HIPAA (Health Insurance Portability and Accountability Act of 1996) is United States legislation that provides data privacy and security provisions for safeguarding your medical information.
The law emerged into greater prominence in recent years with the proliferation of health data breaches caused by cyberattacks and ransomware attacks on health insurers and providers.
The act, which was signed into law by President Bill Clinton on Aug. 21, 1996, contains five sections, or titles.
Title I, HIPAA Health Insurance Reform
Title I protects health insurance coverage for individuals who lose or change jobs. It also prohibits group health plans from denying coverage to individuals with specific diseases and pre-existing conditions, and from setting lifetime coverage limits.
Title II: HIPAA Administrative Simplification
Title II directs the U.S. Department of Health and Human Services (HHS) to establish national standards for processing electronic healthcare transactions. It also requires healthcare organizations to implement secure electronic access to health data and to remain in compliance with privacy regulations set by HHS.
Title III: HIPAA Tax-Related Health Provisions
Title III includes tax-related provisions and guidelines for medical care.
Title IV: Application and Enforcement of Group Health Plan Requirements
Title IV further defines health insurance reform, including provisions for individuals with pre-existing conditions and those seeking continued coverage.
Title V: Revenue Offsets
Title V includes provisions on company-owned life insurance and the treatment of those who lose their U.S. citizenship for income tax purposes.
Hippa: Coverage and Compliance
Hippa: What information is protected?
The HIPAA Privacy Rule protects all individually identifiable health information that is held or transmitted by a covered entity or a business associate. This information can be held in any form, including digital, paper or oral. This individually identifiable health information is also known as PHI under the Privacy Rule.
Hippa: What is considered protected health information under HIPAA?
- a patient’s name, address, birth date and Social Security number;
- an individual’s physical or mental health condition;
- any care provided to an individual; or
- information concerning the payment for the care provided to the individual that identifies the patient, or information for which there is a reasonable basis to believe could be used to identify the patient.
HIPAA Penalties
Under the HIPAA Privacy Rule, falling victim to a healthcare data breach, as well as failing to give patients access to their Protected Health Information, could result in a fine.
The minimum penalties are:
- Unknowingly violating HIPAA is $100 per violation, with an annual maximum of $25,000 for repeat violations.
- Reasonable cause for violating HIPAA is $1,000 per violation, with an annual maximum of $100,000 for repeat violations.
- Willful neglect of HIPAA, but the violation is corrected within a given time period, is $10,000 per violation, with an annual maximum of $250,000 for repeat violations.
- Willful neglect of HIPAA, and the violation remains uncorrected, is $50,000 per violation, with an annual maximum of $1.5 million for repeat violations.
The maximum penalty for all of these is $50,000 per violation, with an annual maximum of $1.5 million for repeat violations.
Covered entities and individuals who intentionally obtain or disclose PHI in violation of the HIPAA Privacy Rule can be fined up to $50,000 and receive up to one year in prison. If the HIPAA Privacy Rule is violated under false pretenses, the penalties can be increased to a $100,000 fine and up to 10 years in prison.