The HIPAA Act of 1996 required the Secretary of the U.S. Department of Health and Human Services (HHS) to develop regulations protecting the privacy and security of certain health information. To fulfill this requirement, HHS published what are commonly known as the HIPAA Privacy Rule and the HIPAA Security Rule. The Privacy Rule, or Standards for Privacy of Individually Identifiable Health Information, establishes national standards for the protection of certain health information. The Security Standards for the Protection of Electronic Protected Health Information (the Security Rule) establish a national set of security standards for protecting certain health information that is held or transferred in electronic form. The Security Rule operationalizes the protections contained in the Privacy Rule by addressing the technical and non-technical safeguards that organizations called "covered entities" must put in place to secure individuals' "electronic protected health information" (e-PHI). Within HHS, the Office for Civil Rights (OCR) has responsibility for enforcing the Privacy and Security Rules with voluntary compliance activities and civil money penalties.
Name: Health Insurance Portability and Accountability Act
Short Name: HIPAA
Effective Date: August 21, 1996
Region | State : CA, US
HIPAA is applicable primarily to industries and organizations that handle protected health information, Here are the key types of industries and entities that HIPAA applies to: Healthcare Providers, Health Plans, Business Associates, Healthcare Contractors, Telemedicine and Health Tech Companies, Pharmaceutical Companies and Clinical Research Organizations, Employers.
SNoRightsDescriptionAlso Referred as Section 1 Right to Notice of Privacy PracticesEach covered entity must provide a notice of its privacy practices that tells how they may use and share Individual’s health information. It must also include Individual’s health privacy rights. In most cases, Individuals should receive the notice on their first visit to a provider or in the mail from their health plan.Right to Notice45 C.F.R. §§ 164.520(a) and (b)2Right to Receive Paper Copy of Privacy Notice
A covered health care provider with a direct treatment relationship with individuals must deliver a privacy practices notice to patients starting April 14, 2003.
Under the HIPAA Privacy Rule, individuals have the right to receive a paper copy of their Notice of Privacy Practices (NPP). The NPP is a document that explains how a covered entity (CE) may use and share your protected health information (PHI). CEs are required to provide a copy of their NPP to you at the time of your first appointment or service, or upon request.
45 C.F.R. § 164.520(c).3Right to AccessIndividuals have the right to review and obtain a copy of their protected health information in a covered entity's designated record set.The "designated record set" is that group of records maintained by or for a covered entity that is used, in whole or part, to make decisions about individuals, or that is a provider's medical and billing records about individuals or a health plan's enrollment, payment, claims adjudication, and case or medical management record systems.Right to KnowRight to Information45 C.F.R. § 164.520(c).4Right to AmendmentThe Rule gives individuals the right to have covered entities amend their protected health information in a designated record set when that information is inaccurate or incomplete.Right to Rectification45 C.F.R. § 164.526.5Right to Disclosure AccountingIndividuals have a right to an accounting of the disclosures of their protected health information by a covered entity or the covered entity's business associates. The maximum disclosure accounting period is the six years immediately preceding the accounting request, except a covered entity is not obligated to account for any disclosure made before its Privacy Rule compliance date.45 C.F.R. § 164.5286Right to Authorization for Use or DisclosureA covered entity must obtain the individual’s written authorization for any use or disclosure of protected health information that is not for treatment, payment or health care operations or otherwise permitted or required by the Privacy Rule.45 C.F.R. § 164.5087Right to Restrict Use or DisclosureIndividuals have the right to request that a covered entity restrict use or disclosure of protected health information for treatment, payment or health care operations, disclosure to persons involved in the individual's health care or payment for health care, or disclosure to notify family members or others about the individual's general condition, location, or death. A covered entity is under no obligation to agree to requests for restrictions.Restriction Request45 C.F.R. § 164.522(a)8Right to Review Denial Access
For information included within the right of access, covered entities may deny an individual access in certain specified situations, such as when a health care professional believes access could cause harm to the individual or another. In such situations, the individual must be given the right to have such denials reviewed by a licensed health care professional for a second opinion.
Covered entities may impose reasonable, cost-based fees for the cost of copying and postage.
9Right to file a complaintA person who believes a covered entity or business associate is not complying with the administrative simplification provisions may file a complaint to the U.S. Dept. of Health and Human Services (HHS), Office of Civil Rights (OCR).1 45 C.F.R. § 164.530(d).10Right to Request Confidential CommunicationHealth plans and covered health care providers must permit individuals to request an alternative means or location for receiving communications of protected health information by means other than those that the covered entity typically employs. For example, an individual may request that the provider communicate with the individual through a designated address or phone number. Similarly, an individual may request that the provider send communications in a closed envelope rather than a post card. 45 C.F.R. § 164.522(b).
These are not Rights but HIPAA Privacy Rule requirements that must be accomplished by the Company (aka Covered Entity)Privacy Policies and ProceduresA covered entity must develop and implement written privacy policies and procedures that are consistent with the Privacy Rule.
