HIPAA

HIPAA
Shorttitle	Health Insurance Portability and Accountability Act of 1996
Longtitle	An Act to amend the Internal Revenue Code of 1986 to improve portability and continuity of health insurance coverage in the group and individual markets, to combat waste, fraud, and abuse in health insurance and health care delivery, to promote the use of medical savings accounts, to improve access to long-term care services and coverage, to simplify the administration of health insurance, and for other purposes
Enactedby	102nd, 103rd, and 104th United States Congress
Citations	Public Law 104-191
Signeddate	August 21, 1996
Signedby	Bill Clinton

HIPAA is a federal law that was enacted to improve the portability and continuity of health insurance coverage in the group and individual markets, as well as to combat Medicare and Medicaid fraud and abuse. The law was signed by Bill Clinton on August 21, 1996, and is administered by the United States Department of Health and Human Services (HHS), in conjunction with the Centers for Medicare and Medicaid Services (CMS) and the Office for Civil Rights (OCR). The law has been amended several times, including by the American Recovery and Reinvestment Act of 2009 and the Omnibus Budget Reconciliation Act of 1990. The Health Information Technology for Economic and Clinical Health Act (HITECH) also expanded the scope of HIPAA to include business associates and increased the penalties for non-compliance.

Introduction to HIPAA

The introduction of HIPAA marked a significant shift in the way that health insurance and health care were regulated in the United States. Prior to the enactment of HIPAA, there was no federal law that protected the privacy and security of protected health information (PHI). The law was designed to improve the portability and continuity of health insurance coverage, as well as to combat fraud and abuse in the health care system. The National Committee on Vital and Health Statistics (NCVHS) and the Agency for Healthcare Research and Quality (AHRQ) played important roles in the development and implementation of HIPAA. The law has been influenced by other federal laws, including the Employee Retirement Income Security Act of 1974 (ERISA) and the Consolidated Omnibus Budget Reconciliation Act of 1985 (COBRA).

History of HIPAA

The history of HIPAA dates back to the early 1990s, when Congress began to consider legislation to improve the portability and continuity of health insurance coverage. The Health Insurance Portability and Accountability Act of 1996 was introduced in Congress in 1995 and was signed into law by Bill Clinton on August 21, 1996. The law was the result of a bipartisan effort, with support from Newt Gingrich and Ted Kennedy. The American Medical Association (AMA) and the American Hospital Association (AHA) also played important roles in the development of the law. The National Institutes of Health (NIH) and the Centers for Disease Control and Prevention (CDC) have been impacted by the law, as have the Food and Drug Administration (FDA) and the Substance Abuse and Mental Health Services Administration (SAMHSA).

Key Provisions of HIPAA

The key provisions of HIPAA include the portability and continuity of health insurance coverage, as well as the protection of protected health information (PHI). The law requires that health plans and health care providers implement administrative, technical, and physical safeguards to protect PHI. The law also requires that health plans and health care providers provide notice of privacy practices to patients and obtain authorization before disclosing PHI. The Office of the National Coordinator for Health Information Technology (ONC) and the National Institute of Standards and Technology (NIST) have developed guidelines and standards for the implementation of HIPAA. The American Academy of Family Physicians (AAFP) and the American College of Physicians (ACP) have also provided guidance on the implementation of the law.

HIPAA Compliance and Enforcement

HIPAA compliance and enforcement are critical components of the law. The Office for Civil Rights (OCR) is responsible for enforcing the law, and may impose civil monetary penalties on health plans and health care providers that fail to comply with the law. The Centers for Medicare and Medicaid Services (CMS) also plays a role in enforcing the law, particularly with respect to Medicare and Medicaid programs. The Federal Trade Commission (FTC) and the Department of Justice (DOJ) may also enforce the law in certain circumstances. The National Association of State Departments of Agriculture (NASDA) and the National Governors Association (NGA) have also been involved in efforts to enforce the law.

HIPAA Privacy Rule

The HIPAA Privacy Rule is a key component of the law, and requires that health plans and health care providers protect the privacy of protected health information (PHI). The rule requires that health plans and health care providers implement administrative, technical, and physical safeguards to protect PHI, and provide notice of privacy practices to patients. The rule also requires that health plans and health care providers obtain authorization before disclosing PHI, except in certain circumstances. The American Bar Association (ABA) and the Health Care Compliance Association (HCCA) have provided guidance on the implementation of the Privacy Rule. The National Committee for Quality Assurance (NCQA) and the Joint Commission have also developed standards for the implementation of the rule.

HIPAA Security Rule

The HIPAA Security Rule is another key component of the law, and requires that health plans and health care providers implement administrative, technical, and physical safeguards to protect electronic protected health information (ePHI). The rule requires that health plans and health care providers conduct a risk analysis to identify potential security threats, and implement policies and procedures to mitigate those threats. The rule also requires that health plans and health care providers provide training to workforce members on security policies and procedures. The National Institute of Standards and Technology (NIST) and the Office of the National Coordinator for Health Information Technology (ONC) have developed guidelines and standards for the implementation of the Security Rule. The College of Healthcare Information Management Executives (CHIME) and the Healthcare Information and Management Systems Society (HIMSS) have also provided guidance on the implementation of the rule.

Category:United States federal healthcare legislation