Overview of the Health Insurance Portability and Accountability Act (HIPAA)

Congress enacted the Health Insurance Portability andAccountability Act (HIPAA) in 1996. The purpose of this law isto protect private individual health information from beingdisclosed to anyone without the consent of the individual.Except under unusual circumstances, the consent needs to be inwriting.However, there are some exceptions to the consent provision. Theconsent provision does not apply in the following situations: - Treatment - Billing - Quality assurance - Peer review -Business planning activities - Staff training - Requiredreporting to public health agencies - Certain emergencysituations - Research studies that have obtained a wavier fromthe Institutional Review Board (IRB) ResearchPrivate health information can be used in research studies if itis "de-individualized" so that the identity of the individualcannot be ascertained from the information disclosed. Forexample, if you were conducting a study of the lung problemssuffered by New Yorkers after the 911 terrorist attacks, itwould be permissible to identify a patient as, a 50 year old,5'11', 175 lb., while male from New York City with high bloodpressure.MarketingHealth care providers are prohibited from selling or using theirpatient or enrollees lists to market products from a thirdparty. However, they can use their list to communicate with orsell their own services to their list members. Great care mustbe taken to restrict access when using online collaboration,such as an intranet. Business AssociatesAll business associates, vendors or other contractors that usethe health care provider's facility must sign a contract statingthat they understand and agree to be bound by HIPAA regulations.The health care provider can be held responsible for the actionsof the business associate if they did not sign a contract orthere was a history of abuse and the health care provider didnoting about it. Individual RightsUnder HIPAA, individuals have the right to: - Notice of the health provider's privacy practices - Requestrestrictions on who is allowed to access their healthinformation - Access, inspect or copy their personal healthinformation - Request an accounting of all disclosures of theirhealth information - Request corrections or amendments to theirhealth information Health Care Providers ResponsibilitiesHealth care providers are required to: - Provide security for both paper and electronic individualhealth information - Institute a complaint process toinvestigate complaints - Train staff on the lawThe HIPAA regulations allow for both civil monetary and criminalpenalties for violations of the act.