Health Insurance Portability and Accountability Act

Function

Functions of HIPAA

When enacting HIPAA, Congress established federal standards to ensure the security of electronic PHI (ePHI), thereby safeguarding the confidentiality, integrity, and availability of health information. This law protects individuals' health information while allowing authorized access for healthcare providers, clearinghouses, and healthcare plans to facilitate continued medical care.[5][6][7]

The rise in ePHI exchange has necessitated robust security standards to safeguard sensitive health information while ensuring proper access for healthcare-related entities, as mentioned below.

• Security standards became essential due to the increasing exchange of PHI between covered and non-covered entities. These standards ensure the availability, integrity, and confidentiality of ePHI. Additionally, state laws with stricter guidelines may overrule federal security guidelines.

• The Federal Security Rule mandates standards that protect individuals' health information while allowing authorized access by healthcare providers, clearinghouses, and health insurance plans. The Federal Security Rule establishes federal standards to ensure the availability, confidentiality, and integrity of ePHI. In some cases, state laws with stricter requirements may take precedence over these federal standards.

• Healthcare providers, healthcare plans, and business associates have a longstanding commitment to safeguarding private health information. However, traditional methods, such as securing paper records in locked cabinets, are no longer sufficient in the digital age. As information is increasingly stored and transmitted electronically, the Federal Security Rule establishes clear national standards to protect ePHI.[8][9]

Issues of Concern

There are 5 sections of the HIPAA Act, also referred to as "Titles," as outlined below.[10][11][12][13]

Title I. Focus on Healthcare Access, Portability, and Renewability

• Regulates the availability of group and individual health insurance policies. Title I amended the Employee Retirement Income Security Act, the Public Health Service Act, and the Internal Revenue Code.

• Requires coverage and limits the restrictions that a group healthcare plan can impose on benefits for preexisting conditions. Specifically, group healthcare plans can only deny benefits related to preexisting conditions for up to 12 months after enrollment or 18 months for late enrollment.

• Allows individuals to shorten the exclusion period based on the duration of their previous coverage before enrolling in a new plan, taking into account any breaks in coverage.

• Includes "creditable coverage," which applies to most group and individual healthcare plans, as well as Medicare and Medicaid.

• Defines a "significant break" as any 63 consecutive days without creditable coverage. This also permits premiums based on factors such as body mass index or tobacco use avoidance.

• Requires insurers to issue policies without exclusions to individuals leaving group healthcare plans with creditable coverage exceeding 18 months. Title I also mandates insurers to renew individual policies as long as they are offered or provide alternatives to discontinued plans, without exclusions, as long as the insurer remains in the market, regardless of the individual's health condition.

Title II. Preventing Healthcare Fraud and Abuse; Administrative Simplification; Medical Liability Reform

• Establishes policies and procedures for maintaining the privacy and security of individually identifiable health information, outlines offenses, and creates civil and criminal penalties for violations.

• Introduces programs to control fraud and abuse, along with Administrative Simplification rules.

• Requires the Department of Health and Human Services to enhance the efficiency of the healthcare system by establishing standards.

The Department of Health and Human Services implemented the following 5 rules to enforce Administrative Simplification:

• Privacy Rule
• Transactions and Code Sets Rule
• Security Rule
• Unique Identifiers Rule
• Enforcement Rule

Privacy Rule

The HIPAA Privacy Rule governs the use and disclosure of PHI by "covered entities," which include healthcare clearinghouses, health insurers, employer-sponsored healthcare plans, and medical providers. Covered entities are required to disclose PHI to an individual upon request within 30 days. Additionally, these entities must provide and disclose PHI as mandated by law enforcement, such as for investigating suspected child abuse.

• Covered entities may disclose PHI to law enforcement upon receiving court orders, subpoenas, or administrative requests.

• A covered entity may reveal PHI to facilitate treatment, payment, or healthcare operations without requiring the patient's written authorization.

• Any other disclosures of PHI require the covered entity to obtain the individual's prior written authorization.

• When a covered entity discloses PHI, it must make a reasonable effort to disclose only the minimum amount of information necessary.

• The Privacy Rule grants individuals the right to request corrections to any inaccurate PHI and requires covered entities to take reasonable steps to ensure the confidentiality of communications with individuals.

• The Privacy Rule requires covered entities to notify individuals of PHI use, keep track of disclosures, and document privacy policies and procedures.

2013 Omnibus Rule update: The revised definition of "significant harm" to an individual in breach analysis requires a more comprehensive investigation of covered entities intending to disclose breaches that were previously unreported. The protection of PHI was extended from indefinite to 50 years after an individual's death. Additionally, the HIPAA Privacy Rule may be waived during a natural disaster.

Right to access: The Privacy Rule requires medical providers to grant individuals access to their PHI upon written request. Providers must supply a copy of the requested information within 30 days. After that, individuals can request the information in electronic form or as a hard copy.

• Individuals have the right to access all health-related information, except for psychotherapy notes and information collected by a provider for legal defense purposes.

• Providers may charge a reasonable fee for copying costs, but no charge is allowed when providing data electronically from a certified electronic health record using the "view, download, and transfer" function."

• Individuals may authorize information delivery through encrypted or unencrypted email, media, direct messaging, or other methods. However, they must understand and accept the risks associated with using unencrypted methods for data transfer.

• Individuals may request that their PHI be delivered to a third party in writing.

• Individuals may request in writing that their provider send PHI to a designated service, such as a Personal Health Record application, used to collect or manage their records.

Relative disclosure: Hospitals are prohibited from disclosing information over the phone to relatives of admitted patients. This restriction has hindered efforts to locate missing persons, as seen in incidents like airline crashes, where hospitals are reluctant to reveal the identities of passengers being treated, making it challenging for relatives to find them.

Transactions and Code Sets Rule

HIPAA was created to improve the efficiency of the healthcare system by standardizing healthcare transactions. Part C of HIPAA, titled "Administrative Simplification," mandates that healthcare plans adopt standardized processes for healthcare transactions. For instance, medical providers seeking reimbursements are required to submit electronic claims that comply with HIPAA standards to receive payment.

Security Rule

This rule complements the Privacy Rule. While the Privacy Rule pertains to all PHI, the Security Rule is specific to ePHI. The Security Rule outlines 3 key security safeguards—administrative, physical, and technical.

Administrative safeguards: Policies and procedures must clearly outline how the entity will comply with the act. Covered entities are required to adopt written privacy procedures and designate a privacy officer responsible for developing and implementing necessary policies and procedures. These procedures must define the classes of employees with access to ePHI and restrict access to those who need it to perform their job functions. The procedures should cover access authorization, as well as the processes for establishing, modifying, and terminating access. Ongoing training for employees on handling PHI is essential. Additionally, covered entities must back up their data and implement disaster recovery plans. Internal audits are necessary to assess operations and identify potential security violations, with clear instructions for addressing and responding to security breaches.

Physical safeguards: Procedures must regulate physical access to protected data, including the introduction and removal of hardware and software from the network, ensuring access is limited to authorized individuals. Procedures must also control and monitor access to equipment containing PHI. Workstations must be arranged to ensure monitor screens are invisible to the public. Additionally, if covered entities employ contractors or agents, they must receive thorough training on handling PHI.

Technical safeguards: Technical safeguards include controlling access to computer systems and enabling covered entities to protect communications containing ePHI over open networks.

• Information systems storing PHI must be safeguarded against unauthorized access.

• Data within these systems must not be altered or erased without proper authorization.

• Data corroboration methods, such as checksums, double-keying, message authentication, and digital signatures, must be used to ensure data integrity and authenticate communicating entities.

• Covered entities must make their HIPAA documentation available to government authorities.

• IT documentation should include detailed records of all configuration settings for network components.

• Entities must have documented risk analysis and risk management programs in place.

Unique Identifiers Rule (National Provider Identifier)

HIPAA-covered entities, including healthcare providers engaging in electronic transactions, healthcare clearinghouses, and large healthcare plans, must use the National Provider Identifier (NPI) exclusively to identify healthcare providers in standard transactions.

The NPI replaces all other identifiers used by healthcare plans, Medicare, Medicaid, and other government programs. However, NPI does not replace a provider's DEA number, state license, or tax identification number. The NPI consists of 10 digits (which may be alphanumeric), with the last digit serving as a checksum. The NPI is devoid of any embedded intelligence and does not carry additional meaning. NPI is unique and national, never reused, and, with the exception of institutions, a provider typically has only 1 NPI. Institutions may obtain multiple NPIs for different "sub-parts," such as a free-standing surgery or wound care center. 

Enforcement Rule

• This rule imposes civil monetary penalties for violations of HIPAA regulations and establishes procedures for investigations and hearings related to such breaches.

• The US Department of Health and Human Services has investigated over 20,000 cases, often resolving them by requiring changes in privacy practices or corrective actions.

• If noncompliance is determined, entities must implement corrective measures.

• Complaints have been investigated against a wide range of organizations, including pharmacy chains, major healthcare centers, insurance groups, hospital networks, and smaller providers.

The Department of Health and Human Services has identified the following issues, ranked by frequency:

1. Misuse and improper disclosure of PHI
2. Lack of protections for health information
3. Patients denied access to their health information
4. Use or disclosure of PHI exceeding the minimum necessary
5. Inadequate safeguards for ePHI

According to the Department of Health and Human Services, the entities most commonly required to take corrective action are listed below in order of frequency: 

1. Private practices
2. Hospitals
3. Outpatient facilities
4. Group insurance plans
5. Pharmacies

Title III. Tax-Related Health Provisions Governing Medical Savings Accounts

• Standardizes the allowable pre-tax savings per person in a medical savings account.

• Extends medical savings accounts to employees covered by employer-sponsored high-deductible plans for small businesses and self-employed individuals.

Title IV. Application and Enforcement of Group Health Insurance Requirements

• Specifies conditions for group healthcare plans related to coverage for individuals with preexisting conditions and modifies continuation of coverage requirements.

• Clarifies the continuation coverage provisions and includes specific updates to COBRA regulations.

Title V. Revenue Offset Governing Tax Deductions for Employers

• Establishes provisions for company-owned life insurance, prohibiting tax deductions for interest on loans related to life insurance policies, endowments, or contracts owned by the company.

• Repeals the financial institution rules related to interest allocation.

• Amends provisions of laws related to individuals who renounce US citizenship or permanent residency, expanding the expatriation tax to apply to those considered to be giving up their US status for tax avoidance purposes.

• Publishes the names of former citizens in the public record through the creation of the Quarterly Publication of Individuals Who Have Chosen to Expatriate.

Clinical Significance

The HIPAA Privacy and Security Rules have substantially transformed the operations of medical institutions and healthcare providers. Their complex legal requirements, severe civil and financial penalties, and increased paperwork and implementation costs have significantly influenced healthcare practices. Comprehensive training in HIPAA is essential for all healthcare professionals to understand the potential risks and actions that could result in violations.[14][15]

Clinical Care Effects

HIPAA, combined with its severe penalties for violations, may cause medical centers and practices to withhold life-saving information from individuals who have a right to it and urgently need it. According to the HIPAA Privacy Rule, the US Government Accountability Office found that healthcare providers were often "uncertain about their legal privacy responsibilities" and tended to take an overly cautious approach to disclosing information. The solution lies in educating all healthcare professionals and support staff to ensure they understand when PHI can be legally shared.

Education and Training Effects

Education and training are essential for healthcare providers and students to effectively implement the HIPAA Privacy and Security Rules. Practical training and education should describe the regulatory background and purpose of HIPAA, as well as provide a comprehensive review of the principles and key provisions of the Privacy Rule.

Research Effects

HIPAA restrictions on research have affected the ability to perform chart-based retrospective studies, making it more challenging to evaluate patients prospectively for follow-up.[11][16]

• The HIPAA Privacy Rule has led to a 95% decrease in the completion of follow-up surveys by patients being monitored long-term.

• Recruitment of patients for cancer studies has resulted in a 70% decrease in patient accrual, along with a tripling of the time spent on recruitment and an increase in mean recruitment costs.

• The legal language required for research studies has become extensive due to the need to protect participants' health information. While such information is crucial, the lengthy legal sections can make these complex documents less user-friendly for those required to read and sign them.

Many researchers believe that HIPAA privacy laws negatively impact the cost and quality of medical research.[7]

Costs

The HIPAA Privacy and Security Acts mandate that all medical centers and practices comply with their provisions. The costs associated with developing and updating systems, increasing paperwork, and dedicating time to staff education have significantly impacted the finances of medical centers and practices, especially as reimbursements from insurance companies and Medicare have decreased. Ultimately, the potential costs of violating the statutes are so substantial that institutions must allocate scarce resources to ensure compliance and to educate employees on the statutory rules.

Conclusions

HIPAA presents a significant risk of violations that almost any medical professional can inadvertently commit. Staff with limited education and understanding are particularly prone to breaching these rules during routine tasks. While only a small percentage of violations involve personal gain or curiosity, the majority result from momentary lapses that lead to costly mistakes. Simple errors, such as writing an incorrect address, phone number, or email on a form or inadvertently disclosing protected information aloud, can put a practice at risk. HIPAA education and training are essential, as is the design and maintenance of systems that minimize human errors and ensure compliance.[17][18][19]

Other Issues

Violations of HIPAA

Civil violations

• For an individual who unknowingly violates HIPAA, there is a $100 fine per violation, with an annual maximum of $25,000 for repeated violations.

• For a violation due to reasonable cause and not willful neglect, the penalty is $1000 per violation, with an annual maximum of $100,000 for repeated violations. 

• For violations due to willful neglect, where the violation is corrected within the required period, the penalty is $10,000 per violation, with an annual maximum of $250,000 for repeated violations.

• For a HIPAA violation due to willful neglect that is not corrected, the penalty is $50,000 per violation, with an annual maximum of $1,000,000, $50,000, or $1.5 million per violation.

Criminal violations

• For covered entities and specified individuals who willfully and knowingly obtain or disclose individually identifiable health information, the penalty is up to $50,000, with imprisonment for up to 1 year.

• For offenses committed under false pretenses, the penalty is up to $100,000, with imprisonment for up to 5 years.

• For offenses committed with the intent to sell, transfer, or use individually identifiable health information for commercial advantage, personal gain, or malicious harm, the penalty is up to $250,000, with imprisonment for up to 10 years.

The US Department of Health and Human Services—Office for Civil Rights has received over 100,000 complaints of HIPAA violations, many of which have resulted in civil and criminal prosecutions.

Examples of HIPAA violations and breaches include:

• Hospital staff disclosed a patient's HIV testing results in a waiting room, prompting a requirement for regular HIPAA training for staff and repositioning of computer monitors to ensure privacy.

• An office manager accidentally faxed confidential medical records to an employer instead of a urologist's office, resulting in a stern warning letter and mandatory HIPAA training for all employees.

• A surgeon was terminated after illegally accessing the personal records of celebrities, fined $2,000, and sentenced to 4 months in jail.

• A private practice lost an unencrypted flash drive containing PHI, resulting in a $150,000 fine and the requirement to implement a corrective action plan.

• A private physician had their license suspended for submitting a patient's bill to collection agencies with CPT codes that revealed the patient's diagnosis.

• Texas hospital employees received an 18-month jail term for the wrongful disclosure of private patient medical information.

• A Walgreens pharmacist violated HIPAA by sharing confidential information about a customer who had dated her husband, resulting in a $1.4 million HIPAA award.

• Virginia employees were terminated for accessing medical files without a legitimate medical need.

• An employee was terminated for inadvertently disclosing a pregnancy test result aloud in the back office of a medical clinic.

• A sales executive was fined $10,000 for filling out prior authorization forms and placing them in patient charts.

• A total of 6 doctors and 13 employees were terminated at UCLA for viewing the medical records of Britney Spears without a legitimate reason.

• A cardiac monitor vendor was fined $2.5 million when a laptop containing hundreds of patient medical records was stolen from a car.

• An employee was terminated at the Washington State Medical Center for improperly accessing over 600 confidential patient health records.

• A hospital employee posted on Facebook about a patient's death, stating, "She should have worn her seatbelt."

• A hospital was fined $2.2 million for allowing an ABC film crew to film two patients without their consent.

• A cardiology group was fined $200,000 for posting surgical and clinical appointments on a publicly accessible internet calendar.

• Tricare Management of Virginia exposed the confidential data of nearly 5 million individuals.

• Cignet Health of Maryland was fined $4.3 million for ignoring patient requests to obtain copies of their records and for disregarding federal officials' inquiries.

• A Virginia physician was prosecuted for sharing patient information with an employer under false pretenses.