HIPAAstandard

HIPAA is a United States federal law that creates national standards to protect individuals' medical records and other personal health information, known as protected health information (PHI). The Health Insurance Portability and Accountability Act of 1996 was enacted to improve the portability and continuity of health insurance coverage and to combat waste, fraud, and abuse in health insurance and healthcare delivery. Key components of HIPAA include the Privacy Rule and the Security Rule.

The Privacy Rule establishes national standards for protecting all individuals' medical records and other identifiable health information. It sets limits and conditions on the uses and disclosures of PHI that may be made without patient authorization. It also gives patients rights over their health information, including rights to examine and obtain a copy of their health records, and to request corrections.

The Security Rule establishes national standards for protecting electronic protected health information (ePHI) that is created, received, maintained, or transmitted by a covered entity. Covered entities must implement administrative, physical, and technical safeguards to protect the confidentiality, integrity, and availability of ePHI. These safeguards are designed to prevent unauthorized access, use, or disclosure of ePHI.

HIPAA applies to covered entities, which include most healthcare providers, health plans, and healthcare clearinghouses. Business associates, which are entities that perform certain functions or activities involving PHI on behalf of a covered entity, are also subject to HIPAA's requirements. Enforcement of HIPAA is carried out by the U.S. Department of Health and Human Services, Office for Civil Rights (OCR).