
In addition, states may enact their own laws to protect health information because HIPAA sets a baseline from which states can create stronger laws. There are federal laws that apply to specific types of health information (or records containing health information) such as genetic information, health information in school records, identifiable information about individuals maintained by the federal government, certain alcohol and drug substance abuse records, and information relating to medical research. The Health Insurance Portability and Accountability Act (HIPAA) is not the only law that applies to health information. It also implemented changes to the HIPAA Privacy Rule required by the Genetic Information Nondiscrimination Act of 2008 (GINA). It modified and finalized the Breach Notification Rule. It implemented many provisions of the HITECH Act. HHS' Omnibus Rule made several important changes to the HIPAA Privacy, Security, and Enforcement Rules. 2013 – HHS' Office for Civil Rights issued the HIPAA Omnibus Rule.The HITECH Act created financial incentives for healthcare providers and insurers to continue shifting to electronic medical records, and also addressed privacy and security concerns related to the electronic transmission of health information, including unauthorized access and data breaches. Pharmacies began to process prescriptions electronically. Patients began to communicate with their doctors by email and through online portals.

Electronic medical records started replacing paper files. The HITECH Act is Title XIII of the American Recovery and Reinvestment Act (AARA).īetween 20 technology changed the medical privacy landscape.

The Office for Civil Rights (OCR) within HHS is reponsible for enforcing the HIPAA regulations. The Enforcement Rule addresses compliance, investigations, and potential penalties for violations of the HIPAA Privacy Rule and Security Rule.

The Security Rule sets standards for safeguarding electronic PHI. It also explains how covered entities (those who must comply with HIPAA) can use and disclose PHI. The Privacy Rule gives individuals rights with respect to their protected health information (PHI). In 2003, HHS issued the first national data privacy and security rules under HIPAA. Department of Health and Human Services (HHS) issued and adopted the HIPAA Privacy Rule, HIPAA Security Rule, and the HIPAA Enforcement Rule. In fact, until 2003 there were no national privacy standards for medical information under HIPAA. However, HIPAA’s initial purpose was to set standards for transmitting electronic health data and to allow people to transfer and continue health insurance after they change or lose a job. Most people are familiar with HIPAA as a medical privacy and security law.

Nearly everyone recognizes the sensitive nature of health and medical information. If there is a monetary penalty, will the individual who filed the complaint receive money? How does HHS determine a penalty for a violation?Ĭ. Department of Health and Human Services (HHS) enforce HIPAA?Ī. Health information regarding a person who has been deceased over 50 years Health information in education records (for the most part)Ĭ. Health information in employment recordsī. What information isn't covered under the HIPAA Privacy Rule?Ī.What information does the HIPAA Security Rule apply to? What information does the HIPAA Privacy Rule apply to?ī. Who isn't required to comply with HIPAA?Ī.Is HIPAA the only law that applies to health information?
