What is HIPAA? What are the benefits of HIPAA? How are standards in health care information helpful in improving health care? Who is affected by HIPAA? What does HIPAA mean for patients? What does HIPAA mean for staff? What are the boundaries on medical records and health information? What does HIPAA require for the protection of health care data? What is the impact of HIPAA on Information Technology? What are the penalties for non-compliance and who can be held liable? Where can I get the latest information on HIPAA?
How will WRNMMC’s patients be affected by the Privacy regulation? How are providers affected by the Privacy regulation? What is considered PHI under HIPAA? What is Individually Identifiable Health Information?
Why have national standards for electronic health care transactions been adopted and why are they required? What health care transactions are required to use the standards under this regulation? What are the benefits of HIPAA transactions? What is a code set?
What is HIPAA?
HIPAA is The Health Insurance Portability & Accountability Act of 1996. It has four main goals:
Specifically, the Administrative Simplification or Title II provision of HIPAA mandates regulations in four areas:
Although some of WRNMMC’s practices will change as a result of the HIPAA regulations, in many cases these new regulations contain provisions that were already required by state law or were already a part of professional practice.
TOP
What are the benefits of HIPAA?
HIPAA was designed to provide many benefits to the health care industry. Some of HIPAA’s immediate benefits include:
How are standards in health care information helpful in improving health care?
HIPAA standards will improve the health care system, and ultimately, benefit patients. By standardizing the electronic transmission formats and data elements used in health care data exchange there will be new opportunities to:
Who is affected by HIPAA?
HIPAA affects health care providers, but also the majority of their vendors and business partners. Specifically, Covered Entities must comply with the HIPAA regulations and they are defined as:
Providers – Providers who exchange claims electronically, e.g., physicians, MTFs, dental clinics, pharmacies Health plans – e.g., TRICARE Clearinghouses – e.g., companies that perform electronic billing, claims repricing Business Associates – e.g., managed care support contractors, vendors, consultants and others – Although not specifically Covered Entities, they are also impacted by the HIPAA regulations.
What does HIPAA mean for patients?
What does HIPAA mean for staff?
What are the boundaries on medical records and health information?
With few exceptions, such as appropriate law enforcement or public interest needs, patients’ PHI may only be used for treatment, payment and health care operations (TPO).
Health information covered by HIPAA generally may not be used for purposes not related to health care, such as:
What does HIPAA require for the protection of health care data?
Security risk assessment, management, mitigation in four categories:
Administrative Procedures and Physical Safeguards such as:
Technical Security Services and Technical Security Mechanisms such as:
What is the impact of HIPAA on Information Technology?
Information Technology is a key enabler of the business process for most health care organizations, and, for the most part, this role will continue under HIPAA.
More true now than ever before, emphasis will be placed on IT for adherence to HIPAA regulations. IT may get the role of "watchdog," the failsafe that ensures a certain level of compliance, even if rote process is breached. In addition, some specific new responsibilities will fall on ITS. In particular:
The media's portrayal of Hackers may now alight upon the patient recollection as they are "Mirandized" with the new security and privacy portion of the admissions process.
What are the penalties for non-compliance and who can be held liable?
For unintentional violation of the HIPAA regulations, the Department of Health & Human Services can levy:
A fine of $100 per violation and a maximum of $25,000 per year
For intentional violation of the HIPAA regulations, the Department of Justice can levy:
Penalties may apply to the individual violator but they may also apply to the organization or even to its officers.
Where can I get the latest information on HIPAA?
For the complete HIPAA regulations, visit the Department of Health and Human Services.
To learn more about HIPAA insurance reform or HIPAA administrative simplification, visit Center for Medicare & Medicaid Services (CMS).
To learn more about what the Navy and TMA is doing to comply with HIPAA requirements, visit the TMA HIPAA site.
The WorkGroup for Electronic Data Interchange provides information and white papers on Transactions, Security and Privacy.
Questions about HIPAA regulatory compliance (transactions, code sets, national identifiers, and security) can be directed to the Centers for Medicare and Medicaid (CMS) at 410-786-4232 (local) or 1-866-282-0659 (toll-free).
How will WRNMMC’s patients be affected by the Privacy regulation?
The Privacy regulation supports WRNMMC's commitment to keep patient information confidential. New patient rights were created, which include accessing and amending health information as well as filing complaints about privacy issues.
The NPP must include the following:
How are providers affected by the Privacy regulation?
All providers, regardless of how Protected Health Information (PHI) is transmitted, are required to comply with the privacy regulation.
What is considered PHI under HIPAA?
The privacy regulations cover all Individually Identifiable Health Information that is transmitted or maintained on paper, in an electronic format, or in a verbal medium.
Examples of PHI elements are:
What is Individually Identifiable Health Information?
Why have national standards for electronic health care transactions been adopted and why are they required?
Congress and the health care industry have agreed that standards for the electronic exchange of administrative and financial health care transactions are needed to improve the efficiency and effectiveness of the health care system. National standards for electronic health care transactions will encourage electronic commerce in the health care industry and ultimately simplify the processes involved. This will result in savings from the reduction in administrative burdens on health care providers and health plans.
Today, health care providers and health plans that conduct business electronically must use many different formats for electronic transactions. For example, about 400 different formats exist today for health care claims. With a national standard for electronic claims and other transactions, health care providers will be able to submit the same transaction to any health plan in the United States and the health plan must accept it. Health plans will be able to send standard electronic transactions such as remittance advices and referral authorizations to health care providers. These national standards will make electronic data interchange a viable and preferable alternative to paper processing for providers and health plans alike.
What health care transactions are required to use the standards under this regulation?
As required by HIPAA, DHHS is adopting standards for the following administrative and financial health care transactions:
Standards for the first report of injury and claims attachments (also required by HIPAA) will be adopted at a later date.
What are the benefits of HIPAA Transactions?
What is a code set?
Codes to identify various diseases/injuries/impairments, inpatient and outpatient procedures, drugs/biologics, and medical supplies such as orthotics, prosthetics, durable medical equipment and dental services are included under HIPAA.