HIPAA Compliance and Your Practice: Part 2 of 3

The entire HIPAA legislation is no quick read! Its length and technical jargon may make it difficult for you to know where and how to start becoming HIPAA compliant.

For healthcare providers wanting to take a step toward having a HIPAA-compliant practice, these basic HIPAA rules are a good place to start: Privacy, Security, and Breach Notification.

It’s also important to keep in mind that these apply to:

• Covered entities. Health plans, healthcare clearinghouses, and healthcare providers that create, maintain, or transmit PHI.

• Business associates. Any entity that is provided with access to PHI in order to perform services for a covered entity.

Privacy, Security, and Breach Notification

Privacy Rule

The HIPAA Privacy Rule largely covers protected health information (PHI). It points out the restrictions and conditions that need to be observed when using and/or disclosing PHI. It discusses what can and cannot be shared without patient authorization, and with whom such information can be disclosed. 

The Privacy Rule also gives patients (or their nominated representatives) rights over their PHI. These rights include being able to obtain a copy of and/or examine their health records as well as being able to request necessary corrections.

Under the Privacy Rule, covered entities are strongly advised to:

• Provide HIPAA education and training to employees

• Ensure that appropriate steps are taken to maintain the integrity of patients’ PHI

• Ensure that patients provide written permission before their health information is used for purposes such as marketing, fundraising, or research

Even when the use or disclosure of PHI is permitted under the HIPAA Privacy Rule, it still needs to go through the minimum necessary standard, which means that access to PHI is limited to the minimum amount of information necessary to fulfill the intended purpose of the particular disclosure, request, or use.

Security Rule

The HIPAA Security Rule defines and regulates the standards, methods, and procedures that must be applied to electronically stored, accessed, and transmitted PHI (ePHI).

The Security Rule comprises three parts—technical, physical, and administrative safeguards. Some safeguards must be implemented (required), while some can be implemented with a reasonable amount of flexibility (addressable).

Here they are according to HIPAA Journal’s Compliance Checklist:

Technical Safeguards

The technical safeguards focus on the technology used to protect and provide access to ePHI. HIPAA requires ePHI (at rest or in transit) to be encrypted according to NIST standards once ePHI goes beyond an organization's internal firewalled servers.