Main menu

HIPAA Compliance

HIPAA Compliance Software

HIPAA Form

HIPAA Forms

HIPAA Laws

HIPAA Privacy Rule

HIPAA Requirements

HIPAA Rules

HIPAA Security Rule

HIPAA Training

Additional Reading

• HIPAA
• What is HIPAA?
• HIPAA Laws
• HIPAA Violations

HIPAA Compliance Software

For covered entities, fully enforcing the Health Insurance Portability and Accountability Act is not something to take lightly.

Compliance with the HIPAA is a huge responsibility and ensuring that your entire organization knows the full impact of non-compliance is a must.

Violations may not only mean expensive lawsuits but they could mean expensive penalties that could have otherwise been avoided. HIPAA Compliance Software can help you achieve your goal of fully enforcing all regulations laid out by the HIPAA.

The type of software that you will be getting could depend on the size of your organization, the scope of your responsibility as specified in the HIPAA and the type of database management system that you wish to put in place.

HIPAA Compliance Software

There are quite a number of HIPAA-ready software out in the market today and picking one that will be perfect for your organizational structure could mean looking at several at a time and testing each one.

For specific electronic documentation and accounting purposes, there are practice management software products that are designed to give and receive standard HIPAA electronic documentations and transmissions.

On the other hand, there are likewise software products that not only include applications for electronic documentations, accounting and auditing; but are likewise designed to include HIPAA templates.

These templates include specific forms that both covered entities and consumers may need from time to time as well as templates on concise information about HIPAA stipulations.

Software Brands Available Today

As mentioned earlier, there are a number of HIPAA-ready software products available today. First, what you want to look for are those that have been tried and tested by other covered entities like yourself.

You can get a pretty good idea of whether or not a specific software is doing its job as expected, or perhaps even exceeding expectations.

Next, you can check out software developers’ websites that have specialized applications for HIPAA compliance.

To give you an idea of how this software can help your organization, you can check out http://cornerstoneondemand.com and view their regulatory compliance software products.

You can also view product specifications of HIP software are http://hipaahomecare.com; another type of software that is HIPAA-ready.

The basic applications of these software brands include minimizing risks and vulnerability of your client’s private medical records and other pertinent details as well as check the compliance level of everyone in your organization.

These software providers will walk you through the whole process of setting-up and using the software applications. They may provide trainings for all concerned personnel to ensure that everyone complies with the highest level of competency.

HIPAA Requirements

The Health Insurance Portability and Accountability Act hopes to protect the privacy of patients or customers of health insurers while also defining who the covered entities are.

In complying with the HIPAA, there are various HIPAA Requirements that covered entities and consumers must follow in order to avoid incurring any violations.

These requirements are specific, detailing guidelines for consumers and another set of guidelines for covered entities. The requirements likewise include certain forms that both parties may need to submit for specific purposes.

General Requirements

For covered entities, i.e. health insurance companies, HMOs, health care clearinghouses and health care providers; the basic requirement under the Final Rule is to protect electronically documented patient or consumer information.

Protecting this information includes putting in place security measures both physically and technologically to ensure that no patient information will be exposed to unauthorized personnel.

If this information will be used in any way such as passing it on to a business associate, the covered entities must fill-out specific consent and authorization forms and have these signed by the concerned client.

For clients or patients on the other hand, the basic requirements are those that need specific forms to show their consent to, as mentioned, passing on their information to a covered entity’s business associate; and allowing visitors to be in the room during a medical procedure.

What Information is Covered Under the Privacy Rule?

Basic information about a patient such as their names, addresses, dates, i.e. birth date, admission and discharge date and also date of demise; are covered under the privacy rule.

Pictures of the patient as well as Social Security and Medical Record numbers are likewise included in the privacy rule.

Should any of the abovementioned information be used by the covered entity in activities other than those set by the HIPAA, the covered entity is required to obtain authorization and consent from the patient prior to using the information.

The covered entity is required by law to submit a Notice of Privacy Practices to the client to avoid breach of the privacy rule.

For the part of the business associate who will be receiving a client’s information, the business associate is required by Federal Law to let the covered entity know if the information was disclosed to unauthorized personnel or other entities.

The business associate is likewise required, where possible, to give back the information to the covered entity upon termination of their agreement.

Should any violations be committed by the business associate, the covered entity must employ all means to rectify the situation and inform the U.S. Department of Health and Human Services.

HIPAA Rules

Numerous offences relating to health care are defined under Title II of the Health Insurance Portability and Accountability Act of 1996 and sets civil and criminal liabilities for them. However, the most significant provisions of said portion of HIPAA are its Administrative Simplification Rules that mandates the Department of Health and Human Services to draft rules that would increase the efficiency of the health care system and create standards for the dissemination and use of health care information. The HHS accordingly promulgated five HIPAA Rules regarding Administrative Simplification, namely: Privacy Rule; Security Rule; Transaction and Code Sets Rule; Unique Identifiers Rule; and, Enforcement Rule. These rules apply to so-called Covered Entities that generally refer to health plans, health care clearinghouses and health care providers that transmit HIPAA regulated health data.

The HIPAA Rules on Privacy regulates the disclosure and use of Protected Health Information held by Covered Entities. Any information held by a covered entity concerning the status of health, the provision or payment of health care that can be linked to an individual form part of the PHI which can be interpreted rather simply and broadly as any portion of the medical record or payment history of an individual.

The HIPAA Rules on Security specifically deals with all Electronic Protected Health Information. It complements the Privacy Rule which refer to all Protected Health Information to include both paper and electronic based. The Security Rule prescribes three types of security safeguards that covered entities should comply with, namely: administrative, technical and physical safeguards.

The HIPAA Rules on Transaction and Code Sets prescribe the standard key EDI transactions that medical providers must follow in electronically filing their claims for payment, as follows: EDI Health Care Claim Transaction Set; EDI Retail Pharmacy Claim Transaction; EDI Health Care Claim Payment/ Advice Transaction Set; EDI Benefit Enrollment and Maintenance Set; EDI Payroll Deducted and Other Group Premium Payment for Insurance Products; EDI Health Care Eligibility/ Benefit Inquiry; EDI Health Care Eligibility/ Benefit Response; EDI Health Care Claim Status Request; EDI Health Care Claim Status Notification; EDI Health Care Service Review Information; and, EDI Functional Acknowledgement Transaction Set.

The HIPAA Rules on Unique Identifiers prescribes a National Provider Identifier that is unique and national to identify covered health care providers in standard transactions. The NPI replaces all other identifiers used by Medicare, Medicaid, health plans and other government programs.

The HIPAA Rules on Enforcement prescribes civil monetary penalties for violation of HIPAA Rules and sets procedures for investigations and hearings for HIPAA violations.

HIPAA Security Rule

The HIPAA Security Rule is a vital part of the Health Insurance Portability and Accountability Act of 1996 that thousands of organizations throughout the United States are required to comply with. If your organization is covered by the Act, it is important that you understand the HIPPA Security Rule and take the steps necessary to be compliant to the rule.

Basically the rule applies to electronic protected health information, or EPHI, which is individually identifiable health information, or IIHI, in electronic form. The IIHI pertains to the patient’s future, present or past mental or physical condition, his provision of health care and future, present and past payment for such provision of health care. The foremost concern of the HIPAA Security Rule is to protect the integrity, confidentiality and availability of the EPHI when it is stored, maintained or transmitted.

The organizations that are required to comply, or Covered Entities (CEs), are group health plans, HMOs and similar entities, health care providers such as hospitals, doctors and dentists who transmit EPHI, and health care clearing houses like billing and medical transcription companies. To protect the integrity, confidentiality and availability of their EPHI, CEs are required to maintain appropriate and reasonable technical, physical and administrative safeguards within their operational systems and policies.

Aside from the civil and criminal penalties, the consequences for non-compliance to the HIPAA Security Rule that may severely affect the continuing viability of the organization are: negative publicity, loss of customers or clients and business partners. Under the guiding principles, all CEs must: be able to comply with the rule regardless of size; have a cohesive security approach based on “defense in depth” principle; protect their EPHI against both external and internal threats; choose the appropriate technology to protect its EPHI; and regularly conduct a thorough risk analysis.

The key concepts of the HIPAA Security Rule provides that: CEs are required to comply with best security practices and principles; CEs must undertake appropriate measures to control or mitigate anticipated risks to their EPHI and balance their business requirements and resources against such risks; universal compliance to the rule by all members of the CEs; CEs must document their security procedures, policies and processes; and, CEs must conduct regular awareness and security training to its workforce and revise policies and procedures as the need arises.

The HIPAA Security Rule requires all CEs to put in place administrative, physical and technical safeguards to ensure the safety, integrity and confidentiality of their EPHI. CEs found to be non-compliant to the HIPAA Security Rule face civil penalties ranging from $100 per violation up to $25,000 per annum for every requirement violated. Criminal penalties, on the other hand, range from a fine of $50,000 plus a one-year imprisonment up to $250,000 in fines plus 10 years of imprisonment.

HIPAA Forms

For both patients or consumers and entities covered by the Health Insurance Portability and Accountability Act, there are specific forms that you need to fill-up for information requests, data sharing and health care practitioners who will be allowed in the room or facility during specific medical procedures.

HIPAA Forms are available for download from certain websites on the internet such as hipaa.ucsf.edu and you may also obtain these from your medical facility such as your preferred clinic or hospital.

It is important that these forms be well-documented so should anything amiss occur, all concerned entities have legal records of these forms.

Various HIPAA Forms

There are a number of forms available for consumers’ needs as well as forms that provide legal consent from consumer to medical practitioners, volunteers and visitors.

These forms may vary depending on the medical facility or medical practitioner you will be obtaining them from. Basically however, these forms cover the abovementioned areas as well as other specifications as decided upon by the medical facility or practitioner.

For some medial institutions, there is a Confidentiality Statement that concerned individuals must sign in order to be legally held responsible for any violations that could otherwise make the medical institution be liable for such violations.

Other forms include Request for Accounting Disclosure, Consents and Authorizations such as Consent for Presence of Observer During Medical Procedure and Nursing Care, and Consent for Minor Visitors to volunteers in medical institutions.

An important form that consumers or patients also need to look into is the Data Sharing form. This form will allow the patient to decide on who gets a copy of their medical record including medical billings.

Other Important HIPAA Forms

If you are a relative of a deceased former patient, you will also be asked to fill-up certain forms if you wish to obtain medical records of your deceased relative. You may also be asked to submit other requirements together with the form to validate your claim of being a relative of the deceased.

If you wish to give your medical records for research, marketing purposes, court proceedings or any other purpose, there are likewise corresponding forms that you need to fill-up and sign.

On the other hand, if you are a parent of a minor patient and wish to obtain the patient’s medical record, some medical institutions will require you to fill-out and sign a request form even if you have already proven that you are the legal guardian or parent of the patient.

These forms will release the medical institution from liabilities should anything amiss happen resulting from your possession of the records.

HIPAA Form

For various transactions between a covered entity and its clients, there are different forms that you can use as regulated by the HIPAA.

These forms make transactions between the two parties more efficient. They likewise prove the legality of the transactions, specifically according to the regulations set up by the HIPAA.

There is a specific HIPAA Form for covered entities and their clients, and this can either be obtained from the office of the covered entity or through their website.

HIPAA Notice of Privacy Practices Statement

This form must be duly signed by both the covered entity and its clients. This Notice of Privacy Practices Statement states how the covered entity will collect your information: via post mail correspondences, telephone calls, and electronic mail, among others.

The client has to take note that the covered entity has no right to share a client’s information without prior written and signed consent.

Other stipulations in the Privacy Statement may also be included and these need to be carefully read and studied by both parties before affixing their respective signatures.

These stipulations include outlining specific instances where a covered entity wishes to use the client’s information such as medical purposes, payments and billings and other health-related activities as indicated by the covered entity.

Patient Information Forms

For new clients, a covered entity may require them to fill-up a patient medical history form to give them a brief look at a client’s health care history. This will help them in the analyses of patient cases where medical care or procedures may be needed.

For existing patients, an update form may be required to keep the patient’s record updated from time to time.

A Consent Form for Use and Disclosure is required and must be submitted by the covered entity to the patient in cases where they wish to share a patient’s health information to other entities not included in the HIPAA.

These could be business associates or affiliates of the covered entity for marketing and advertising purposes.

It is important that the covered entity specify each to whom they will be disclosing a client’s information, for what purpose will this information be shared and for how long their information will be held by the third party in question.

It is also best to check for stipulations that provide a client with the option to revoke their consent under specific circumstances.

Acknowledgment Receipt of Privacy Notice is given by covered entities to the patient as proof that the patient did indeed receive the Notice of Privacy Statement. This form is given depending on the covered entity.

HIPAA Training

In order for covered entities, including their management and other personnel, to fully comply with the Health Insurance Portability and Accountability Act; they have to undergo specific training programs.

HIPAA Training will not only give all concerned personnel a clearer understanding of how the HIPAA works for both covered entities and consumers; but it will also help them rise up to situations where violations have occurred.

What Type of HIPAA Training is Required?

There is no standardized training that all covered entities must go through. The type of training largely depends on the discretion of the covered entities.

There are trainings that extensively discuss all stipulations included in the HIPAA plus simulated scenarios where breach of any of the stipulations has taken place.

For other entities, the training likewise covers security measures that need to be physically implemented in order to reduce the risk of violations on the part of their personnel.

Still others also include training for use of technological security measures to ensure that all concerned personnel will be adept at manipulating the security measures according to the limitations included therein.

Who Conducts the Trainings?

Certified experts on the HIPAA will be conducting these trainings. They can either come to your office to train your personnel within your own premises or you may go to their designated training facilities for the training program.

The trainings usually cover several days of understanding what the HIPAA is all about and how this affects both you as the covered entity, and your customers.

Depending on our chosen training agency, there could likewise be tests or exams that will follow after completion of each training module.

The tests will determine whether or not the personnel have fully grasped what HIPAA is all about. The tests may also include doing damage control for situations where breach of security was made.

Handling Customer Complaints

One of the most important parts of training is knowing how to handle customer complaints, this includes appeasing irate customers. Learning about tact and diplomacy may be part of handling customer complaints.

Should a customer wish to file a complaint, the personnel should know how the complaint process goes, from filing a formal complaint up to conducting an investigation.

Other Mattes of Concern

The training may likewise touch on certain procedures that both customers and covered entities should follow during specific situations. These include seeking for the customer’s authorization and consent for sharing of their private information to a covered entity’s business associates.

Corresponding forms as well as the processes involved in these requests will be tackled during training.

There are a lot of nitty-gritty details that encompass the HIPAA. This is why t HIPAA Training is a must for all covered entities to ensure that the laws enforced therein will be strictly followed.

HIPAA Compliance

The Health and Insurance Portability and Accountability Act was enacted in 1996 to lower the cost of health care in the United States, give its citizens better access to health insurance and reduce abuse and fraud. The most significant portion of this Act is the Security Rule, which covers thousands of organizations called “Covered Entities.” Before such covered entities can take the steps needed for HIPAA compliance, it is important that they first understand the rule. Covered entities should consider the following steps when preparing to comply with the Security Rule.

HIPAA compliance requires a lot of money, time and effort. That is why it is crucial to educate senior management about the Security Rule and for them to make a clear statement of support for compliance, and if possible, they should willingly sponsor compliance projects. Before even starting security processes, covered entities should identify and define the security policies that they need to develop and implement. They should craft the strategic security goals of their organization to ensure a focused and integrated security effort. A formal and documented security policies and procedures are clear manifestations of senior management’s desire to move their organization towards HIPAA compliance.

The goal of the HIPAA Security Rule is to ensure the integrity, confidentiality and availability of Electronic Protected Health Information. For this to happen, covered entities must first conduct and maintain an inventory of their EPHI and document both the internal and external flow of EPHI. Compliance with the Security Rule begins with the people who make the organization. Implementing security policies and technology without understanding the underlying culture and politics in an organization is bound to fail. It is imperative in this regard that members of the workforce be educated about the requirements of the Security Rule and the importance of protecting the EPHI. Soliciting workforce participation in crafting security policies and in the feedback process can go a long way in ensuring HIPAA compliance.

Covered entities should also undertake regular risk analysis that basically entails the identification of, and assessment of risks to their EPHI so that senior management may be able to allocate the necessary resources to mitigate the impact these risks and protect these EPHI. The Security Rule does not, however, expect covered entities to devote all of its resources, effort and time to provide the perfect security against all possible risks at the expense of its organization as a going concern. Covered entities are instead enjoined to understand their EPHI and the reasonably anticipated risks so that they can develop security procedures that are reasonable and appropriate. Having done these, covered entities are then required to formally document their security policies, procedures and controls that should be approved by senior management with the understanding that these shall be regularly reviewed and modified as necessary. Covered entities must appreciate that risks, rules and laws change over time and they should be prepared to respond to these changes.

HIPAA Laws

HIPAA Laws serve to protect consumers while also outlining specific regulations that will enhance the procedures and operations of covered health insurance companies and other covered entities.

The laws were enforced in 2003 and all covered entities should be fully complying with said HIPAA by 2005. The systematic procedures, as outlined by the HIPAA, are estimated to save more than 9 billion dollars every year for covered entities.

How Does the HIPAA Affect Covered Entities?

Under HIPAA Laws, covered entities should adhere to specific regulations that will serve to preserve the privacy of their costumers.

Security measures that health insurance companies and other entities included in the HIPAA will put into place are seen to reduce fraudulent activities where unlawful access and use of a customer’s personal as well as medical information will be reduced, if not completely eradicated.

Under Federal Law, which protects and ensures adherence to HIPAA, covered entities will have a more systematized backbone for electronically documenting all relevant information of a patient.

It likewise provides limitations as to who can get access to said information thereby reducing the risk of customer complaints for unlawful sharing of their personal records.

On the other hand, the law also states that compliance with the HIPAA requires covered entities to conduct a thorough investigation of customer complaints in a timely manner. This once again serves to protect the rights of the customer.

What are the Procedures for Filing a Complaint?

If a customer determines, after a thorough investigation on their part, that breach of their privacy was made by covered entities, the customer should immediately file a complaint.

Customers have two options when filing a complaint. They can file their complaint directly to the American government or to the covered entity in question.

You must file your complaint no later than one hundred and eighty days after you have determined that the breach of privacy was undertaken. If you have supporting documents validating your complaint, these should be submitted together with your complaint letter.

You may send your complaint through electronic mail or facsimile, whichever is more convenient.

If there is probable cause for your complaint, as analyzed by the Office for Civil Rights, further investigation will be undertaken.

How Does the HIPAA Affect Customers?

For the part of the consumers, the HIPAA has given them peace of mind that their health insurance companies or other covered entities will not disclose their personal information to unauthorized entities without their prior consent.

The HIPAA laws likewise ensure consumers that should breach of privacy be undertaken by the covered entity, their rights to privacy will be upheld by providing them with the option to file a complaint.

HIPAA Privacy Rule

Health Insurance Portability and Accountability Act, which was passed into law in 1996 to set guidelines on health insurance coverage as well as protecting the privacy of consumers and health care providers, among other things.

HIPAA Privacy Rule is divided into two categories: consumer protection and entities who must comply with the privacy rule.

This article hopes to provide basic important information to consumers concerning their rights to privacy when it comes to their medical history including who gets to see it and which third parties may obtain copies of it.

HIPAA Privacy Rule and the Federal Law

The Health Insurance Portability and Accountability Act Privacy Rule is protected by Federal Law. It is therefore of vital importance that all covered entities comply with the privacy rule lest they be charged with unlawfully disseminating a patient’s classified medical history to unqualified third parties.

As a consumer, you have to know what these rights cover. Under Federal Law, d entities who must comply with the privacy rule include health insurance companies, health care providers such as medical, dental and mental doctors, medical facilities, drugstores and nursing homes.

Data analysts and entities that process medical information such as billings are also required to follow the privacy rule.

Consumer Privacy Rule

As a consumer or a patient, you have a right to obtain copies of your medical record from specified entities holding your information. As a rule, you should get the requested copies no later than thirty days from the date of request unless the entity seeks for an extension with good reason.

You should know that you may be required to shoulder mailing and printing expenses. Discuss this option with the entity.

You also have the right to request that your medical information be updated or altered in cases where wrong data was inputted. From the date of request, the information should be updated within sixty days unless the entity requests for an extension with viable reason.

In cases where your medical information will be passed-on to another entity by your health insurance or health care provider, you have the right to be informed about this matter prior to sharing this information.

Finally, you should know that your classified medical information may not be shared to your employer and other entities without your consent. Should this information be requested, there has to be a consent form signed by you before the information can be given.

Information covered by the privacy rule includes written medical records, billing information and conversations between doctors and nurses regarding your medical case.