For the first time, the federal government has established a set of criteria for protecting certain health information. The Secretary of HHS must make public guidelines exchange, in accordance with Sections 261 through 264 of HIPAA. Together, these are known as the Administrative Simplification provisions.

There are restrictions and constraints placed on the uses and disclosures of an individual's protected health information that cannot be made without the consent of the individual, as outlined in the Rule. Individuals have the right to access and get a copy of their health records, to have a covered entity provide a third party with an electronic copy of their protected health information included in an electronic health record, and to have any inaccurate information corrected.

Protected health information (PHI) is information about an individual's health that may be used or disclosed by covered entities. The term "covered entities" is used to refer to these people and businesses.Individuals' rights to know and regulate the uses of their health information are likewise spelled out in the Privacy Rule's criteria.

History of Laws and Regulations

Public Law 104-191 (HIPAA) was signed into law on August 21, 1996, establishing standards for the interoperability of health information between different insurance providers. The HIPAA mandates that the Secretary of HHS make available guidelines for the electronic interchange, privacy, and security of health information (Sections 261-264). The term "Administrative Simplification provisions" describes the whole package.

On August 14, 2002, the revised version appeared online for anyone to see. 3 45 CFR Parts 160 and 164, Subparts A and E contain the combined text of the final regulation and the revisions.

Who Must Follow the Privacy Regulations

To clarify, "covered entities" include health plans, health care clearinghouses, and any health care provider that transmits health information electronically. This includes both the Privacy Rule and all of the Administrative Simplification rules. Use CMS's coverage calculator to learn more about your options.

Medical Insurance. Covered entities include healthcare providers and insurers, individually and collectively. 4 Long-term care insurance, Medicare, Medicaid, Medicare+Choice, and Medicare supplement insurance are all considered to be types of health plans Group health insurance plans provided by employers, government or religious organisations, and multi-employer health insurance pools are all types of health plans. With few exclusions, only the employer who established and managed a group health plan with less than 50 participants is considered a covered entity.

Health plans do not include (1) government-funded programmes whose primary purpose is not providing or paying for health care (such as the food stamps programme) and (2) government-funded programmes whose primary activity is directly providing health care (such as a community health centre) or making grants to fund the direct provision of health care. Aside from workers' compensation, auto, and property and casualty insurers, other insurance providers have not considered health plans. As long as the insurance company has a health plan as one of its distinct lines of business, it must comply with HIPAA.

Privacy Rule applies to any health care provider that electronically communicates patient information, whether the provider does so directly or employs a billing agency or third party to do so on its behalf. As defined by Medicare, "providers of services" include institutions like hospitals, while "providers of medical or health services" include non-institutional providers like doctors, dentists, and other practitioners.

Partners in Business

Relationship Defined Between Business Partners. Business associates are any person or to the covered entity that involves the use or disclosure of individually identifiable health information. Claims handling, data analysis, utilisation review, and billing are all examples of business associate operations or activities performed on behalf of a covered organisation

The Meaning of a Business Partner. Whoever, other than an employee of the covered entity, performs certain functions or activities on its behalf, or provides certain services to it, and does so in a way that involves the use or disclosure of individually identifiable health information, is considered a business associate of the covered entity. Claims processing, data analysis, usage review, and billing are all examples of business associate operations or activities carried out on behalf of a covered organisation.

However, individuals or entities are not considered business associates if the performance of their duties or provision of their services does not necessitate the use or disclosure of protected health information and where the aforementioned individuals' or entities' access to such information is minimal at best. A business associate of one covered entity can be another covered entity.