HIPAA Series #3: An Overview of HIPAA’s Privacy and Security Rules

Worldwide, governments are implementing legislation to protect the data and identity of users. One such important legislation is the Health Insurance Portability and Accountability Act of 1996 (HIPAA). It is a federal law enacted to safeguard patients’ Protected Health Information (PHI). In particular, HIPAA establishes strict rules and guidelines for entities that handle, store, and share health information.

In this article, we will look into HIPAA’s main provisions, including its privacy and security laws, and how you can comply with them.

HIPAA Objectives

HIPAA’s main objectives are:

Protecting Health Information 

The foremost objective of HIPAA is to protect the privacy and security of PHI, which includes any information that can be used to identify an individual and is related to their health or healthcare. This unauthorized access or sharing prevents discrimination due to health conditions.

Ensuring Continuity of Health Coverage

Another key objective is to ensure that individuals continue to have health insurance when they lose or change jobs. This provision ensures they can maintain the same health insurance coverage without facing pre-existing condition exclusions.

Promoting Standardization 

From an operational standpoint, HIPAA establishes standardized code sets for electronic transmission of administrative and financial transactions. This standardization promotes the exchange of health information within the healthcare industry.

Improving Healthcare Efficiency 

Other HIPAA objectives include combating fraud and abuse in the health insurance and healthcare delivery industries. Also, HIPAA aims to improve access to long-term care services at affordable costs.

Out of these objectives, the security, and privacy of patients are the most important, and this is why HIPAA lays down specific rules for both of these aspects.

HIPAA Privacy Rules

The Standards for Privacy of Individually Identifiable Health Information, commonly known as the Privacy Rule, establishes the standards to protect patients’ healthcare data in the United States. These rules apply to HIPAA-covered entities and HIPAA business associates.

A HIPAA-covered entity includes healthcare providers, organizations offering health plans, and healthcare clearinghouses. A business associate is an entity that has a business agreement with one of the HIPAA-covered entities to handle patient data.

Both these entities are responsible for safeguarding patient’s PHI and protecting their identity. They are responsible for obtaining written authorization and explicit consent from the patients before using or disclosing their PHI. Furthermore, the covered entities must limit the use of PHI to the minimum necessary.

Lastly, patients have the right to access their information at any time. They can also request changes, and the covered entities must provide an accounting of disclosures to them.

HIPAA Security Rules

The HIPAA security rule established in 2005 lays down the standards for protecting electronic PHI (e-PHI). These provisions are based on the National Institute of Standards and Technology’s Cybersecurity Framework.

Under this rule, the covered entities must meet the following requirements:

• Establish policies and processes to manage security risks. Some policies include risk assessments, employee training, incident response plans, and more.
• Physical measures like secure access to data storage facilities.
• Technical safeguards like encryption, audit trails, and access controls.

Along with the security and privacy rules, HIPAA also establishes the requirements for notifying breaches.

Breach Notification Rule

This rule requires covered entities and their business associates to notify affected individuals, the Department of Health and Human Services (HHS), and, in some cases, the media when there’s a breach of unsecured PHI. The above entities must be notified within 60 days after the breach was identified. For this rule, a breach means an impermissible use or disclosure that compromises the security or privacy of PHI.

Note that these breach rules apply only to unsecured PHI, which includes any patient data that is usable, readable, and decipherable by unauthorized users.

Thus, these are HIPAA’s privacy and security rules.

Next, let’s see how you can adhere to these rules if you are a covered entity under HIPAA.

10 Actionable Tips for Covered Entities

Below are some actions you can take to ensure adherence to the privacy and security rules:

1. Have a dedicated officer for HIPAA compliance.
2. Establish clear and written policies that adhere to HIPAA regulations.
3. Create a system for responding to data subject requests.
4. Conduct regular audits and assessments to identify compliance gaps.
5. Establish safeguards like access controls.
6. Maintain documentation and records to demonstrate compliance.
7. Create the required technical and physical safeguards.
8. Offer regular training to employees.
9. Create protocols for notifying breaches.
10. Monitor business associates’ compliance with HIPAA and address any issues promptly.

Final Words

HIPAA plays a key role in protecting the security and privacy of any data that can identify an individual, also known as Protected Health Information (PHI). In this context, the privacy, security, and breach notification rules are HIPAA’s pillars, and non-compliance can attract heavy fines. This article discussed these three rules and provided actionable tips, and we hope they come in handy to ensure compliance.