|
|
| (19 intermediate revisions by 2 users not shown) |
| Line 1: |
Line 1: |
| [[File:Lab Community.jpg|left|300 px]]
| | #REDIRECT [[LII:HIPAA Compliance: An Introduction]] |
| [[LII:HIPAA Compliance - LII 007 01. What Is HIPAA?|HIPAA]] compliance is highly important in the healthcare arena. Non-compliance can result in fines and other serious consequences. But who is actually bound by this law? HIPAA is comprised of two main segments, the Privacy Rule and the Security Rule. Those who must comply are called "covered entities". According to the [[HHS]], these are: | |
| | |
| '''HIPAA Covered Entities''':
| |
| | |
| [[File:HIPAA Course Insert 1.png]]
| |
| | |
| So covered entities are doctors, clinics, hospitals, dentists, nursing homes and pharmacies that transmit data electronically, as well as health plans, insurance plans and healthcare clearinghouses.<ref name="HHSPrivacy">{{cite web |url=http://www.hhs.gov/hipaa/for-professionals/privacy/laws-regulations/index.html |title=Summary of the HIPAA Privacy Rule |publisher=U.S. Department of Health and Human Services |accessdate=8 June 2016}}</ref>
| |
| | |
| ===Healthcare Providers===
| |
| Every health care provider (regardless of size) who electronically transmits health information in connection with certain transactions, is a covered entity. These transactions include:
| |
| | |
| * Claims
| |
| * Benefit eligibility inquiries
| |
| * Referral authorization requests
| |
| * Other transactions for which HHS has established standards under the HIPAA Transactions Rule
| |
| | |
| It's important to note that using electronic technology (e.g. email) does not mean a healthcare provider is a covered entity. The transmission must be in connection with a "standard transaction".
| |
| | |
| Transactions are electronic exchanges involving the transfer of information between two parties for specific purposes. For example, a healthcare provider will send a claim to a health plan to request payment for medical services.<ref name="StandardTrans">{{cite web |url=https://www.cms.gov/Regulations-and-Guidance/HIPAA-Administrative-Simplification/TransactionCodeSetsStands/index.html?redirect=/TransactionCodeSetsStands |title=Transaction & Code Sets Standards |publisher=U.S. Centers for Medicare and Medicaid Services |accessdate=8 June 2016}}</ref>
| |
| | |
| In the HIPAA regulations, the Secretary of Health and Human Services (HHS) adopted certain standard transactions for Electronic Data Interchange (EDI) of healthcare data. These transactions are:
| |
| | |
| * Claims and encounter information
| |
| * Payment and remittance advice
| |
| * Claims status
| |
| * Eligibility, enrollment and disenrollment
| |
| * Referrals and authorizations
| |
| * Coordination of benefits and premium payment<ref name="StandardTrans" />
| |
| | |
| The standard does <u>not</u> encompass telephone voice response and fax-back systems.<ref name="TexMed">{{cite web |url=https://www.texmed.org/Template.aspx?id=1599 |title=What Are HIPAA Transaction and Code Sets Standards? |publisher=Texas Medical Association |accessdate=8 June 2016}}</ref>
| |
| | |
| The Privacy Rule covers a healthcare provider whether it electronically transmits these transactions directly or uses a billing service or other third party to do so on its behalf. Healthcare providers include all “providers of services” (e.g., institutional providers such as hospitals) and “providers of medical or health services” (e.g., non-institutional providers such as physicians, dentists and other practitioners) as defined by Medicare, and any other person or organization that furnishes, bills, or is paid for healthcare.<ref name="HHSPrivacy" />
| |
| | |
| ===Business Associates===
| |
| Healthcare providers don't always do everything that involves patient information themselves. There are very often other entities contracted for a variety of services. As a result of the Health Information Technology for Economic and Clinical Health (HITECH) Act that was passed in 2009, HIPAA has also been expanded to include business associates. Business associates are those persons or organizations that function on behalf of a covered entity, such as a doctor, and who either use or receive identifiable health information.<ref name="PrivacyGuide">{{cite web |url=http://www.medscape.org/viewarticle/781892_2 |title=Patient Privacy: A Guide for Providers |publisher=Office for Civil Rights at the US Department of Health and Human Services |accessdate=8 June 2016}}</ref>
| |
| | |
| According to 45 CFR 160 part 103 Definitions, Business Associate functions or activities on behalf of a covered entity include:
| |
| | |
| * Claims processing
| |
| * Data analysis
| |
| * Utilization review
| |
| * Billing
| |
| * Legal services
| |
| * Actuarial services
| |
| * Accounting
| |
| * Consulting
| |
| * Data aggregation
| |
| * Management
| |
| * Administrative services
| |
| * Accreditation
| |
| * Financial services
| |
| | |
| A Business Associate is also '''''anyone, not in the workforce of the covered entity, who performs any activities for a covered entity that are covered by HIPAA'''''. Consider that an "...and all other related" kind of clause. Subcontractors of Business Associates who also fit these criteria are also subject to HIPAA.<ref name="45CFR160">{{cite web |url=http://www.ecfr.gov/cgi-bin/text-idx?SID=7d3448738e75c9fd893c236c65924180&mc=true&node=se45.1.160_1103&rgn=div8 |title=Title 45: Public Welfare, PART 160—GENERAL ADMINISTRATIVE REQUIREMENTS, Subpart A — General Provisions |publisher=US Government Publishing Office |accessdate=8 June 2016}}</ref>
| |
| | |
| However, '''''persons or organizations are not considered business associates if their functions or services do not involve the use or disclosure of protected health information, and where any access to protected health information by such persons would be incidental, if at all'''''. A covered entity can also be the business associate of another covered entity.<ref name="HHSPrivacy" />
| |
| | |
| | |
| | |
| ===Others (Plans, etc.)===
| |
| | |
| | |
| ==References==
| |
| <references />
| |
| <!---Place all category tags here-->
| |
| [[Category:LabCourses material (all)]]
| |
| [[Category:LabCourses material on regulations and standards]]
| |
