What Is HIPAA?

While you place a great deal of trust in your healthcare providers and support staff, you have certain rights and protections as a patient as well. One of the most important changes to patient privacy law in the 20th century was the introduction of the Health Insurance Portability and Accountability Act of 1996, otherwise known as HIPAA.

‍

Since its beginnings in the 1990s, HIPAA has expanded, been amended, and updated a number of times to address modern health concerns and protect patient privacy in the digital age. 

‍

Let’s explore exactly what HIPAA is and what it means for your rights to privacy as a patient.

‍

Why Was HIPAA Originally Passed? What Did It Cover?

‍

HIPAA was passed to do much more than just ensure patient privacy. The law aimed to ensure portability and continuity of health insurance coverage for Americans. The HIPAA legislation is split into 5 parts or titles:

‍

• Title I: This part allows for transfer and continuation of coverage in instances of job loss or change, as well as adding protections against being denied coverage as a result of preexisting conditions.
• Title II: The 2nd part of HIPAA required the establishment of national standards for electronic healthcare transactions and created new rules for security and privacy to help curb fraud and abuse. 
• Title III: Title three changed health insurance laws and amended tax deductions for medical insurance and guidelines for pretax medical spending accounts.
• Title IV: This title clarified conditions for group health plans regarding employees with preexisting conditions and changed “continuation-of-coverage” requirements.
• Title V: Title five added provisions related to company-owned life insurance and guidelines for coverage of individuals who are not U.S. citizens.

‍

These 5 parts made up the basis of HIPAA, but it has been updated and amended many times since, including during the COVID-19 pandemic to expand providers’ ability to practice medicine digitally (telehealth). 

‍

HIPAA and Your Rights to Privacy

‍

HIPAA established a couple of different “rules” aimed at protecting patients. Here are the ones most relevant for patients:

‍

• The Privacy Rule: The Privacy Rule dictates how, at what time, and under what conditions individuals' protected health information (PHI) can be leveraged or disclosed. The rule also gave patients more control over their PHI and how it is used.
• The Security Rule: This rule created guidelines to protect electronic PHI (ePHI). Both covered entities and their business associates must comply with the standards set forth by HIPAA.
• The Breach Notification Rule: When a data breach occurs and is discovered, the Department of Health and Human Services must be notified within 60 days if it affects over 500 individuals. The patients affected must also be notified within 60 days.

‍

At its core, HIPAA exists to protect your right to healthcare coverage and the privacy of confidential health information. If you have more questions about how HIPAA impacts your day-to-day interactions with your healthcare team, be sure to reach out to your pharmacist or provider.

‍

The information on this site is for informational purposes only and should not replace direct medical advice, diagnosis, or treatment from your doctor or another qualified healthcare provider.

‍

Sources: 

“Health Insurance Portability and Accountability Act of 1996 (HIPAA).” The Centers for Disease Control.

“Review of HIPAA, Part 1: History, Protected Health Information, and Privacy and Security Rules.” Journal of Nuclear Medicine Technology.