Health Insurance Portability Accountability Act (HIPAA)

What is HIPAA?

HIPAA stands for the Health Insurance Portability Accountability Act of 1996. The concept of the law is to protect patient's privacy and rights regarding their confidential health information. Administration Simplification (Title II fo HIPAA, Subtitle F) affects the patient records healthcare organizations print, copy, fax and email every day. It will require you to produce and/or manage large volumes of new documents — such as training manuals and patient education materials — on an ongoing basis.

Because organizational processes, policy assessment and procedure redesign represent the vast majority of compliance work, it will be far more important for healthcare organizations to establish a productive, efficient organization that shares information easily, enables smooth collaboration among workgroups and across departments, and interacts with business partners seamlessly than it will be to purchase new technology.

Who is required to be in compliance?

Health plans, health care clearinghouses, and those health care providers who conduct certain financial and administrative transactions electronically (i.e. electronic billing and funds transfers).

General requirements

According to the U.S. Department of Health and Human Services, general requirements for the average provider or health plan include:

Notifying patients about their privacy rights and how their information can be used.
Adopting and implementing privacy procedures for its practice, hospital, or plan.
Training employees so that they understand the privacy procedures.
Designating an individual to be responsible for seeing that the privacy procedures are adopted and followed.
Securing patient records containing individually identifiable health information so that they are not readily available to those who do not need them.

Examples of the types of adjustments or modifications to facilities or systems that may constitute reasonable safeguards are:

In an area where multiple patient-staff communications routinely occur, use of cubicles, dividers, shields, curtains, or similar barriers may constitute a reasonable safeguard. For example, a large clinic intake area may reasonably use cubicles or shield-type dividers, rather than separate rooms, or providers could add curtains or screens to areas where discussions often occur between doctors and patients or among professionals treating the patient.
Hospitals could ensure that areas housing patient files are supervised or locked.

More Information

For more information on HIPAA, the following websites may be of help:

Department of Health & Human Services

Centers for Medicare & Medicaide Services

Washington State Department of Health & Human Services