HIPAA

The Health Insurance Portability and Accountability Act of 1996 is the single most significant Federal legislation affecting the health care industry since the creation of the Medicare and Medicaid programs in 1965. This legislation is intended to help all parties better manage limited healthcare resources through improving overall business practices and make health care more consumer focused. Title I of the Act improves the portability and continuity of health insurance coverage for millions of American workers and their families. Title II provides for administrative simplification that requires the development of standards for the electronic exchange of health care information. Administrative simplification also requires rules to protect the privacy of personal health information and the establishment of security requirements to protect that information and the development of standard identifiers.

While the law passed in August 1996, the compliance dates vary depending upon when the individual rule was released. The compliance dates are as follows:

• Transaction and Code Sets Rule - October 16, 2003

• Privacy Rule - April 14, 2003

• Security Rule - 26 months after the final rule is adopted

The main focus of administrative simplification is a reduction of health care costs through the development of standards for the electronic exchange of health care information. This means that health care organizations, including DHH, will need to secure the data processing systems necessary to make these changes possible. With the shift towards these e-business practices, the health care industry then must be ready to focus on protecting the privacy and security of individuals' health care information. Specific provisions include:

• Transactions and Code Sets Rule - HIPAA calls for the development and use of standardized transactions to be used in the electronic exchange of data. In addition, the rule requires the use of standardized national code sets to identify medical conditions, treatments, procedures, durable medical equipment, etc.
  

• Privacy Rule - This provides for the protection of individually identifiable health information that is transmitted or maintained in any form or medium.
  

• Security Rule - The provision that specifies that an entity must implement and document security measures to protect personal health information from inadvertent destruction or illegal disclosure.

LDH's HIPAA documents are located here.

Here are some tools that can offer you some assistance in determining whether HIPAA will affect you. However, you should not rely solely on these tools, but rather seek professional legal advice on what your organization needs to do to be in compliance with these federal regulations.

• HIPAA Coverage Validation Survey (Courtesy of the North Carolina Department of Health & Human Services)
• Covered Entity Screening Tool (Courtesy of the Ohio Statewide Project)