Focus of HIPAA: Health Insurance Portability & Accountability Act
HIPAA Privacy Rule
The HIPAA Privacy Rule, under the Health Insurance Portability and Accountability Act (HIPAA), sets national standards for patients' rights regarding Protected Health Information (PHI). It applies to covered entities and dictates regulations on patient access, provider denial, and HIPAA form content. Organizations must document these standards in policies, ensuring annual HIPAA training for the workforce and attestation for compliance.
HIPAA Security Rule
The HIPAA Security Rule, also under HIPAA, establishes national standards for secure handling of electronic Protected Health Information (ePHI) by covered entities and business associates. It outlines physical, administrative, and technical safeguards, mandating documentation and annual HIPAA training with attestation to maintain compliance.
HIPAA Breach Notification Rule
The HIPAA Breach Notification Rule mandates covered entities and business associates to respond to data breaches involving PHI or ePHI. Reporting requirements to HHS OCR apply universally, with breach protocols varying based on type, regardless of size.
HIPAA Omnibus Rule
The HIPAA Omnibus Rule extends regulations to include business associates, requiring HIPAA Certification and compliance. It introduces rules for Business Associate Agreements (BAAs) between covered entities and business associates or between two business associates, ensuring HIPAA training and compliance before any PHI or ePHI transfer.
