RM Services
Frequently Asked Questions
Office Practice Risk Evaluations
Arbitration
Self-Evaluation Toolkit
RM Articles
CAPsules Editions
CME Program/Schedule
RM Questions
RM Materials / Forms
RM Alerts
Case Of The Month - Past Issues

Medical / Legal Q&A:
HIPAA Privacy Regulations
By Dan Groszkruger, Consulting Editor

A: HIPAA (the Health Insurance Portability and Accountability Act of 1996; formerly the “Kennedy-Kassebaum” Act), includes several well-publicized provisions (e.g., medical savings accounts; rules limiting exclusions for pre-existing medical conditions; and rules prohibiting loss of coverage due to job change), as well as other, less well-known parts. These include (1) claim standardization, (2) security, and (3) privacy.

One provision of HIPAA instructed the Department of Health & Human Services (HHS) to adopt medical privacy regulations by the year 2000. When HHS promulgated a set of draft regulations in 1999, HHS received more than 50,000 comments and complaints!

There are ample reasons for concern, considering just the HIPAA privacy regulations. Generally, the new rules control electronic transmission of “individually identifiable” protected health information. More rules cover paper medical records and oral communications. The new rules apply to most everyone, from single physician offices to huge academic medical centers, and to every provider setting in between. Though some kick in sooner, the new privacy rules will take full effect early in 2003.

Several features of the HIPAA privacy rules are controversial. One set of rules requires physicians and other providers to inform patients about information practices, provide patient-access to protected health information, allow for amendment and correction, and account for all disclosures. Other rules require that only the “minimum necessary” protected health information be disclosed, but fail to specify exactly how such a determination is to be made. Yet more rules may require providers to ensure that their “business partners” observe the new privacy rules. Violations may be subject to harsh fines, up to $250,000, and/or imprisonment for up to 10 years.

Due to the importance and potential impact of the new HIPAA Privacy Regulations, CAP physicians are encouraged to investigate the potential impact and to watch for more information about sources of help and specific compliance recommendations.