HIPAA Privacy Rule

Abstract

This research paper deals which the “Privacy Rule” which is a Federal regulation under the 1996 statute Health Insurance Portability and Accountability Act, and is aimed at the protection of health information. The Privacy Rule was passed for the protection of privacy of health information of identifiable individuals. The regulation was developed to strike a balance between an individual's interests in maintaining secrecy about his or her health records with various other social interests, like health care research studies.





Introduction1

History of the Legislation1

Purposes of HIPAA2

Who Is Regulated by the Privacy Rule?2

Group of People Affected by this2

Covered Entities3

Hybrid Entities4

Business Associates4

Determining the Status under the Privacy Rule4

What Type Information is protected?5

Protected Health Information5

De-Identified Health Information5

HIPAA Officer5

Enactment of American Recovery and Reinvestment Act6

Enforcement and Penalties for Noncompliance (Prior to ARRA)6

Enforcement after ARRA7

How Do Other Privacy Protections Interact with the Privacy Rule?7

Privacy Rule and State Law7

Privacy Rule and Federal Law7

Has the legislation been effective in addressing the problem or issue?8

Conclusion8

HIPAA Privacy Rule

Introduction

The phrase “Privacy Rule” precedes “HIPAA” which is an acronym for Health Insurance Portability and Accountability Act of 1996. The Standards for Privacy of Individually Identifiable Health Information is contained in Title 45 of the Code of Federal Regulations, Part 160 and Part 164 (Sub-parts A and E) (Rouse, 2012).

History of the Legislation

The Department of Health and Human Services (HHS) published the Rule in December 2000, with the objective to promote HIPAA's mandate which is to set standards for protection of privacy of individually identifiable health information (NIH Publications, 2003). HHS's Office for Civil Rights (OCR) has the jurisdiction to enforce it The regulation bestow certain rights on individuals that includes rights to access and alter their personal health information and to acquire records of when and for what purposes their PHI has been disclosed. Moreover the Rule presents a set of administrative requirements for covered entities (NIH Publications, 2003). The Privacy Rules pays regard to the rightful needs of the research community and its procedures which require the application and disclosure of health information in order to study and develop healthcare projects and new techniques of treatment. To simplify the provisions, negate the adverse effects and mitigate the burden of administrative hurdles on health care, HHS amended the Privacy Rule on August 14, 2002 and compliance with the Rule was made mandatory by August 14, 2003 (NIH Publications, 2003).

HSS also developed and set forward the final Security Rule in February 2003 which focused on the standards of confidentially, ethical use and availability of e-PHI. Compliance with the Security Rule was made compulsory in April 2005, however small health plans were afforded another year to comply.

Purposes of HIPAA

The health care system in the United States moved towards achieving its goal of maintaining a National Health Information Infrastructure (NHII) which resulted in greater use of electronically administered health records which in turn posed a threat to security and confidentiality of identifiable health information. The security rules of HIPAA were developed for two key purposes: firstly to implement a system of security ...