The Health Insurance Portability and Accountability Act (HIPAA) of 1996 set
the standards for securing health information and protecting privacy. This
federal legislation was critical as healthcare organizations transitioned to
electronic health records (EHRs). EHRs improve continuity of care because
data can be easily shared among clinics, hospitals, and providers, but
standards are necessary to ensure the transmission and exchange of
information is secure (Oachs & Watters, 2020).
There are three regulations within HIPAA that protect health information and
provide patient rights regarding their health information. The Privacy Rule
pertains to how the health information is used and to who it is given. It also
sets standards for patients' rights to access their health information and
control how it is used and shared. The Security Rule takes the standards
outlined in the Privacy rule and puts them into action. This rule describes the
administrative, physical, technical, and organizational safeguards that need
to be utilized to ensure that protected health information is secure. The
Breach Notification Rule requires entities to inform patients when their data
has been breached. This rule also requires entities to have procedures in
place to investigate when health information is used or shared without
authorization (Oachs & Watters, 2020).
Laws that protect patient health information are necessary because this
information contains confidential and sensitive information. Laws and
regulations help determine what is considered protected health information,
how it should be managed, and penalties for non-compliance. Patients trust
that their healthcare practitioners and organizations will keep their
information secure. If patients are concerned that their health information
may be mishandled, this may deter them from seeking care.
Oachs, P., & Watters, A. (2020). Health information management: Concepts,
principles, and practice (6th ed.). AHIMA, American Health Information
Management Association.
