HIPAA
Health Insurance Portability and Accountability Act of 1996

T

he Health Insurance Portability and Accountability Act, commonly referred to as HIPAA, became a federal law in 1996. The act contains insurance reform provisions and introduces the establishment of a fraud and abuse control program when rendering medical care to Medicare patients. In 2000, regulations were established to protect the privacy of personal health information maintained by health care providers, health plans, hospitals, health care clearinghouses, and health insurers. These regulations became effective in 2003 (2004 for small health plans). Violators of HIPAA may be subjected to fines, prison, or both.
HIPAA is organized into three parts:
• Privacy regulations. HIPAA regulations guide health care providers with overall privacy measures, such as turning the charts toward the wall and making sure the computer screen is not visible. Five forms are required (privacy notice, acknowledgment, authorization, business associate agreement, and trading partner agreement).
• Transaction standards. Requirements must be followed when putting the office software into HIPAA compliance.
• Security regulations. HIPAA requires health care providers to keep computers safe.
The first two parts had 2003 deadlines for compliance and the third part has a 2005 deadline.
To adhere to the HIPAA regulations, a medical practice must have an appointed privacy official draft privacy policies and procedures, and implement a program to educate and train all physicians and employees to the mandates of HIPAA. These policies become part of the office policies and procedures manual. Health Insurance Portability and Accountability Act of 1996

American Association of Medical Assistants

2

HIPAA

Confidentiality (privacy) policies must be followed. Refrain from talking about patients and their problems where