HIPAA Guidelines for Employers

In 1996 the U.S. Congress instituted the Health Insurance Portability and Accountability Act (HIPPA) in response to the need to protect patient health care information. HIPPA is a federally regulated act with standards that covered entities must adhere to.

Privacy Guidelines

According to HIPAA's privacy rule, individually identifiable health information, such as a patient's name, date of birth and social security number, must be kept confidential and only used for the purpose of providing treatment. While handling patient information, it must never be left unattended or out in the open where coworkers, clients or others can see.

Security Guidelines

Under HIPAA's security rule, medical records must be secured in a way that is inaccessible to unauthorized users. For hard copies of medical charts, the files must be kept locked in a room or file cabinet. For employers that maintain electronic patient data in their computer systems, computers must be secured with password protection features.

Disclosures

Employers shall obtain written consent from patients in order to disclose health information to entities for purposes beyond the scope of treatment. Disclosing patient information without authorization is a federal violation, punishable by fines and/or jail time. However, if information is subpoenaed by a federal court, the information can be turned over without the patient's consent.

References

• Department of Health and Human Services: Health Information Privacy
• Department of Health and Human Services: Summary of the HIPAA Privacy Rule