Health Insurance Portability and Accountability Act (HIPPA) - Kloudlearn

Online course offering
HIPAA
All you need to know about Health Insurance
Portability and Accountability Act
© KloudLearn www.kloudlearn.com

Learning
Objectives
© KloudLearn www.kloudlearn.com 2
Introduction to HIPAA
Purpose of HIPAA
Main components of HIPAA
HIPAA Compliance Requirement
Compliance Checklist
HIPAA Privacy Rule
Entities covered by HIPAA
PHI
What information is protected under HIPAA?
HIPAA Security Rule
Breach Notification
Summary

Introduction to HIPAA
● HIPAA (Health Insurance Portability and
Accountability Act) is United States legislation
that provides data privacy and security provisions for
safeguarding medical information.
● The law has emerged into greater prominence in
recent years with the many health data breaches
caused by cyber attacks and ransomware attacks on
health insurers and providers.
● The federal law was signed by President Bill Clinton
on Aug. 21, 1996. HIPAA overrides state laws
regarding the safety of medical information, unless
the state law is considered more stringent than
HIPAA.
● It is a federal legislation which addresses issues
ranging from health insurance coverage to national
standard identifiers for healthcare providers.

Purpose of HIPAA
● HIPAA, also known as Public Law 104-191, has two main purposes:
■ to provide continuous health insurance coverage for workers who lose or change their job and;
■ to ultimately reduce the cost of healthcare by standardizing the electronic transmission of
administrative and financial transactions.
● Other goals include combating abuse, fraud and waste in health insurance and healthcare delivery, and improving
access to long-term care services and health insurance.

Main components of HIPAA
HIPAA contains five sections, or titles:
● Title I: HIPAA Health Insurance Reform
Title I protects health insurance coverage for individuals who lose or change jobs. It also prohibits group
health plans from denying coverage to individuals with specific diseases and preexisting conditions and from
setting lifetime coverage limits.
● Title II: HIPAA Administrative Simplification
Title II directs the U.S. Department of Health and Human Services (HHS) to establish national standards for
processing electronic healthcare transactions. It also requires healthcare organizations to implement secure
electronic access to health data and to remain in compliance with privacy regulations set by HHS.
● Title III: HIPAA Tax-Related Health Provisions
Title III includes tax-related provisions and guidelines for medical care.
● Title IV: Application and Enforcement of Group Health Plan Requirements
Title IV further defines health insurance reform, including provisions for individuals with preexisting
conditions and those seeking continued coverage.
● Title V: Revenue Offsets
Title V includes provisions on company-owned life insurance and the treatment of those who lose their U.S.
citizenship for income tax purposes.

HIPAA Compliance Requirements
● National Provider Identifier Standard:
Each healthcare entity, including individuals, employers, health plans and healthcare providers, must have a
unique 10-digit National Provider Identifier number, or NPI.
● Transactions and Code Sets Standard:
Healthcare organizations must follow a standardized mechanism for electronic data interchange (EDI) in
order to submit and process insurance claims.
● HIPAA Privacy Rule:
Officially known as the Standards for Privacy of Individually Identifiable Health Information, this rule
establishes national standards to protect patient health information.
● HIPAA Security Rule:
The Security Standards for the Protection of Electronic Protected Health Information (ePHI) sets standards
for patient data security.
● HIPAA Enforcement Rule:
This rule establishes guidelines for investigations into HIPAA compliance violations.

Compliance Checklist
HIPAA Compliance Checklist
✔ Establish a HIPAA compliance committee
✔ Review HIPAA guidelines
✔ Perform gap analysis to identify areas of concern
✔ Build and execute a plan to address security gaps
✔ Review key vendors’ interactions with PHI
✔ Perform ongoing monitoring and audits
✔ Establish data breach incident response protocols
✔ Perform HIPAA training
✔ Regularly evaluate compliance and review HIPAA updates
✔ Ask subject matter experts for assistance

HIPAA Privacy Rule
● The Standards for Privacy of Individually Identifiable
Health Information, commonly known as the HIPAA
Privacy Rule, establishes the first national standards
in the United States to protect patients' personal or
protected health information (PHI).
● The Privacy Rule also guarantees patients the right
to receive their own PHI, upon request, from
healthcare providers covered by HIPAA.
● The HIPAA Privacy Rule applies to organizations
that are considered HIPAA-covered entities.

Entities covered by HIPAA
● A HIPAA-covered entity is any organization or corporation that directly handles PHI or personal health
records. Covered entities are required to comply with HIPAA and HITECH (Health Information Technology
for Economic and Clinical Health) Act mandates for the protection of PHI and PHRs.
● Covered entities fall into three categories:
■ Healthcare provider:
Healthcare providers include doctors, clinics, psychologists, dentists, chiropractors, nursing homes and
pharmacies.
■ Health plan:
Health plans include health insurance companies, health maintenance organizations (HMOs), company
health plans and government healthcare programs, such as Medicare, Medicaid and military healthcare
programs.
■ Healthcare clearinghouse:
Healthcare clearinghouses are entities that process nonstandard health information they receive from
another entity into a standard format or vice versa. Examples include billing services and community
healthcare systems for managing health data.

PHI
Protected Health Information (PHI)
● HIPAA protects all patient information whether it is verbal,
written or electronic.
● It includes all individually identifiable health information that
is transmitted or maintained in any form or medium.
● It includes demographic information that ties the identity of
the individual to his or her health record.
● E.g. names, addresses, geographic codes smaller than state,
all dates (except year) elements related to the person,
telephone numbers, fax numbers, license numbers, social
security numbers, etc.

What information is protected under HIPAA?
● The HIPAA Privacy Rule protects all individually identifiable health information that is held or transmitted by
a covered entity. This information can be held in any form, including digital, paper or oral.
● PHI includes but is not limited to the following:
■ a patient's name, address, birth date, Social Security number, biometric identifiers or other personally
identifiable information (PII);
■ an individual's past, present or future physical or mental health condition;
■ any care provided to an individual; and
■ information concerning the past, present or future payment for the care provided to the individual that
identifies the patient or information for which there is a reasonable basis to believe could be used to
identify the patient.
● PHI does not include the following:
■ employment records, including information about education, as well as other records subject to or
defined in the Family Educational Rights and Privacy Act (FERPA); and
■ deidentified data, meaning data that does not identify or provide information that could identify an
individual -- there are no restrictions to its use or disclosure.

HIPAA Security Rule
● The Security Standards for the Protection of Electronic Protected Health Information, commonly known as
the HIPAA Security Rule, establishes national standards for securing patient data that is stored or transferred
electronically.
● It draws from the National Institute of Standards and Technology's (NIST) Cybersecurity Framework.
● The Objective:
■ Defines general standards and implementation requirements to protect electronic personal health
information (ePHI), which is preserved by covered entity.
■ Provides appropriate controls such as administrative, physical, technical and Policies, procedures and
documentation requirements in order to guarantee the confidentiality, integrity, and availability of ePHI.

Breach Notifications
● Definition of “Breach”:
An impermissible acquisition,
access, use or disclosure not
permitted by the HIPAA Privacy
Rule.
● Examples include:
■ Laptop containing PHI is
stolen.
■ Receptionist who is not
authorized to access PHI
looks through patient files in
order to learn of a person’s
treatment.
■ Nurse gives discharge papers
to the wrong individual.
■ Billing statements containing
PHI mailed or faxed to the
wrong individual/entity.
● Examples of Privacy Breach
■ Talking in public areas, talking too loudly, talking to the
wrong person.
■ Lost/stolen or improperly disposed of paper, mail,
films, notebooks.
■ Lost/stolen laptops, PDAs, cell phones, media devices
(video and audio recordings).
■ Lost/stolen media like CDs, flash drives, memory
cards.
■ Hacking of unprotected computer systems.
■ Email or faxes sent to the wrong address, wrong
person, or wrong number.
■ User not logging off of computer systems, allowing
others to access their computer or system.

Summary
● HIPAA (Health Insurance Portability and Accountability Act) is United States legislation that provides data
privacy and security provisions for safeguarding medical information.
● HIPAA Health Insurance Reform, HIPAA Administrative Simplification, HIPAA Tax-Related Health Provisions,
Application and Enforcement of Group Health Plan Requirements and Revenue Offsets are the 5 main
components of HIPAA.
● National Provider Identifier Standard, Transactions and Code Sets Standard, HIPAA Privacy Rule, HIPAA
Security Rule and HIPAA Enforcement Rule are the requirements for HIPAA compliance.
● The Standards for Privacy of Individually Identifiable Health Information, commonly known as the HIPAA
Privacy Rule, establishes the first national standards in the United States to protect patients' personal or
protected health information (PHI).
● The Security Standards for the Protection of Electronic Protected Health Information, commonly known as
the HIPAA Security Rule, establishes national standards for securing patient data that is stored or transferred
electronically.
● Nurse gives discharge papers to the wrong individual,Billing statements containing PHI mailed or faxed to the
wrong individual/entity etc are examples of breach in HIPAA.

Test your knowledge!
Quiz
Quiz

Health Insurance Portability and Accountability Act
Health Insurance Portability and Accuracy Act
Health Insurance Policy and Accuracy Act
None of the above
Which of the following
is the abbreviation of
HIPAA?
16

True
False
State true or false.
HIPAA Health
Insurance Reform
protects health
insurance coverage for
individuals who lose or
change jobs.
17

5
7
10
None of the above
The National Provider
Identifier number must
have a unique ___
digits.
18

Health Plan
Healthcare clearinghouse
Healthcare provider
All of the above
are the entities covered
by HIPAA?
19

Laptop containing PHI is stolen
Receptionist who is not authorized to access PHI
looks through patient files in order to learn of a
person’s treatment
Nurse gives discharge papers to the right individual
Billing statements containing PHI mailed or faxed
to the wrong individual/entity
is not an example of
breach in HIPAA?
20

a patient's name, address, birth date, Social
Security number, biometric identifiers or
other personally identifiable information (PII);
an individual's past, present or future physical
or mental health condition;
any care provided to an individual;
employment records, including information
about education;
information is not
included in PHI?
21

HIPAA Privacy Rule
HIPAA Security Rule
None of the above
The Security Standards
for the Protection of
Electronic Protected
Health Information is
commonly known as
_____.
22

Reviewing HIPAA guidelines
Reviewing HIPAA updates
Addressing security gaps
Personal information of patients
HIPAA Compliance
checklist does not
include?
23

True
False
The federal law of
HIPAA was signed by
President Bill Clinton.
24

Electronically Performed Health Information
Electronic Protected Health Information
Easily Protected Health Information
None Of The Above
ePHI stands for _____.
25

Thank You
KloudLearn, Inc. is headquartered in Silicon Valley, California. Our mission is to help
enterprises provide an engaging and impactful learning experience that improves
business performance. We provide the industry’s most modern LMS (Learning
Management System). For more information visit us at www.kloudlearn.com or reach
out to us at info@kloudlearn.com

Health Insurance Portability and Accountability Act (HIPPA) - Kloudlearn

Recommended

Recommended

More Related Content

What's hot

What's hot (20)

Similar to Health Insurance Portability and Accountability Act (HIPPA) - Kloudlearn

Similar to Health Insurance Portability and Accountability Act (HIPPA) - Kloudlearn (20)

More from KloudLearn

More from KloudLearn (8)

Recently uploaded

Recently uploaded (20)

Health Insurance Portability and Accountability Act (HIPPA) - Kloudlearn