Hippa – Effects Of Health Insurance

Effects of the Health Insurance
Portability & Accountability Act (HIPAA)
Introduction
Just when Americans thought it was safe to turn on their computers after this year’s anticipated Y2K catastrophe, now comes the federal government’s new Health Insurance Portability & Accountability Act (HIPAA) — privacy regulations that will create new, insurmountable challenges for today’s healthcare industry. The Y2K bug is estimated to have cost the health care industry upwards of $10 billion. By comparison, implementing the HIPAA privacy and security regulations is estimated to cost the health care industry $40 billion over the next two years. Beginning January 2001, US health care operations will never be the same again.
This paper will address the origins of these new federal privacy regulations with a specific focus on the privacy standards and the Health and Human Services (HHS) proposed rules on confidentiality of personal health information. In a Wall Street Journal/ABC poll conducted on September 16, 1999, Americans were asked to identify those issues that concerned them most for the coming century. Loss of personal privacy ranked as the first or second concern of 29 percent of all respondents. Other issues, such as terrorism, world war, and global warming, scored of 23 percent or less.

Background
Historically, an individual’s access to his or her own medical records ? and the ability to limit that access to third-parties ? was safeguarded by the patient, physicians, and healthcare organizations (i.e., hospitals, clinics, etc.). However, with advances in information technology, the issues of security and breeches of patient confidentiality have become major priorities.
When Congress passed the Health Insurance Portability & Accountability Act of 1996, it contained hundreds of pages of proposed legislation intended to set privacy and security standards for the creation and maintenance of patient health care databases. Congress set a deadline for itself of fall 1999, to pass comprehensive legislation regulating the privacy and security of information traditionally held sacred between patient and doctor. If Congress did not meet its deadline, HIPAA authorized the Secretary of the Department of Health & Human Services (HHS) to take on the program. In November 1999, after Congress failed to meet its deadline, HHS issued proposed privacy regulations regarding the secure treatment of electronic information and requiring a standardization of data used in transmitting health care information electronically. After the uneventful passing of the Y2K crisis, healthcare providers reevaluated the proposed regulations and began to realize the impact of such privacy and security regulations.

Purpose
HIPAA addresses the protection of health information from its creation and establishes uniform requirements for those handling such information. The new privacy regulations effect all health care providers, health plan administrators, and health care clearinghouses (hereinafter collectively referred to as health care operators) that electronically transmit individual, identifiable health information in one of several types of transactions. The regulations apply not only when a health care operator engages in one of the listed transaction, but any time they use or disclose protected information. In fact, the regulation covers such a broad variety of healthcare-related transactions — such as verification and coordination of benefits — that only on rare occasion will a health care operator not be effected by this mandate.
The regulation governs the use and disclosure of individual, identifiable health information that has been electronically transmitted or maintained by a health care operator. However, not all health care information is protected under these regulations. The new privacy regulation only applies when a health care operator places information that potentially identifies an individual into an electronic format, and a reasonable basis exists to believe that the information can or will be used to identify the individual. This category of information is known under the new regulation as protected health information.
It is important to remember that individual, identifiable health care information can easily become subject to these regulations whenever existing information is entered into a computer or any type of electronic data system. This includes the scanning of older, paper records into an optical storage device. As a general rule, protected health care information may not be used or disclosed — even within an organization — unless the health care operator receives specific authorization from the individual patient.
The Privacy Act of 1974
Before