Difference between revisions of "Health Insurance Portability and Accountability Act"
(HIPAA Security Guidance) |
DavidB4-bot (talk | contribs) (→top: clean up & uniformity) |
||
| (8 intermediate revisions by 6 users not shown) | |||
| Line 1: | Line 1: | ||
| − | The Health Insurance Portability and Accountability Act of 1996 (HIPAA), also known as the Kassebaum-Kennedy or Kennedy-Kassebaum Act, was passed in 1996 for the stated goal of allowing | + | The '''Health Insurance Portability and Accountability Act''' of 1996 (HIPAA), also known as the Kassebaum-Kennedy or Kennedy-Kassebaum Act, was passed in 1996 for the stated goal of allowing [[employee]]s to continue with their employer-based health insurance after a change in jobs ("portability") and to reduced alleged health care fraud and waste ("accountability").<ref>[http://frwebgate.access.gpo.gov/cgi-bin/getdoc.cgi?dbname=104_cong_public_laws&docid=f:publ191.104.pdf Public Law 104-191].</ref> |
| − | In fact, HIPAA enacted sweeping changes that enabled federal regulators to establish standards for the electronic data interchange (EDI) of health information, and to create federal jurisdiction and control over medical record privacy issues. Regulators promulgated these rules under the name of "administrative simplification," even though the rules are extraordinarily complex. | + | In fact, HIPAA enacted sweeping changes that enabled [[federal]] regulators to establish standards for the [[Electronic Data Interchange|electronic data interchange]] (EDI) of health information, and to create federal jurisdiction and control over medical record privacy issues. Regulators promulgated these rules under the name of "administrative simplification," even though the rules are extraordinarily complex. |
Though not widely known, only those who engage in electronic transactions (i.e., electronic billing, authorizations, etc.) are subject to HIPAA and federal jurisdiction under HIPAA. | Though not widely known, only those who engage in electronic transactions (i.e., electronic billing, authorizations, etc.) are subject to HIPAA and federal jurisdiction under HIPAA. | ||
| Line 7: | Line 7: | ||
There are four sets of rules under HIPAA: | There are four sets of rules under HIPAA: | ||
| − | * the privacy rule <ref>[http://www.hhs.gov/ocr/privacysummary.pdf Summary of the HIPAA Privacy Rule]</ref> | + | * the privacy rule;<ref>[http://www.hhs.gov/ocr/privacysummary.pdf Summary of the HIPAA Privacy Rule]</ref> |
* the transaction standard for computer-to-computer information exchanges; | * the transaction standard for computer-to-computer information exchanges; | ||
| Line 15: | Line 15: | ||
* information system security rules | * information system security rules | ||
| − | The Centers for Medicare & Medicaid Services (CMS) has prepared guidance to provide HIPAA covered entities with general information on the risks and possible mitigation strategies for remote use of and access to Electronic Protected Health Information (EPHI). <ref>[http://www.cms.hhs.gov/SecurityStandard/Downloads/SecurityGuidanceforRemoteUseFinal122806.pdf HIPAA Security Guidance]</ref> | + | The Centers for Medicare & Medicaid Services (CMS) has prepared guidance to provide HIPAA covered entities with general information on the risks and possible mitigation strategies for remote use of and access to Electronic Protected Health Information (EPHI).<ref>[http://www.cms.hhs.gov/SecurityStandard/Downloads/SecurityGuidanceforRemoteUseFinal122806.pdf HIPAA Security Guidance]</ref> |
There is a timetable for implementing the above rules.<ref>http://privacy.med.miami.edu/glossary/xd_compliance_calendar.htm</ref> | There is a timetable for implementing the above rules.<ref>http://privacy.med.miami.edu/glossary/xd_compliance_calendar.htm</ref> | ||
== References == | == References == | ||
{{reflist|2}} | {{reflist|2}} | ||
| + | |||
| + | [[Category:Law]] | ||
Latest revision as of 13:51, July 13, 2016
The Health Insurance Portability and Accountability Act of 1996 (HIPAA), also known as the Kassebaum-Kennedy or Kennedy-Kassebaum Act, was passed in 1996 for the stated goal of allowing employees to continue with their employer-based health insurance after a change in jobs ("portability") and to reduced alleged health care fraud and waste ("accountability").[1]
In fact, HIPAA enacted sweeping changes that enabled federal regulators to establish standards for the electronic data interchange (EDI) of health information, and to create federal jurisdiction and control over medical record privacy issues. Regulators promulgated these rules under the name of "administrative simplification," even though the rules are extraordinarily complex.
Though not widely known, only those who engage in electronic transactions (i.e., electronic billing, authorizations, etc.) are subject to HIPAA and federal jurisdiction under HIPAA.
There are four sets of rules under HIPAA:
- the privacy rule;[2]
- the transaction standard for computer-to-computer information exchanges;
- standardized "identifiers" for health providers and health plans;[3] and
- information system security rules
The Centers for Medicare & Medicaid Services (CMS) has prepared guidance to provide HIPAA covered entities with general information on the risks and possible mitigation strategies for remote use of and access to Electronic Protected Health Information (EPHI).[4]
There is a timetable for implementing the above rules.[5]
References
- â Public Law 104-191.
- â Summary of the HIPAA Privacy Rule
- â public outrage put patient identifiers on hold
- â HIPAA Security Guidance
- â http://privacy.med.miami.edu/glossary/xd_compliance_calendar.htm