Introduced in 1996, the Health Insurance Portability and Accountability Act (HIPAA) is widely used for safeguarding the privacy of health information.  In this first installment of a three part series, the history and background of HIPAA are discussed, as excerpted from the book authored by HCC CEO Bob Cimasi, entitled, Healthcare Valuation: The Financial Appraisal of Enterprises, Assets, and Services, to be published by John Wiley & Sons later this year, and the recent amendment are introduced. Part II of the series, due next month, will address the implications of recent changes to HIPAA that have resulted from the transition of patient information to an electronic format and the continued integration of providers, while, Part III assesses various compliance concerns and related privacy laws.

The Health Insurance Portability and Accountability Act (HIPAA) was signed into law on August 21, 1996, and encourages the development of health information systems, as well as regulating access to, and safeguarding the privacy of, individually identifiable health information.¹ The final standards for HIPAA, created by the Department of Health and Human Services (HHS) were published on August 17, 2000.²   While HIPAA serves many purposes, it is most widely used for safeguarding the privacy of Protected Health Information (PHI), i.e., individually identifiable health information.³  This protection extends to information related to the “…past, present or future physical or mental health condition of an individual; the provision of healthcare services to an individual; or the past, present or future payment for the provision of healthcare to an individual.”⁴ The HIPAA Privacy Rule provides standards for the use and disclosure of PHI by covered entities, as well as rights for individuals to control how their PHI is used.⁵ Covered entities include such companies as, “…health plans, healthcare clearinghouses, and any health care provider who transmits health information in electronic form in connection with a transaction for which the Secretary of HHS has adopted [HIPAA] standards.”⁶ 

Transactions by healthcare providers falling under the Privacy Rule include claims, benefit eligibility inquiries, referral authorization requests, and other transactions for which HHS has established particular standards.⁷ These transactions are covered regardless of whether they are performed by the healthcare provider, a billing service, or any other third party under contract with the provider.⁸    When a covered entity contracts with a third party entity to perform billing or other business associate activities, such as claims processing, data analysis, or utilization review, the covered entity must impose specific safeguards to protect PHI.⁹ Unintentional HIPAA violations carry fines of $100 per occurrence, up to $25,000 per year. However, intentional HIPAA violations carry criminal penalties that include fines of up to $250,000 and ten years in prison.¹⁰ Significantly, however, HIPAA does not provide for private rights of action for patients who were harmed by the dissemination of their PHI; but rather it provides patients with the option of filing a complaint with the HHS Office for Civil Rights (OCR) in the event of a violation that resulted in harm to the patient.¹¹ The proper destruction of PHI is also protected under HIPAA.¹²

As the healthcare industry transitions to electronic transactions, the current version of the HIPAA standards that regulate the transmission of specific health care information, known as the Accredited Standards Committee X12 Version 4010/4010AI, have become increasingly less functional for the coding and transactional updates providers are currently required to accommodate (i.e., the coming ICD-10 transition). To rectify any inefficiency, HHS approved ASC X12 Version 5010,¹³  which improvements in Version 5010 include technical, structural, and data content requirements; transactional business standardization; data transmission specifications, and, delineation of various patient codes.¹⁴ The transition to HIPAA Version 5010 will likely affect many healthcare industry stakeholders, including providers, health plans, healthcare clearinghouses, and business associates that participate in electronic transactions, such as billing/service agents and vendors.¹⁵  According to a 2011 Medical Group Management Association report, 45 percent of practices would have to replace their practice management systems completely to manage Version 5010, and 50.3 percent of practices would need to install upgrades to accommodate Version 5010.¹⁶  See HC Topics article HIPAA Version 5010: What and When.

One of the most significant amendments to HIPAA was passed under the American Recovery and Reinvestment Act of 2009 (ARRA), signed into law February 17, 2009. The ARRA amended HIPAA’s health information privacy and security provisions, and created funding incentives for the widespread implementation of healthcare information technology, specifically electronic health records (EHR), through the Health Information Technology for Economic Clinical Health (HITECH) Act, a portion of the ARRA.¹⁷ For more information of HITECH see HC Topics Article Obama Signs HITECH Act for Healthcare IT.

The latest amendment to the HIPAA legislation was published on January 25, 2013 in a Final Rule from HHS and OCR, which may significantly affect business associates and their subcontractors. The Final Rule changes: (1) the definition of business associate under HIPAA; (2) the liability of business associates and subcontractors under HIPAA; and, (3) the level at which agreements between business associates and covered entities are scrutinized under HIPAA. Each of these changes and their potential impact on covered entities and their business associates will be discussed in Part II of the HC Topics HIPAA Series.