Health Insurance Portability and Accountability Act (HIPAA)

Health Insurance Portability and Accountability Act (HIPAA)
Shorttitle	Health Insurance Portability and Accountability Act of 1996
Longtitle	An Act to amend the Internal Revenue Code of 1986 to improve portability and continuity of health insurance coverage in the group and individual markets, to combat waste, fraud, and abuse in health insurance and health care delivery, to promote the use of medical savings accounts, to improve access to long-term care services and coverage, to simplify the administration of health insurance, and for other purposes
Enactedby	103rd United States Congress
Citations	Pub.L. 104–191
Effective	August 21, 1996
Introducedby	Bill Thomas

Health Insurance Portability and Accountability Act (HIPAA) is a federal law that was enacted to improve the portability and continuity of health insurance coverage in the United States, particularly in the group health plan and individual health insurance markets, as well as to combat waste, fraud, and abuse in health care delivery, and to promote the use of medical savings accounts, as advocated by Newt Gingrich and Bob Dole. The law was signed by President Bill Clinton on August 21, 1996, and is administered by the United States Department of Health and Human Services (HHS), in conjunction with the United States Department of Labor and the United States Department of the Treasury. The implementation of HIPAA has been influenced by various stakeholders, including the American Medical Association (AMA), the American Hospital Association (AHA), and the Blue Cross and Blue Shield Association.

Introduction to HIPAA

The Health Insurance Portability and Accountability Act (HIPAA) is a comprehensive federal law that aims to protect the privacy and security of protected health information (PHI) and to promote the efficient and secure exchange of health information, as facilitated by the National Committee for Quality Assurance (NCQA) and the Joint Commission. HIPAA applies to covered entities, including health care providers, health plans, and health care clearinghouses, such as UnitedHealth Group, Kaiser Permanente, and Aetna Inc.. The law also applies to business associates of covered entities, such as medical billing companies and health information exchanges, including the National Health Information Network (NHIN) and the Health Information Trust Alliance (HITRUST). The implementation of HIPAA has been supported by various organizations, including the American Health Information Management Association (AHIMA) and the Healthcare Information and Management Systems Society (HIMSS).

History and Enactment

The Health Insurance Portability and Accountability Act (HIPAA) was enacted on August 21, 1996, as a result of efforts by Congress to improve the portability and continuity of health insurance coverage, as advocated by Senator Ted Kennedy and Representative John Dingell. The law was signed by President Bill Clinton and is considered a major achievement of the 103rd United States Congress, which also passed the North American Free Trade Agreement (NAFTA) and the Violent Crime Control and Law Enforcement Act. The enactment of HIPAA was influenced by various stakeholders, including the American Academy of Family Physicians (AAFP), the American College of Physicians (ACP), and the National Association of Social Workers (NASW). The law has been amended several times, including by the Health Information Technology for Economic and Clinical Health Act (HITECH) of 2009, which was signed into law by President Barack Obama as part of the American Recovery and Reinvestment Act.

Key Provisions and Regulations

The Health Insurance Portability and Accountability Act (HIPAA) includes several key provisions and regulations, including the portability of health insurance coverage, the pre-existing condition exclusion, and the guaranteed renewability of health insurance coverage, as outlined by the National Association of Insurance Commissioners (NAIC) and the Centers for Medicare and Medicaid Services (CMS). The law also includes regulations related to the privacy and security of protected health information, including the Privacy Rule and the Security Rule, which are enforced by the Office for Civil Rights (OCR) and the Office of the National Coordinator for Health Information Technology (ONC). The implementation of HIPAA has been supported by various organizations, including the American Bar Association (ABA) and the Health Care Compliance Association (HCCA).

Privacy and Security Rules

The Privacy Rule and Security Rule are two of the most important regulations under the Health Insurance Portability and Accountability Act (HIPAA), as they protect the privacy and security of protected health information, including electronic protected health information (ePHI), as defined by the National Institute of Standards and Technology (NIST) and the Office of the National Coordinator for Health Information Technology (ONC). The Privacy Rule applies to all covered entities and business associates, and requires them to implement policies and procedures to protect the privacy of protected health information, as outlined by the American Health Information Management Association (AHIMA) and the Healthcare Information and Management Systems Society (HIMSS). The Security Rule applies to all covered entities and business associates that create, receive, maintain, or transmit electronic protected health information, and requires them to implement administrative, technical, and physical safeguards to protect the security of ePHI, as recommended by the National Institute of Standards and Technology (NIST) and the SANS Institute.

Enforcement and Penalties

The Health Insurance Portability and Accountability Act (HIPAA) is enforced by the Office for Civil Rights (OCR) and the Office of the National Coordinator for Health Information Technology (ONC), which are responsible for investigating complaints and imposing penalties for noncompliance, as authorized by the Social Security Act and the Federal Trade Commission Act. The penalties for noncompliance with HIPAA can be significant, including fines of up to $50,000 per violation, as well as imprisonment for up to one year, as specified by the United States Code and the Federal Sentencing Guidelines. The enforcement of HIPAA has been supported by various organizations, including the American Medical Association (AMA) and the American Hospital Association (AHA).

Impact and Criticisms

The Health Insurance Portability and Accountability Act (HIPAA) has had a significant impact on the healthcare industry, including the improvement of portability and continuity of health insurance coverage, as well as the promotion of the efficient and secure exchange of health information, as facilitated by the National Committee for Quality Assurance (NCQA) and the Joint Commission. However, the law has also been criticized for its complexity and burden on covered entities and business associates, as well as its limitations in protecting the privacy and security of protected health information, as noted by the Government Accountability Office (GAO) and the Congressional Budget Office (CBO). The implementation of HIPAA has been influenced by various stakeholders, including the American Academy of Family Physicians (AAFP), the American College of Physicians (ACP), and the National Association of Social Workers (NASW). Despite these criticisms, HIPAA remains an important federal law that protects the privacy and security of protected health information, as advocated by Senator Patrick Leahy and Representative Henry Waxman.

Category:United States federal healthcare legislation