HIPAA Qualifications

Almost anyone who has received any kind of health care service since April 2003 has been affected in some way by HIPAA, the Health Insurance Portability and Accountability Act of 1996. The goal of HIPAA is to insure patient privacy while helping health care entities to share information necessary for quality care and protecting the public. Regulations within the act define what information is protected and how it can be shared.

Who Must Comply

• All kinds of health care professionals are covered under HIPAA.

  HIPAA applies to all health care providers who transmit health information in electronic form, health care plans and health care clearinghouses.

  Health care providers include doctors, dentists, nurse practitioners, chiropractors and any others who provide and are paid for health care services or supplies, as well as hospitals, clinics and other institutions that provide health care services. In today's electronic world, you are unlikely to find providers who do not use computers or the Internet to store and transmit health care information, or who do not fax the information once it is in an electronic form.

  Health care plans include insurance companies, including health, dental, vision, prescription drug and life; HMOs and PPOs; the company staff member who administers employee health benefits; government health programs, such as Medicare and Medicaid; and anyone involved in health care payments.

  Health care clearinghouses include medical transcription, medical billing and associated services.

Protected Information Defined

• HIPAA states that any information that can identify a specific patient is protected. Physical and mental history, current or future treatment plans and all payment information is covered. General information that has been stripped of identifying information is not covered.

Release of Information

• Health care providers need written permission to release protected information to anyone except the patient or his legal representative. Exceptions include certain legal investigations and compliance investigations or reviews.

Patient Rights Notification

• Patients must be notified of their rights in writing at the first visit with a new care provider. Health care providers must post patient rights where they are visible to patients, such as in treatment rooms, waiting areas and business offices. In an emergency treatment situation, the health care provider must give the patient HIPAA information as soon as possible after giving emergency care.

Compliance in the Health Care Office

• Each health care provider or agency must have written policies describing how it complies with HIPAA. It must have printed HIPAA information and authorization release forms, a designated HIPAA compliance officer, HIPAA compliance staff training and safeguards for patient information, and it must provide information on filing a HIPAA violations complaint.

Reporting Violations

• Patients have 180 days to file a HIPAA complaint with their local U.S. Dept. of Health and Human Services Office for Civil Rights; complaint packets are available on the department website. You must file in writing and specifically name the person you believe violated HIPAA.