12 Slide Power Point & 1 Page Summary

Cite your sources in a clickable reference list at the end. Do not copy without providing proper attribution (quotation marks and in-line citations). Write in essay format not in bulleted, numbered or other list format.

It is important that you use your own words, that you cite your sources, that you comply with the instructions regarding length of your submission Do not use spinbot or other word replacement software. It usually results in nonsense and is not a good way to learn anything. I will not spend a lot of my time trying to decipher nonsense. Proof read your work or have it edited. Find something interesting and/or relevant to your work to write about.

Project Proposal Topic

HIPAA Compliance

In 1996, the United States Congress passed the Health Insurance Portability and Accountability Act (HIPAA), one of the purposes of which was to simplify and standardize the administrative functions of healthcare. The Administrative Simplification provisions of this law require an adaptation and implementation of standards for the privacy, security and arrangement of electronic healthcare transactions. The Health Information Technology for Economic and Clinical Health Act of 2009 (HITECH Act) of the American Recovery and Reinvestment Act of 2009 (ARRA) contains provisions that significantly affected the HIPAA Privacy and Security Rules. The HIPAA Privacy Rule and the HIPAA security Rule (collectively, the “HIPAA Rules”) were issued by the United States Department of Health and Human Services in 2002 and 2003, respectively. A second goal of HIPAA was to prevent healthcare fraud and ensure that all ‘protected health information’ was appropriately secured and to restrict access to health data to authorized individuals.

Prior to HIPAA, no generally accepted set of security standards or general requirements for protecting health information existed in the health care industry. At the same time, new technologies were evolving, and the health care industry began to move away from paper processes and rely more heavily on the use of electronic information systems to pay claims, answer eligibility questions, provide health information and conduct a host of other administrative and clinically based functions. “A major goal of the Security Rule is to protect the privacy of individuals’ health information while allowing covered entities to adopt new technologies to improve the quality and efficiency of patient care” (HHS Office of the Secretary, 2013)

The Technical Safeguards focus on the technology that protects PHI and controls access to it. The standards of the Security Rule do not require to use specific technologies. The Security standards were designed to be "technology neutral. “Failure to comply with HIPAA regulations can result in substantial fines being issued and criminal charges and civil action lawsuits being filed should a breach of ePHI occur. There are also regulations be aware of covering breach reporting to the OCR and the issuing of breach notifications to patients.” (HIPAA JOURNAL, 2018)

“HIPAA requires covered entities and business associates to conduct annual audits of their organization to assess Administrative, Technical, and Physical gaps in compliance with HIPAA Privacy and Security standards. Under HIPAA, a Security Risk Assessment is NOT ENOUGH to be compliant–it’s only one essential audit that HIPAA-beholden entities are required to perform in order to maintain their compliance year-over-year.” (Sivilli, 2019)

In our organization, our entire eco system is cloud based servers providing a myriad of functions and services in support of the inhabitants. Many of these services include the collection and/or use of PHI resulting in the maintenance and use of both physical and ePHI. We recently had a need to contract with an outside CONSULTANT to assess the Company’s compliance efforts as a Hybrid Entity regarding HIPAA Privacy and Security and the HITECH/OMNIBUS Act. This assessment will note current effort status and identify deficiencies.