HIPAA was enacted in 1996 to protect patients' health insurance and personal health information. It requires covered entities like healthcare providers, insurers, and their business partners to implement procedures to protect protected health information (PHI), such as patients' medical records. These entities must designate a privacy officer, train staff on privacy policies, and obtain patient acknowledgement of their privacy practices. HIPAA also dictates exceptions for uses of PHI, such as for treatment, payment, healthcare operations, and with patient authorization.

1. HIPPA Privacy and Security
Awareness
Charles Taft
MHA690: MHA690: Health Care Capstone (NDL1523A)
Instructor: Hwang-Ji Lu

2. Introduction
• Protect patients from losing their health insurance if they change jobs or have
pre-existing health conditions.
• Reduce cost and administrative burdens by creating standard electronic
formats.
• Implement standards and requirements to protect the privacy and security of
health information.
The Health Insurance Portability and Accountability Act (HIPPA) was enacted
by Congress in 1996, during the Aids crisis. HIPAA serves 3 main purposes
(National Safety Compliance, 2009):

3. HIPPA Privacy and Security
• Healthcare insurance companies
• Healthcare providers
• Healthcare clearinghouses
• Business associates of covered entities, which include auditors, consultants,
lawyers, data and billing firms, etc.
The HIPAA Privacy and Security Rules dictate all who come in contact with
protected health information (PHI) go through training on HIPPA policy and
relevant documentation is kept (National Safety Compliance, 2009). Entities
covered by the Privacy and Security Rules include:

4. Protected Health Information
Regardless of the form, notes on a medical health
record, information entered into a computer or
discussions about a patients diagnosis becomes PHI
under HIPPA.

5. Exclusions to PHI
• Authorization by patients in writing.
• Purpose of research or public health with proper
consent.
• When patient has the opportunity to agree or
object when there is an accompany party

6. Notice of Privacy Practices
Facilities are required to provide patients with a
Notice of Privacy Practices, while obtaining patient
written acknowledgment.

7. Administrative Safeguards
• A Privacy Officer must be designated for the
purpose of developing and implementing policy.
• All staff members must receive adequate training
on privacy policies and procedures.
• External sources and associates must consent to
protect PHI.
• A tracking system must be in place to monitor
and/or address violations to such information.

8. Reference
National Safety Compliance: HIPAA privacy and
security awareness. (2009). National Safety
Compliance, Inc.