HIPAA Privacy Rule

HIPAA Privacy Rule

The Privacy Rule is intended to protect the privacy of all individually identifiable health information in the hands of covered entities, regardless of
whether the information is or has been in electronic form. The rule establishes the first “set of basic national privacy standards and fair information
practices that provides all Americans with a basic level of protection and peace of mind that is essential to their full participation in their care”.

Privacy Standards
•    Give patients new rights to access their medical records, restrict access by others, request changes, and to learn how they have been accessed
•    Restrict most disclosures of protected health information to the minimum needed for healthcare treatment and business operations
•    Provide that all patients are formally notified of covered entities' privacy practices
•    Enable patients to decide if they will authorize disclosure of their protected health information (PHI) for uses other than treatment or healthcare business operations
•    Establish new criminal and civil sanctions for improper use or disclosure of PHI
•    Establish new requirements for access to records by researchers and others
•    Establish business associate agreements with business partners that safeguard their use and disclosure of PHI.
•    Implement a comprehensive compliance program, including
o    Conducting an impact assessment to determine gaps between existing information practices and policies and HIPAA requirements
o    Reviewing functions and activities of the organization's business partners to determine where Business Associate Agreements are required
o    Developing and implementing enterprise-wise privacy policies and procedures to implement the Rule
o    Assigning a Privacy officer who will administer the organizational privacy program and enforce compliance
o    Training all members of the workforce on HIPAA and organizational privacy policies
o    Updating systems to ensure they provide adequate protection of patient data