HIPAA Implementation Specifications

HIPAA implementations follow certain guidelines.

The Health Insurance Portability and Accountability Act (HIPAA) of 1996 created standards for treatment of individuals' private health care information. There are specific ways in which HIPAA is implemented in a health-care setting.

Types

Health-care organizations must have written policies and procedures that are consistent with HIPAA regulations. They must also have a specific person assigned to ensuring that protected information is kept private and secure. This person is responsible for training other employees regarding the guidelines set forth by HIPAA, ensuring that all regulations are followed, and disciplining employees that do not comply with HIPAA.

Significance

By requiring an organization to set policies and procedures in writing and appointing a specific individual in charge of ensuring compliance, organizations are held accountable. Providing specification for the implementation of HIPAA also makes it easier and quicker for organization to become compliant with privacy and security regulations.

Considerations

Organizations may be designated as "hybrid entities" if only a selected number of functions of the organization meet the requirements to be a covered entity under the HIPAA act. These organizations must designate in writing which components are health-care related and thus must comply with HIPAA regulations, otherwise the entire organization must comply.

References

• Department of Health and Human Services: Summary of the HIPAA Security Rule
• Department of Health and Human Services: Summary of the HIPAA Privacy Rule