HIPAA: An overview

Fifty years ago, when medical school graduates took the Hippocratic oath, it was good enough to assure that a patient’s privacy would be protected. Fast forward to 1996; as medicine has evolved and become more complex, so has the interest in formalizing patient confidentiality.

The 1996 Health Insurance Portability and Accountability Act (HIPAA) is perhaps the most sweeping legislation ever to face the healthcare industry. The primary intention of HIPAA is to protect the patient, by granting them:

	the right to inspect and copy their protected health information (PHI),
	and receive an account of all PHI disclosures.
	the right to report any concerns and/or complaints about the way their
	PHI is being managed.

The responsibility to carry out HIPAA provisions lies with any person or organization who handles patient health information (PHI); physicians, nurses, medical office staff, insurance companies, and any other entity, (as stated in the guideline) "who transmits or on whose behalf is transmitted any health information in electronic form in connection with a transaction referred to in section 1173(a)(1)." Section 1173(a)(1) defines a transaction as just about anything that a health care provider could possibly imagine: "(A) Health claims or equivalent encounter information. (B) Health claims attachments. (C) Enrollment and disenrollment in a health plan. (D) Eligibility for a health plan. (E) Health care payment and remittance advice. (F) Health plan premium payments. (G) First report of injury. (H) Health claim status. (I) Referral certification and authorization."

The main focus of the HIPAA Act is found in Title II, which sets forth specific provisions for

	Security
	Privacy of health information
	Standardized health information transactions

The impact of HIPAA compliance on healthcare practitioners must not be underestimated. Patient confidentiality concerns any patient records, whether written, typed or spoken as well as the personnel who will be handling them. All patient data must be securely stored and any electronic transmissions of such must be encrypted.