Online Class: HIPAA Compliance 101

HIPAA was the result of mounting concerns regarding patient access to insurance during unstable times, as well as concerns regarding the mass collection and storage of highly sensitive personal information by health insurance companies and medical establishments. HIPAA is divided into two components, Title 1 and Title 2.  

Title 1: Health Coverage Access and Portability

The focus of Title 1 is on the portability of health coverage. This protects an individual's ability to maintain health coverage even when moving between jobs, and is especially important in the case of pre-existing conditions.

In the past, many employers denied health coverage to new employees if they could verify the existence of a pre-existing condition. Due to this, many people were afraid to leave their jobs, even if the work environment and compensation were poor. The risk of being unable to acquire health insurance for themselves and their families was one that few people were willing to take, especially in uncertain economic times.

According to the United States Department of Labor, HIPAA is a federal law that:

• Limits the ability of a new employer plan to exclude coverage for pre-existing conditions
• Provides additional opportunities to enroll in a group health plan if you lose other coverage, or experience certain life events
• Prohibits discrimination against employees and their dependent family members based on any health factors they may have, including prior medical conditions, previous claims experience, and genetic information
• Guarantees that certain individuals will have access to, and can renew, individual health insurance policies.

Title 2: Developing the Administrative Simplification Provisions

The focus of Title 2, also known as the "Administrative Simplification"provisions, is to protect unique identifying information found in patient health records, insurance claims and many other types of health documents. Title 2 also encourages the use of electronic patient records systems and imposes penalties for breaches of patient privacy.

When the act was initially drafted, there was a mandate for the Administrative Simplification rules to be developed and ratified by Congress and publicized by the Secretary of the Department of Health and Human Services to the public within three years. In the absence of action by Congress, the Secretary of HHS was to take responsibility for drafting the legislation. As Congress failed to move on this initiative, the Secretary of HHS took over.

The Secretary created proposed legislation that governed the exchange, privacy, and security of personal health information. This proposal was released to the public for feedback and amended based on more than 52,000 comments that were received. The final version was released in December of 2000. The legislation was later revised and again vetted by the public, with the final version released in August of 2002.

The First Federal Medical Privacy Data Legislation

There were privacy laws on the books in the individual states, but they mainly focused on financial data, identity theft, and other types of fraud. The laws that dealt with medical information were not robust or clear enough to eliminate the many breaches of privacy that had occurred,  or could occur. HIPAA provided a blanket set of expectations for medical data privacy that provided more security for patients and uniform direction for those who deal with medical data. The fact that the law included civil and criminal penalties also gave it more credibility.  

Prior to the inception of HIPAA's privacy rule, there was a sense of organized chaos in the medical community. Clinics were burdened with increased administrative duties required by managed care companies, which included keeping up to date on procedure codes, billing requirements, and record maintenance. Also, there was no standard format for the establishments that maintained electronic patient records. One of the main goals of HIPAA was to streamline the process for maintaining and transmitting patient data electronically while limiting breaches in confidentiality.  

The main benefits of the Standards for Privacy of Individually Identifiable Health Information ("Privacy Rule") are:

• Specific rules regarding the disclosure of Protected Health Information (PHI) 

• Guidelines for transmitting patient data electronically 

• Limiting internal employee access to PHI to the minimum necessary to perform their jobs 

• Guidelines for health insurance companies and clearing houses that transmit PHI 

• The ability for patients to access their medical records and make amendments to their medical data if warranted  

• To require authorization from the individual to utilize or transmit PHI as part of any marketing communications

The privacy rule has gone through a few iterations. The original version was released in December of 2000. The privacy rule was later amended in August of 2002, and required compliance by February 14, 2003. Smaller health plans with fewer resources were required to be in compliance by April 14, 2004.