The Health Insurance Portability and Accountability Act of 1996 (HIPAA or the Kennedy–Kassebaum Act) is a United States Act of Congress enacted by the 104th United States Congress and signed into law by President Bill Clinton on August 21, 1996. It aimed to alter the transfer of healthcare information and stipulated guidelines by which personally identifiable information maintained by the healthcare and healthcare insurance industries should be protected from fraud and theft, and addressed some limitations on healthcare insurance coverage. It generally prohibits healthcare providers and businesses called covered entities from disclosing protected information to anyone other than a patient and the patient's authorized representatives without their consent. The law does not restrict patients from accessing their own information, except in limited cases. Furthermore, it does not prohibit patients from voluntarily sharing their health information however they choose, nor does it require confidentiality where a patient discloses medical information to family members, friends, or other individuals not employees of a covered entity.
The act consists of five titles:
Title I protects health insurance coverage for workers and their families if they change or lose their jobs. Title II, known as the Administrative Simplification (AS) provisions, requires the establishment of national standards for electronic health care transactions and national identifiers for providers, health insurance plans, and employers. Title III sets guidelines for pre-tax medical spending accounts. Title IV sets guidelines for group health plans. Title V governs company-owned life insurance policies.
Titles There are five sections to the act, known as titles.
Title I: Health Care Access, Portability, and Renewability Title I of HIPAA regulates the availability and breadth of group health plans and certain individual health insurance policies. It amended the Employee Retirement Income Security Act, the Public Health Service Act, and the Internal Revenue Code. Title I also addresses the issue of "job lock," where employees remain in a job to avoid losing health coverage. To combat the job lock issue, the Title protects health insurance coverage for workers and their families if they lose or change their jobs.
Title I requires the coverage of and limits restrictions that a group health plan can place on benefits for preexisting conditions. Group health plans may refuse to provide benefits in relation to preexisting conditions for either 12 months following enrollment in the plan or 18 months in the case of late enrollment. Title I allows individuals to reduce the exclusion period by the amount of time they have had "creditable coverage" before enrolling in the plan and after any "significant breaks" in coverage. "Creditable coverage" includes nearly all group and individual health plans, Medicare, and Medicaid. A "significant break" in coverage is defined as any 63-day period without any creditable coverage. Along with an exception, it allows employers to tie premiums or co-payments to tobacco use or body mass index (BMI).
Title I mandates that insurance providers issue policies without exclusions to individuals leaving group health plans, provided they have maintained continuous, creditable coverage (see above) exceeding 18 months,(Sub B Sec 111) and renew individual policies for as long as they are offered or provide alternatives to discontinued plans for as long as the insurer stays in the market without exclusion regardless of health condition.
Some health care plans are exempted from Title I requirements, such as long-term health plans and limited-scope plans like dental or vision plans offered separately from the general health plan. However, if such benefits are part of the general health plan, then HIPAA still applies to such benefits. For example, if the new plan offers dental benefits, then creditable continuous coverage under the old health plan must be counted towards any of its exclusion periods for dental benefits.
An alternate method of calculating creditable continuous coverage is available to the health plan under Title I. 5 categories of health coverage can be considered separately, including dental and vision coverage. Anything not under those 5 categories must use the general calculation (e.g., the beneficiary may be counted with 18 months of general coverage but only 6 months of dental coverage because the beneficiary did not have a general health plan that covered dental until 6 months prior to the application date). Since limited-coverage plans are exempt from HIPAA requirements, the odd case exists in which the applicant to a general group health plan cannot obtain certificates of creditable continuous coverage for independent limited-scope plans, such as dental, to apply towards exclusion periods of the new plan that does include those coverages.
Hidden exclusion periods are invalid under Title I. For example: ‘The accident must have occurred while the beneficiary was covered under this same health insurance contract. Such clauses must not be acted upon by the health plan. Also, they must be re-written to comply with HIPAA.
Title II: Preventing Health Care Fraud and Abuse; Administrative Simplification; Medical Liability Reform
Title II of HIPAA establishes policies and procedures for maintaining the privacy and the security of individually identifiable health information, outlines numerous offenses relating to health care, and establishes civil and criminal penalties for violations. It also creates several programs to control fraud and abuse within the health care system. The most significant provisions of Title II are the Administrative Simplification rules. Title II requires the Department of Health and Human Services (HHS) to increase the efficiency of the health-care system by creating standards for the use and dissemination of health care information.
These rules apply to "covered entities" as defined by HIPAA and the HHS. Covered entities include health plans, health care clearinghouses (e.g., billing services and community health information systems), and health care providers that transmit health care data in a way regulated by HIPAA.
Per the requirements of Title II, the HHS has promulgated five rules regarding Administrative Simplification: the Privacy Rule, the Transactions and Code Sets Rule, the Security Rule, the Unique Identifiers Rule, and the Enforcement Rule.
Privacy Rule
The HIPAA Privacy Rule is composed of national regulations for the use and disclosure of Protected Health Information (PHI) in healthcare treatment, payment and operations by "covered entities" (generally, health care clearinghouses, employer-sponsored health plans, health insurers, and medical service providers that engage in certain transactions).Terry, Ken "Patient Privacy - The New Threats" Physicians Practice journal, volume 19, number 3, year 2009, access date July 2, 2009
The Privacy Rule came into effect on April 14, 2003, with a one-year extension for certain "small plans". By regulation, the HHS extended the HIPAA privacy rule to independent contractors of covered entities who fit within the definition of "business associates".See 45 CFR Sections 160.102 and 160.103 . PHI is any information that is held by a covered entity regarding health status, provision of health care, or health care payment that can be linked to any individual. This includes any part of an individual's medical record or payment history. Covered entities must disclose PHI to the individual within 30 days upon request. They must also disclose PHI when required to do so by law, such as reporting suspected child abuse to state child welfare agencies.
Covered entities may disclose protected health information to law enforcement officials for law enforcement purposes as required by law (including court orders, court-ordered warrants, and subpoenas) and administrative requests or to identify or locate a suspect, a fugitive, a material witness, or a missing person.
A covered entity may disclose PHI to certain parties to facilitate treatment, payment, or health care operations without a patient's express written authorization. Any other disclosures of PHI require the covered entity to obtain written authorization from the individual for disclosure. In any case, when a covered entity discloses any PHI, it must make a reasonable effort to disclose only the minimum necessary information required to achieve its purpose.
The Privacy Rule gives individuals the right to request that a covered entity correct any inaccurate PHI. It also requires covered entities to take reasonable steps on ensuring the confidentiality of communications with individuals. For example, an individual can ask to be called at their work number instead of home or cell phone numbers.
The Privacy Rule requires covered entities to notify individuals of the use of their PHI. Covered entities must also keep track of disclosures of PHI and document privacy policies and procedures. They must appoint a Privacy Official and a contact person responsible for receiving complaints and train all members of their workforce in procedures regarding PHI.
Individuals who believe that the Privacy Rule is not being upheld can file a complaint with the Department of Health and Human Services Office for Civil Rights (OCR). In 2006, the Wall Street Journal reported that the OCR had a long backlog and ignored most complaints. "Complaints of privacy violations have been piling up at the Department of Health and Human Services. Between April of 2003 and November 2006, the agency fielded 23,886 complaints related to medical-privacy rules, but it has not yet taken any enforcement actions against hospitals, doctors, insurers or anyone else for rule violations. A spokesman for the agency says it has closed three-quarters of the complaints, typically because it found no violation or after it provided informal guidance to the parties involved.""Spread of records stirs fears of privacy erosion" , December 23, 2006, by Theo Francis, The Wall Street Journal However, in July 2011, the University of California, Los Angeles, agreed to pay $865,500 in a settlement regarding potential HIPAA violations. An HHS Office for Civil Rights investigation showed that from 2005 to 2008, unauthorized employees repeatedly and without legitimate cause looked at the electronic protected health information of numerous UCLAHS patients.
It is a misconception that the Privacy Rule creates a right for any individual to refuse to disclose any health information (such as chronic conditions or immunization records) if requested by an employer or business. HIPAA Privacy Rule requirements merely place restrictions on disclosure by covered entities and their business associates without the consent of the individual whose records are being requested; they do not place any restrictions upon requesting health information directly from the subject of that information.
2013 Final Omnibus Rule update In January 2013, HIPAA was updated via the Final Omnibus Rule. The updates included changes to the Security Rule and Breach Notification portions of the HITECH Act. The most significant changes related to the expansion of requirements to include business associates, where only covered entities had originally been held to uphold these sections of the law.
In addition, the definition of "significant harm" to an individual in the analysis of a breach was updated to provide more scrutiny to covered entities with the intent of disclosing unreported breaches. Previously, an organization needed proof that harm had occurred, whereas now organizations must prove that harm had not occurred.
Protection of PHI was changed from indefinite to 50 years after death. More severe penalties for violation of PHI privacy requirements were also approved.Health Information of Deceased Individuals 2013