguard the confidentiality, integrity, and availability of all e-PHI.
2. Identify and protect against anticipated threats to the security of the information.
3. Implement safeguards to prevent anticipated impermissible uses or disclosures that are not permitted by the rule.
4. Certify compliance by their workforce.
When considering requests for permissive uses and disclosures, covered entities should rely on professional ethics and exercise their best judgment. The HHS Office for Civil Rights is responsible for enforcing HIPAA rules, and any complaints should be reported to that office. Violations of HIPAA regulations may lead to civil monetary or criminal penalties.
