Understanding HIPAA in 2024, PHI and the Four Main HIPAA Rules, Including the new Omnibus Rule

HIPAA, which stands for the Health Insurance Portability and Accountability Act, is a regulatory standard passed by the US Congress in 1996. It's a federal law and standard that ensures the privacy and security of Protected Health Information (PHI).

What is Protected Health Information (PHI)

PHI refers to individually identifiable health information. Essentially, all health information is considered PHI when it includes individual identifiers.

To provide more clarity, here is a list of 18 identifiers that qualify health information as PHI data:

• Name
• Date
• Telephone number
• Geographic data
• Fax number
• Social Security number
• Email addresses
• Medical record numbers
• Account numbers
• Health plan beneficiary numbers
• Certificates or license numbers
• Vehicle identifiers
• Web URLs
• Device identifiers
• Internet protocol addresses
• Full face photo
• Biometric identifiers
• Any unique identifying number or code

Under HIPAA compliance, PHI data can be any information in the form of a physical record, electronic records, or even spoken information.

HIPAA compliance is applicable to healthcare providers, health plans, health clearinghouses, and business associates. When it comes to healthcare providers, this can include nursing homes, clinics, pharmacies, and hospitals. Health plans can include health insurance companies, company health plans, and government programs like Medicare or military and veteran programs that pay for healthcare.

Healthcare clearinghouses include public and private entities that process health information, such as billing services, accounting companies, or community health management service providers.

Business associates include third-party administrators, billing companies, transcriptionists, cloud service providers, data storage firms, EHR providers, data disposal or shredding companies, consultants, attorneys, CPA firms, claim processors, or collection agencies.

The HIPAA 4 Main Rules

HIPAA compliance is governed by four main rules:

• The Privacy Rule, detailing how PHI can be used or disclosed.
• The Security Rule, including necessary standards and safeguards to protect electronic PHI at rest or in transit.
• The Breach Notification Rule, requiring organizations to notify patients and authorities in case of a PHI data breach.
• The Omnibus Rule: The HIPAA Omnibus Rule added genetic health information into the definition of Protected Health Information and expressly prohibited health plans from using or disclosing genetic information for underwriting purposes.

These HIPAA guidelines are identified and defined in a series of interlocking regulations known as the HIPAA rules.

1. The HIPAA Privacy Rule

First, the HIPAA Privacy Rule includes national standards that all covered entities must address within their business. These standards safeguard the privacy of patient data or Protected Health Information (PHI). It protects PHI from unauthorized use or disclosure.

2. The HIPAA Security Rule

The HIPAA Security Rule protects electronic PHI (ePHI). This rule requires appropriate safeguards to maintain the integrity, availability, and confidentiality of ePHI. Healthcare organizations must implement physical, technical, and administrative safeguards to secure patient information.

• Physical safeguards include alarm systems, security systems, and lockdown areas where PHI or ePHI is stored.
• Technical safeguards protect the cybersecurity of your business and include firewalls, encryption, and data backup.
• Administrative safeguards ensure that staff members are properly trained to execute the security measures in place.

3. Breach Notification Rule

The Breach Notification Rule outlines the processes that HIPAA covered entities must follow in the event of a data breach. Entities are required to notify each person affected within 60 days of discovering the breach.

4. The HIPAA Omnibus Rule

The HIPAA Omnibus Rule is specifically designed to extend the HIPAA protection of an individual's PHI for a period of up to 50 years following their death. This rule is noteworthy because it ensures the continuity of privacy and security measures for personal health information, even after the individual's demise.

It is a testament to the comprehensive nature of HIPAA's protective measures and its commitment to preserving the confidentiality of PHI in all circumstances.

In addition to this, the Omnibus Rule also provides more flexibility to covered entities in terms of disclosing the PHI of the deceased. This aspect of the rule allows healthcare providers and other entities to share the decedent's PHI with individuals who were involved in providing care or payments for the deceased prior to their passing.

This provision recognizes the practical needs of those who were involved in the individual's care and payment processes, while still maintaining the overarching principle of safeguarding PHI.

The HIPAA Omnibus Rule mandates that business associates must be HIPAA compliant. It also outlines the rules surrounding Business Associate Agreements (BAAs), which are contracts that must be executed before any PHI or ePHI can be transferred or shared.

HIPAA Penalties

All entities covered under HIPAA compliance are expected to comply with these rules. The Department of Health and Human Services' Office for Civil Rights is responsible for the enforcement of HIPAA compliance. Non-compliance can result in financial penalties of $50,000 per incident, or up to $1.5 million per violation category per year.

If HIPAA violation persists for several years, or if multiple violations of HIPAA rules are discovered, multi-million dollar fines or even criminal penalties may be imposed.

Conclusion

In conclusion, HIPAA is an essential federal law that protects the privacy and security of Protected Health Information (PHI). Its four main rules provide a comprehensive framework to ensure the confidentiality, integrity, and accessibility of PHI data. It's applicable across healthcare providers, health plans, health clearinghouses, and business associates.

Comprehending and adhering to these rules is crucial, as non-compliance can lead to hefty fines or even criminal penalties. It is vital for all involved entities to understand their responsibilities under HIPAA to ensure the protection of sensitive health information.