LII:HIPAA Compliance - LII 007 02. Who Needs to Comply?

From LIMSWiki
Revision as of 15:44, 8 June 2016 by Avaughan (talk | contribs)
Jump to navigationJump to search

HIPAA compliance is highly important in the healthcare arena. Non-compliance can result in fines and other serious consequences. But who is actually bound by this law? HIPAA is comprised of two main segments, the Privacy Rule and the Security Rule. Those who must comply are called "covered entities". According to the HHS, these are:

HIPAA Covered Entities:

HIPAA Course Insert 1.png

So covered entities are doctors, clinics, hospitals, dentists, nursing homes and pharmacies that transmit data electronically, as well as health plans, insurance plans and healthcare clearinghouses.[1]

Healthcare Providers

Every health care provider (regardless of size) who electronically transmits health information in connection with certain transactions, is a covered entity. These transactions include:

  • Claims
  • Benefit eligibility inquiries
  • Referral authorization requests
  • Other transactions for which HHS has established standards under the HIPAA Transactions Rule

It's important to note that using electronic technology (e.g. email) does not mean a healthcare provider is a covered entity. The transmission must be in connection with a "standard transaction".

Transactions are electronic exchanges involving the transfer of information between two parties for specific purposes. For example, a healthcare provider will send a claim to a health plan to request payment for medical services.[2]

In the HIPAA regulations, the Secretary of Health and Human Services (HHS) adopted certain standard transactions for Electronic Data Interchange (EDI) of healthcare data. These transactions are:

  • Claims and encounter information
  • Payment and remittance advice
  • Claims status
  • Eligibility, enrollment and disenrollment
  • Referrals and authorizations
  • Coordination of benefits and premium payment[2]

The standard does not encompass telephone voice response and fax-back systems.[3]

The Privacy Rule covers a healthcare provider whether it electronically transmits these transactions directly or uses a billing service or other third party to do so on its behalf. Healthcare providers include all “providers of services” (e.g., institutional providers such as hospitals) and “providers of medical or health services” (e.g., non-institutional providers such as physicians, dentists and other practitioners) as defined by Medicare, and any other person or organization that furnishes, bills, or is paid for healthcare.[1]

Business Associates

Healthcare providers don't always do everything that involves patient information themselves. There are very often other entities contracted for a variety of services. As a result of the Health Information Technology for Economic and Clinical Health (HITECH) Act that was passed in 2009, HIPAA has also been expanded to include business associates. Business associates are those persons or organizations that function on behalf of a covered entity, such as a doctor, and who either use or receive identifiable health information.[4]

According to 45 CFR 160 part 103 Definitions, Business Associate functions or activities on behalf of a covered entity include:

  • Claims processing
  • Data analysis
  • Utilization review
  • Billing
  • Legal services
  • Actuarial services
  • Accounting
  • Consulting
  • Data aggregation
  • Management
  • Administrative services
  • Accreditation
  • Financial services

A Business Associate is also anyone, not in the workforce of the covered entity, who performs any activities for a covered entity that are covered by HIPAA. Consider that an "...and all other related" kind of clause. Subcontractors of Business Associates who also fit these criteria are also subject to HIPAA.[5]

However, persons or organizations are not considered business associates if their functions or services do not involve the use or disclosure of protected health information, and where any access to protected health information by such persons would be incidental, if at all. A covered entity can also be the business associate of another covered entity.[1]


Others (Plans, etc.)

References