LII:HIPAA Compliance - LII 007 02. Who Needs to Comply?
HIPAA compliance is highly important in the healthcare arena. Non-compliance can result in fines and other serious consequences. But who is actually bound by this law? HIPAA is comprised of two main segments, the Privacy Rule and the Security Rule. Those who must comply are called "covered entities". According to the HHS, these are:
HIPAA Covered Entities:
So covered entities are doctors, clinics, hospitals, dentists, nursing homes and pharmacies that transmit data electronically, as well as health plans, insurance plans and healthcare clearinghouses.[1]
Healthcare Providers
Every health care provider (regardless of size) who electronically transmits health information in connection with certain transactions, is a covered entity. These transactions include:
- Claims
- Benefit eligibility inquiries
- Referral authorization requests
- Other transactions for which HHS has established standards under the HIPAA Transactions Rule
It's important to note that using electronic technology (e.g. email) does not mean a healthcare provider is a covered entity. The transmission must be in connection with a "standard transaction".
Transactions are electronic exchanges involving the transfer of information between two parties for specific purposes. For example, a healthcare provider will send a claim to a health plan to request payment for medical services.[2]
In the HIPAA regulations, the Secretary of Health and Human Services (HHS) adopted certain standard transactions for Electronic Data Interchange (EDI) of healthcare data. These transactions are:
- Claims and encounter information
- Payment and remittance advice
- Claims status
- Eligibility, enrollment and disenrollment
- Referrals and authorizations
- Coordination of benefits and premium payment[2]
The standard does not encompass telephone voice response and fax-back systems.[3]
The Privacy Rule covers a healthcare provider whether it electronically transmits these transactions directly or uses a billing service or other third party to do so on its behalf. Healthcare providers include all “providers of services” (e.g., institutional providers such as hospitals) and “providers of medical or health services” (e.g., non-institutional providers such as physicians, dentists and other practitioners) as defined by Medicare, and any other person or organization that furnishes, bills, or is paid for healthcare.[1]
Business Associates
Others (Plans, etc.)
References
- ↑ 1.0 1.1 "Summary of the HIPAA Privacy Rule". U.S. Department of Health and Human Services. http://www.hhs.gov/hipaa/for-professionals/privacy/laws-regulations/index.html. Retrieved 8 June 2016.
- ↑ 2.0 2.1 "Transaction & Code Sets Standards". U.S. Centers for Medicare and Medicaid Services. https://www.cms.gov/Regulations-and-Guidance/HIPAA-Administrative-Simplification/TransactionCodeSetsStands/index.html?redirect=/TransactionCodeSetsStands. Retrieved 8 June 2016.
- ↑ "What Are HIPAA Transaction and Code Sets Standards?". Texas Medical Association. https://www.texmed.org/Template.aspx?id=1599. Retrieved 8 June 2016.
