What does HIPA mean in MEDICAL

HIPAA stands for the Health Insurance Portability and Accountability Act, which is a federal law that sets standards for the protection of sensitive patient health information held by covered entities (generally healthcare providers and their business associates). These standards are designed to protect this information from unauthorized access or use.

All covered entities (such as hospitals, physicians and other healthcare providers) who electronically transmit health information in connection with certain transactions as well as any of their “business associates” are required to comply with HIPAA regulations.

HIPAA covers all “individually identifiable health information”, or protected health information (PHI). PHI includes personal information such as name, address, Social Security numbers, medical records, test results and treatment records.

The primary goal of the Privacy Rule is to ensure the confidentiality, integrity, and availability of individually identifiable health information. The Security Rule provides security standards governing access control; transmission security; audit controls; integrity measures which ensure accuracy; authentication procedures to ensure proper identification of parties who have access to PHI; and physical safeguards like secure disposal.

Companies that are compliant with HIPAA must undergo an annual review from an independent auditor and have documentation in place that allows them to demonstrate compliance with the regulations. It’s important to note that while a company may claim they are compliant with HIPAA, it's best practice to request copies of their audit report prior to engaging in any business relationship involving PHI.

As a covered entity or business associate you should take steps such as implementing password management protocols for electronic systems; encrypting all transmission containing PHI; conducting background checks on employees who will be handling PHI; providing training on how to handle protected data; regularly monitoring system security logs for suspicious activities; regularly patching systems for vulnerabilities; and having Disaster Recovery Plans in place.

Yes. Violations fall into four categories ranging from minor non-compliance issues such as lack of written policies or failure to document requests for disclosures all the way up to violations resulting in harm or death due to willful neglect such as deliberately not taking appropriate steps when informed of an attempted breach. Penalties can include civil money penalties ranging from $100 per violation up up to $50,000 per violation (with an annual cap of $1.5 million), criminal fines up $250,000 and/or imprisonment up five years.

Compliance enforcement falls on various agencies dependant on what type entity you are -- whether it be healthcare providers or business associates. Generally speaking enforcement falls on either HHS/OCR (Office for Civil Rights) or FTC (Federal Trade Commission). States may also have their own enforcement agencies which investigate complaints regarding potential violations.