This document discusses HIPAA privacy and security rules for protecting patient health information. It outlines that the HIPAA Privacy Rule provides protections for personal health information and gives patients rights over that information. The Security Rule specifies administrative, physical and technical safeguards for electronic protected health information. The document also notes that health plans, most healthcare providers, and healthcare clearinghouses are considered covered entities that must follow HIPAA regulations. These covered entities must implement safeguards to protect patient information and limit access to only those who need it to do their jobs. Employees are responsible for upholding HIPAA and can be terminated for violations.

1. HIPPA/Security in Healthcare
By
Betty Davis

2. HIPPA
• Understanding Health Information Privacy
• The HIPAA Privacy Rule provides federal protections for personal
health information held by covered entities and gives patients an
array of rights with respect to that information. At the same time,
the Privacy Rule is balanced so that it permits the disclosure of
personal health information needed for patient care and other
important purposes.

3. Security
• The Security Rule specifies a series of administrative, physical, and
technical safeguards for covered entities to use to assure the
confidentiality, integrity, and availability of electronic protected
health information.

4. Healthcare Providers
• Who Must Follow These Laws
• We call the entities that must follow the HIPAA regulations covered entities.
• Covered entities include:
• Health Plans, including health insurance companies, HMOs, company health plans,
and certain government programs that pay for health care, such as Medicare and
Medicaid.
• Most Health Care Providers—those that conduct certain business electronically,
such as electronically billing your health insurance—including most doctors, clinics,
hospitals, psychologists, chiropractors, nursing homes, pharmacies, and dentists.
• Health Care Clearinghouses—entities that process nonstandard health
information they receive from another entity into a standard (i.e., standard
electronic format or data content), or vice versa.

5. Protection
• How Is This Information Protected
• Covered entities (healthcare facilities) must put in place safeguards
to protect the patient health information.
• Covered entities must reasonably limit uses and disclosures to the
minimum necessary to accomplish their intended purpose.
• Covered entities must have contracts in place with their contractors
(providers) and others ensuring that they use and disclose your
health information properly and safeguard it appropriately.
• Covered entities must have procedures in place to limit who can
view and access your health information as well as implement
training programs for employees about how to protect your health
information.

6. Enforcement
• All employees are responsible for up holding HIPPA/Security Act.
Those employees that are found in violation will be terminated.
• It is against the law to violate the patient’s rights by sharing their
healthcare information.
• Contracts are signed by each employee agreeing to up hold all rules
and regulation of the healthcare facility. A binding contract.

7. References
• http://www.hhs.gov/ocr/privacy/psa/enforcement/index.html