special subjects
Confidentiality and HIPAA
Introduction
Traditionally, ethical health care has always included the need to keep patients’ medical information confidential. However, in the United States, the Health Insurance Portability and Accountability Act (HIPAA, seePub. L 104-191 (1996))) codified the responsibility of health care providers, health plans, health care clearinghouses, and their business associates who electronically transmit health and related information (eg, health records, enrollment, billing, eligibility verification). Collectively, these are covered entities under HIPAA. (See alsoU.S. Department of Health and Human Services: HIPAA for Professionals.) Key provisions of HIPAA are embodied in the following three rules (now contained in an omnibus rule), all of which are intended to protect the privacy and security of individually identifiable health information, referred to as protected health information (PHI): Privacy Rule: Sets standards for the protection of PHI and gives patients important rights with respect to their health information Security Rule: Establishes safeguards that covered entities and their business associates must implement to protect the privacy, integrity, and security of electronic PHI Breach Notification Rule: Requires covered entities to notify affected individuals, the federal government, and in some cases, the media of a breach of unsecured PHI The Office for Civil Rights in the U.S. Department of Health and Human Services enforces these three rules and provides guidance on complying with the rules. Key aspects of the Privacy Rule are elaborated below. 