Who Needs HIPAA Certification?

The Privacy Rule applies to electronically transmitted information.

According to the U.S. Department of Health & Human Services (HHS), the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy Rule requires health care providers to protect the privacy of a patient's health information.

Who Must Comply

HIPAA's Privacy Rule applies to health care providers--including doctors, nurses, clinics, psychologists and others who transmit covered health care information in an electronic form. It also applies to health plans and health care clearinghouses that process electronic information. The rule applies to individuals, organizations and agencies.

Requirements

HIPAA requires providers to tell patients about their privacy rights, set up procedures to protect patient privacy, train employees to follow the procedures, designate someone to monitor compliance and keep patient records secure.

Compliance

HHS' Office for Civil Rights enforces the Privacy Rule by responding to complaints and reviewing providers' procedures to verify that they are in compliance. They also provide education and outreach.

Certification

The law does not require certification. According to the Code of Federal Regulations, the provider must supply records and compliance reports on request and must cooperate with complaint investigations and reviews.

Further Information

The law requires providers to evaluate their compliance regularly. Some opt to hire an outside consultant to conduct the evaluation and certify compliance.

References

• U.S. Department of Health & Human Services
• 45 CFR (Code of Federal Regulations), Part 160
• HIPAA Certification.net

Resources

• American Academy of Family Physicians