What is HIPAA?

Originally passed by Congress in 1996, the Health Insurance Portability and Accountability Act (HIPAA) regulates the use and disclosure of personal health information. It covers virtually all health care organizations, including physicians, clinics, hospitals, and insurance companies.


Under HIPAA, organizations must implement security and privacy safeguards to protect personal health information. These safeguards include administrative, technical, and physical measures to prevent unauthorized access, use, or disclosure of PHI. There are four types of penalties for HIPAA violations: Tier 1 penalties (up to $50,000), Tier 2 penalties (up to $100,000), Tier 3 penalties (up to $150,000), and Tier 4 penalties (up to $1 million).

These penalties are imposed by the US Department of Health and Human Services Office for Civil Rights. A data breach is an obvious violation, but there are more subtle forms of non-compliance. Other examples include transmitting unencrypted ePHI, accessing PHI from an unsecure location, or transferring PHI without proper authorization.

The HIPAA Omnibus Rule, which came into effect in 2013, made a number of changes to the rules. This rule extended HIPAA protections to business associates of covered entities, including health care clearinghouses, health plans, and health care providers. It also added new provisions to HHS enforcement powers.

HIPAA requires organizations to conduct risk assessments and implement minimum controls to protect PHI. It also requires organizations to develop a plan to respond to a data breach. It also requires organizations to obtain consent from patients before using their personal health information.

Comments

Popular posts from this blog

How to Get the Best Out of Offline Mailing Campaigns

HIPAA Compliant Methods for Sending Medical Records by Mail

How to Use Healthcare Direct Mail Marketing to Boost Your Practice's Success