Category: HIPAA

More than twenty years ago, Congress passed the Health Insurance Portability and Accountability Act of 1996 (HIPAA). One of HIPAA’s five provisions—Administrative Simplification—mandated that the Department of Health and Human Services (HHS) adopt standards to streamline communications between health care providers and health plans. Administrative simplification requirements govern how providers, health plans, and clearinghouses handle electronic and administrative transactions and set privacy and security standards for transmitting health information. This is done by developing and enforcing regulations that adopt standards, operating rules, unique identifiers, and code sets that these types of individuals and organizations, known as HIPAA-covered entities, are requiredLearn MoreHIPAA Administrative Simplification Regulations Overview

The Privacy Rule 45 CFR Part 164 Subpart E sets the standards for using and disclosing protected health information (PHI). In contrast, the Security Rule 45 CFR Part 164 Subpart C explicitly sets the Security Standards for the Protection of Electronic Protected Health Information (ePHI). Electronic vs. oral and paper It is important to note that the Privacy Rule applies to all forms of patients’ protected health information, whether electronic, written, or oral. In contrast, the Security Rule covers only protected health information in electronic form (ePHI), including ePHI created, received, maintained, or transmitted electronically. The Security Rule sets theLearn MoreComparing the HIPAA Privacy Rule and Security Rule

The Centers for Medicare & Medicaid Services (CMS) enforces HIPAA Administrative Simplification Requirements on behalf of the Health and Human Services (HHS). The CMS enforcement activities include proactive enforcement through Compliance Reviews. Here’s what happens when a HIPAA-covered entity is randomly selected for a review: