Category: HIPAA

According to the Health insurance Probability and Accountability Act (HIPAA) privacy rule, there are two methods for De-identification of Protected Health Information (PHI). Safe Harbor method is one of the De-identification methods. The HIPAA privacy rule set the limits to which extent we can use the PHI and disclosure of the same. The HIPAA Privacy Rule protects most “ individually identifiable health information” held or transmitted by a covered entity or its business associate, in any form or medium, whether electronic, on paper, or oral which is called Protected Health information (PHI). Protected health information is nothing but information about an individual’s total physical and mental health condition and total payments done for or by him and the health care received by him.

The HIPAA Safe Harbor method is used to De-indentify protected health information. De-indentification is the process of removing specific information about an individual. That specific information can be used alone or in combination with other individuals’ (family members, relatives, and employees) information to identify the individual. The specific requirements of the HIPAA Safe harbor De-indentification process is satisfied only if the remaining information (after removal of specific identifiers) about the individual could not be used to identify the individual. Once PHI is de-identified, then that particular individual information is no longer belongs to PHI, which means there will be no limits or restrictions on the usage or disclosure of the information. In short de-identified protected health information no longer can be used to identify the individual.

Accord ng to Safe Harbor guidelines, specific categories must be removed or managed properly for the information to be used or revealed. These specific categories of the individual or his relatives and family members can be used individually or in combination to identify the information.

The specific categories of the individual or his family members and relatives include:

Names, Dates, Geographic identifiers, Telephone numbers, vehical identifiers (license plate number) and serial numbers, Fax numbers, Device identifiers, and serial numbers, Email addresses, Web universal resource locators, Social security numbers, internet Protocol addresses, Medical record numbers, Biometric identifiers (finger and voice prints), Health plan beneficiary numbers, Full-face photographs and any related mages, Account numbers, Any other unique dentifying numbers, Certificate or license numbers, Records unique to the individual, Anything you are unsure of. The geographic unit formed by combining all ZiP codes with the same three initial digits contains more than 20,000 people. The initial three digits of a ZIP code for all such geographic units containing 20,000 or fewer people are changed to 000.

Once the above specific information is removed, the covered entity must have no actual knowledge that the remaining information can be used to identify the individual. Once the ‘no actual knowledge’ requirement is satisfied, then protected health information has been successfully de-identified using the safe harbor method.

According to Morrison (2017), ‘The Safe Harbor method – More than just protect ng patients’. By using the Safe Harbor method you can obtain data sets that can be used while staying with HIPAA. By de-identifying individuals’ information, we can keep patients safe.

There are so many reasons why an entity wants to de-identify certain PHI. Once information have been de-identified, the information no longer considered PHI and can be used for uses that are becoming increasingly popular. These uses include for research purposes, comparative studies. Once the information has been de-identified, the information is no longer belongs PHI, and can therefore be used in many other situations. For example, certain types of research or comparative studies could benefit from medical information. In addition, de-identified information can be shared, allowing for entities to collaborate in research efforts.

References

1. Group, C. (2019, August 8). What is the HIPAA safe harbor provision? Compliancy Group. https://compliancy-group.com/what-is-the-hipaa-safe-harbor-provision/
2. Methods for de-identification of PHI. (2015, November 6). HHS.gov. https://www.hhs.gov/hipaa/for-professionals/privacy/special-topics/de-identification/
3. Morrison, K. (2017, April 13). The HIPAA safe harbor method: More than just protecting patients. Chiropractic Economics. https://www.chiroeco.com/hipaa-safe-harbor

I had no idea that there were so many “levels” of HIPAA and patient rights. All the different rules and regulations for the special topics, the depth of the Patient Safety Rule, the involvement of the OCR. Even though there was an overwhelming amount of information to research through, a lot of it seemed somewhat familiar. This paper discusses some points I found that I actually learned about.

What is HIPAA? HIPAA is the Health Insurance Portability and Accountability Act founded in 1996. This act was issued by the US Department of Health and Human Services (HHS). The rules of HIPAA follow the HIPAA Privacy Rule, which consist of safeguards that protect patient’s privacy and health information. HIPAA states rules and regulations as to who is permitted to access Personal Health Information (PHI) without patient consent.

There is a Security Rule in place that protects health information which is electronically stored (e-PHI). A covered entity creates this e-PHI, receives, maintains or transmits this information in electronic form. Some of the safeguards that are in place are physical, technical and administrative (HHS Office of the Secretary, Office for Civil Rights, & OCR. (2013, July 26) Summary of the HIPAA Security Rule).

Administrative Simplification is a part of HIPAA and the Affordable Care Act (ACA) which requires a covered entity to adopt standard electronic transactions, codes, operating rules and identifiers in order to become a more efficient electronic sharing entity in the healthcare industry (HHS Office of the Secretary, Office for Civil Rights, & OCR. (2013, July 26) Summary of the HIPAA Security Rule).

I also learned the steps to take for a Cyber Attack. I’ve always had an IT department to take care of it, but hopefully someday, I’ll be in a management position and might be responsible for something like this.

1. Call your IT department or an outside company to help fix any technical problems from the attack and/or to stop the event.
2. Report the incident to state or local law enforcement, FBI and/or the Secret Service. Do not include any confidential information.
3. All cyber threat indicators should be reported to federal and info-sharing and analysis organization (ISAOs). Again, do not include any confidential health information.
4. An assessment must be done to determine if any PHI has been breached. If the assessment finds that there has been a breach, see step 5. If the assessment determines that no breach has occurred, then all documentation of the event must be kept and retained, including how it was found that no breach occurred.
5. If a breach occurred, the event must be reported to the OCR ASAP, no later than 60 days after the determination that the breach occurred. If the breach affects 500 people or more, then those affected must be notified. (My entity just experienced a cyber-attack! What do we do now? A quick response checklist from the HHS, Office for Civil Rights (OCR). (n.d.)).

I also learned quite a bit more about the things that The Office for Civil Rights (OCR) is responsible for. The OCR handles complaints filed with the HIPAA Privacy and Security Rules. One way they do this is to perform compliance reviews to make sure that covered entities are in compliance. They also perform outreach and education to enhance compliance with the Privacy and Security Rules ((HHS Office of the Secretary, Office for Civil Rights, & OCR. (2017, June 7) Enforcement Process). OCR may or may not take action on cases presented to them. Normally, they will take action if the case involves a covered entity, such as a health insurance company, a physician, a hospital, etc. They won’t accept cases that involve a non-covered entity, such as employers, schools, workers comp carriers, etc. Once OCR accepts a complaint, the complainant and the covered entity are both informed and are asked to present information (sometimes very specific) related to the incident. If the OCR finds an action that may possibly be a violation of the criminal provision of HIPAA, they may refer that action to the Department of Justice (DOJ) for investigation. Otherwise, OCR reviews the evidence that it collected in each case. If they determine that a violation has been made and the entity is not in compliance, OCR may try to resolve the case with the covered entity by corrective action, voluntary compliance and/or resolution agreement. Most of these issues are resolved this way by the OCR. They then notify both the complainant and the covered entity in writing of the case result. If the covered entity fails to take action in the resolution of the issue that satisfies OCR, OCR may decide to inflict civil money penalties (CMPs) on the covered entity. If that happens, the covered entity may request a hearing where an HHS administrative law judge reviews the evidence and decides if penalties should be imposed from that review. Any CMPs collected do not go to the covered entity; they are deposited in the US Treasury (HHS Office of the Secretary, Office for Civil Rights, & OCR. (2017, June 7). How OCR Enforces the HIPAA Privacy & Security Rules).

There are five categories that can be applied for closed OCR cases:

1) Settled after intake and review (no investigation): OCR doesn’t have jurisdiction or they decide to not investigate; 2) OCR provides technical support (no investigation); 3) OCR finds no violation after investigation (investigation); 4) Corrective Action Obtained (investigation): OCR requires the covered entity to make corrective changes to its HIPAA, privacy and security related policies, safeguards, trainings, or procedures; 5) OCR may determine not to investigate a case further if: a) it involves a natural disaster, b) they referred the case to the DOJ for investigation; c) it was went after, charged, and finalized by state authorities; and d) if the covered entity has taken steps in order to comply with HIPAA rules (HHS Office of the Secretary, Office for Civil Rights, & OCR. (2019, March 22). Enforcement Data).

Another item I learned about is the De-identification Standard. This Standard falls under the HIPAA Privacy Rule and provides the standard for de-identification of PHI. Health information cannot be individually identifiable if it doesn’t identify a person/individual and if the covered entity has no grounds to believe it can be used to determine an individual. There are two methods that are used in this standard to help determine if the health information can be used to identify an individual. The first method is Expert Determination: a covered entity may identify the health information as not individually identifiable only if a person with generally accepted statistical and scientific processes and fundamentals for determining information not individually identifiable; applying these processes and fundamentals, determines that the risk is too small that the information may be used, by itself or with other rationally available information; or by a recipient who is able to verify that the individual stated within the health information is actually the subject person. The second method is titled the “Safe Harbor” method. In this method, some of the identifiers of the individual or of relatives, household members, or employers are removed, i.e., names, addresses, birth date, phone numbers, email addresses, social security numbers, device identifiers and serial numbers, medical record numbers, account numbers, full face photographs, among others. An interesting fact about de-identified health information is that once it’s de-identified, it can no longer be classified as PHI and it no longer falls under the protection of the Privacy Rule (HHS Office of the Secretary, Office for Civil Rights, & OCR. (2015, November 6). Methods for De-identification of PHI).

Another interesting thing I learned was that de-identified health information can actually be re-identified. The covered entity assigns a unique code to the de-identified health information set to allow for re-identification. If the covered entity managed to identify the individual of de-identified health information it maintained, it is now protected by the Privacy Rule, as it meets the definition of PHI. If a code or another way of record identification is created to facilitate coded or otherwise de-identified info to be re-identified, this is also considered to be a disclosure of PHI. There are, however, two implementation specifications for re-identification. The first one is derivation, which means that the code or other ways of record identification is not taken from or connected to information about the individual and is not capable of being adapted so the individual can be identified. The second one is security. In this regard, the covered entity does not disclose or use the code or any other ways of record identification for any other reason and doesn’t disclose the structure for re-identification (HHS Office of the Secretary, Office for Civil Rights, & OCR. (2015, November 6). Methods for De-identification of PHI).

Here’s an act I don’t remember hearing about: The Patient Safety and Quality Improvement Act of 2005 (PSQIA), which became effective January 19, 2009. This act provides a reporting system which is voluntary and its intent is to strengthen the data available to determine and resolve patient safety and health care quality issues. In order to boost the use of this system, PSQIA provides confidentiality protections and Federal privilege for patient safety data called patient safety work product. Patient safety work product includes data gathered and discovered during the disclosure and analysis of patient safety episodes. The confidentiality side of this will help providers report and examine safety issues without fear of heightened liability risk. Better reporting and investigation of patient safety issues will most likely yield greater data and increased understanding of patient safety issues. Through the PSQIA, Patient Safety Organizations have been established. These organizations receive reports of patient safety concerns or issues from providers and prepare analyses of those issues to the reporting providers. These PSOs are considered business associates under the HIPAA Privacy Rules because they gather and prepare analyze PHI for HIPAA covered entities. The Agency for Healthcare Research and Quality (AHRQ) has the responsibility for listing the PSOs and works in close association with the OCR. (HHS Office of the Secretary, Office for Civil Rights, & OCR. (2017, June 16). Understanding Patient Safety Confidentiality).

I learned that The Patient Safety Rule includes select provisions of PSQIA and that OCR is responsible for interpreting and carrying out the confidentiality protections defined in Subpart C and the enforcement provisions stated in Subpart D. As stated above, AHRQ has the duty of listing (and delisting) of listing the PSOs, which can be found in Subpart B. There are four Subparts of The Patient Safety Rule of note: Subpart A first defines the essential terms, such as patient safety work product, PSO, and patient safety evaluation system. Subpart B provides what is required for listing PSOs. A PSO is an entity that offers its expert advice in evaluating patient safety concerns and other data they collect to provide recommendations to providers. Subpart C contains the attachments to the patient safety work product, which are the privilege and confidentiality protections, along with the exceptions to the protections. Subpart D allows HHS to keep an eye on and make sure compliance is being followed by establishing a set framework and processes of confidentiality provisions, impositions of civil money penalties for breach of confidentiality provisions, and hearing actions (HHS Office of the Secretary, Office for Civil Rights, & OCR. (2017, June 16). Patient Safety Rule). Providers need a setting to discuss and investigate patient safety concerns, find causes and improve outcomes. This is where the enforcement provisions of Subpart D come in. Confidentiality of patient safety work product is critical to maintaining this setting for providers. OCR looks for voluntary compliance by PSOs, providers and other responsible people who hold patient safety work product. OCR may perform compliance reviews and investigate complaints claiming that patient safety work product was disclosed in violation of the confidentiality standards. If OCR determines that an infraction has occurred, they may impose a civil money penalty of up to $11,000 per violation (HHS Office of the Secretary, Office for Civil Rights, & OCR. (2017, June 16). Confidentiality Provisions of the Patient Safety Act).

The website offered a little more information on covered entities that I was not aware of. Of course, the covered entities must comply with HIPAA rules and provide protection and security for their patient’s healthcare information, as well as complying with the patient’s rules as far as their rights go for obtaining their own personal medical information. Here is where I gained some knowledge on business associates, which are individuals or entities hired by covered entities to perform some specific service or activity. The covered entities are allowed to “outsource” to these business associates under The Privacy Rule. Covered entities are able to disclose PHI to the business associates insofar as they use this information not for their own use, but only for what they were hired for. If the provider catches the associate with a violation of the contract, the associate must take steps to correct what they did wrong to cause the violation. If such steps are not successful, the contract is terminated. If, for whatever reason, the contract termination is not practical, then the covered entity is responsible for reporting the violation to HHS/OCR. A written contract must be in place for the agreement between the two to be effective. Some examples of business associate activities include claims processing, a medical transcriptionist who works off-site and is independent of the provider, an attorney who provides legal services to healthcare providers and accesses PHI, or a healthcare clearinghouse who deciphers claim information from the provider onto an industry standard claim form. (HHS Office of the Secretary, Office for Civil Rights, & OCR. (2019, May 24). Business Associates).

In conclusion, I learned quite a bit from this assignment, even more than I wrote about in this paper. For my everyday job, HIPAA is something I am required to incorporate all day, every day. I have access to patient’s PHI, social security numbers, birth dates, everything. I found the website to be very helpful and informative and will most likely return to it for reference many times in the coming years.

References:

1. HHS Office of the Secretary, Office for Civil Rights, & OCR. (2013, July 26). Summary of the HIPAA Security Rule. Retrieved February 9, 2020, from https://www.hhs.gov/hipaa/for-professionals/security/laws-regulations/index.html
2. My entity just experienced a cyber-attack! What do we do now? A quick response checklist from the HHS, Office for Civil Rights (OCR). (n.d.). Retrieved from https://www.hhs.gov/sites/default/files/cyber-attack-checklist-06-2017.pdf
3. HHS Office of the Secretary, Office for Civil Rights, & OCR. (2017, June 7). Enforcement Process. Retrieved February 9, 2020, from https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/enforcement-process/index.html
4. HHS Office of the Secretary, Office for Civil Rights, & OCR. (2017, June 7). How OCR Enforces the HIPAA Privacy & Security Rules. Retrieved February 9, 2020, from https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/examples/how-ocr-enforces-the-hipaa-privacy-and-security-rules/index.html
5. HHS Office of the Secretary, Office for Civil Rights, & OCR. (2019, March 22). Enforcement Data. Retrieved February 9, 2020, from https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/data/index.html
6. HHS Office of the Secretary, Office for Civil Rights, & OCR. (2015, November 6). Methods for De-identification of PHI. Retrieved February 9, 2020, from https://www.hhs.gov/hipaa/for-professionals/privacy/special-topics/de-identification/index.html#standard
7. HHS Office of the Secretary, Office for Civil Rights, & OCR. (2017, June 16). Understanding Patient Safety Confidentiality. Retrieved February 9, 2020, from https://www.hhs.gov/hipaa/for-professionals/patient-safety/index.html
8. HHS Office of the Secretary, Office for Civil Rights, & OCR. (2017, June 16). Patient Safety Rule. Retrieved February 9, 2020, from https://www.hhs.gov/hipaa/for-professionals/patient-safety/patient-safety-rule/index.html
9. HHS Office of the Secretary, Office for Civil Rights, & OCR. (2019, May 24). Business Associates. Retrieved February 9, 2020, from https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/business-associates/index.html

Executive Summary

A recent study estimates that 19% percent of US citizens claim they currently use a wearable fitness tracker, with the same percentage saying they currently use a mobile health app. Combining present use with the percentages of Americans saying they have used each of these devices in the past, about one in three Americans report at some point having worn a fitness tracker such as a Fitbit or smartwatch (34%) or having tracked their health statistics on a phone or tablet app (32%).

Wearable technology offers the healthcare industry important benefits, including providing appointment reminders and a way to track patient vitals and activity levels. They also have cost-reducing benefits, such as reducing in-office visits. While wearable technology shipments are expected to grow at an annual compound growth rate of 18.4 percent by 2021 and home healthcare is expected to boost use among medical wearable devices, it also brings along data security and privacy concerns.

When protected health information (PHI) is involved, the devices must comply with HIPAA law. So, it’s important to understand how HIPAA plays a part in wearable health technology. With constantly evolving health technology and constantly increasing patient generated data, it is important to understand where HIPAA policy comes in and where it doesn’t.

This policy brief aims at discussing HIPAA’s impact and effects on wearable technology and related patient data. HIPPA comprises of various rules and the rule that pertains to the effects of wearable technology is the privacy act since there is a large amount of patient generated data that needs to be secure and has to comply with HIPAA. This brief attempts to discuss the effects and impacts of wearable technology generated PHI and its role in clinical data management. Here, we also attempt to discuss the impact of wearable technology on patients, payers and providers through the lens of HIPAA compliance norms in order to possibly establish guidelines and more robust policies such that patient data is secure and effective healthcare administration can evolve alongside fast evolving technology.

History and Background

HIPPA stands for Healthcare Insurance Portability and Accountability Act. It was brought forward mainly for employees between jobs. Other objectives of the Act were to combat waste, fraud and abuse in health insurance and healthcare delivery. The Act also contained passages to promote the use of medical savings accounts by introducing tax breaks, provides coverage for employees with pre-existing medical conditions and simplifies the administration of health insurance. HIPAA therefore improved the portability and accountability of health insurance coverage.

The Privacy rule:

In addition to the original purpose of HIPAA, which is to protect covered entities. The way in which it is implemented is constantly changing to accommodate advances in technology and changes to working practices – both of which have resulted in new threats to patient privacy and the security of PHI. The Privacy Rule dictates how, when and under what circumstances PHI can be used and disclosed. Brought about for the first time in 2003, it applies to all healthcare organizations, clearinghouses and entities that provide health plans. Since 2013, it has been extended to include Business Associates.1

The Privacy Rule sets limits regarding the use of patient information when no prior authorization has been given by the patient. Additionally, it mandates patients and their representatives have the right to obtain a copy of their health records and request corrections to errors.2

Advent of wearable technology

With constant development in technology over the years, humans have not only mastered the art of developing compact and portable devices that can monitor health but have also linked it with the ever growing fashion industry therefore creating a market resonance, as a result of which, self-care using technological products is not only something people are taking up as a health choice but also as a fashion choice.

Figure 1, Percentage of US adults who were willing to wear technology that tracks select health statistics as of 2018.

This sudden and immense disruption in the healthcare sector has brought forward a new realm where patients are generating their own data and this data needs to be regulated and put to good use and has to be integrated with the current healthcare system in order to ensure patient privacy, data misuse and optimize care.

Various types of wearables have come into existence and even more are in the making, let’s take a look at the types of wearable technology people are using on order to monitor their health. Figure 1, with the help of an infographic illustrates the types of wearable devices and their uses.

center000

Figure 2, Smart Insights. “Wearable Technology Statistics and Trends 2018,” November 15, 2017. 3

Health Data and its implications

Health Data may be defined as any data that describes the physical or mental condition, identity and treatment history of an individual. Before the advent of patient generated data, healthcare professionals and healthcare organizations were the generators and managers of such data but after people began gaining access to wearable health technology, an immense amount of data began being generated and circulated for a plethora of purposes. For present purposes, the world of health data falls into two categories. Protected health information (PHI) defined by and subject to HIPAA falls in one category. The second category includes health data that does not enjoy the protections of HIPAA. For ease of reference, the two categories are identified at times here as regulated (subject to HIPAA) and unregulated (not subject to HIPAA). Data in the unregulated category, for the most part, is not subject to any specific statutory regulation for privacy4.

A large portion of unregulated data involves organizations that rely on health data as an element of a commercial activity, including data brokers, advertisers, websites, marketers, genetic testing companies, and others. The unregulated data includes some governmental and non-profit activities as well. The size of the unregulated world of health data is unknown, but Kristen Ostherr from rice university, in a 2017 article, said that in 2016, there were more than 165,000 health and wellness apps available through the Apple App Store alone.5 Those apps represent a small fraction of the unregulated health data sphere.

Under HIPAA, PHI remains subject to controls in the hands of covered entities.

When disclosed outside the HIPAA domain of covered entities, HIPAA data is no longer subject to HIPAA controls, although some disclosed data may occasionally fall under the scope of another privacy law. In general, however, the data disclosed by a HIPAA covered entity passes into the second category of unregulated data.

Patient-Generated Data

As a result of the growing use of wearable technology, users are creating large amounts of self-generated data and patients are now playing a more active role in their healthcare. This phenomenon is known as patient-generated health data (PGHD), which the US Department of Health and Human Services’ (HHS) Office of the National Coordinator of Health Information Technology (ONC) defines as “health-related data created, recorded, or gathered by or from patients (or family members or caregivers) to help address a health concern.”

Associated risks and HIPAA compliance

As patient-generated data overload happens due to millions of users of various health devices, the risk of data leakage and privacy breach is a very real possibility and the very body that is supposed to prevent the misuse and illegal monetization of PHI i.e, HIPAA and its privacy rule, is not up to date regarding the handling of such data. For example, if a patient generates data for his personal use Unregulated data that passes from an unregulated actor to a HIPAA covered entity becomes PHI in the hands of the covered entity while remaining unregulated in the hands of the originator. PHI that passes out of the regulated world generally becomes unregulated data in the hands of a recipient who is not a HIPAA covered entity. Data can pass back and forth between the two institutions.

Impact on Patients

The advent of wearable technology brings about a drastic change as far as patients are concerned, it gives a massive amount of control in the hands of the patient. For example, before health technology came around, patients had to see physicians and utilize healthcare equipment in order to monitor things like heart rate and blood sugar levels, therefore driving up healthcare costs and insurance premiums per patient.

As far as wearable technology is concerned, it has made people more aware of their health and made people more engaged and informed towards personal care therefore improving general population health.

The problem arises when this patient generated data is used by device manufacturers and associated healthcare provider companies for monetary benefits through targeted marketing and for other research purposes. This is where HIPAA is supposed to come in HIPAA regulations only apply to covered entities and business associates. This grouping includes clearinghouses, health plans, and providers.

There aren’t very cut and dry HIPAA regulations related to wearable technology at this point. However, once a provider becomes involved with receiving data from a piece of wearable technology, that exchange is subjected to HIPAA regulations.

Impact on Payers

Insurance companies use patient generated data to improve risk assessments and drive customer quality of life and life value. One study shows that wearables can encourage healthier behavior associated with a 30% reduction in risk of cardiovascular events and death.

Insurance companies may be in danger of not being HIPAA compliant because HIPAA rules are not well defined regarding wearable technology

Impact on Providers

Wearable technology proves to be an efficiency improvement tool for healthcare providers and for improvement in preventive care and expansion of EHS. leading to early detection of chronic diseases and early intervention of doctors.

HIPAA regulation regarding data reaching physicians is unclear Unclear physician responsibilities for collecting, monitoring, and protecting data: HIPAA applies to patient data collected by physicians,[7] but differing state laws mean that a physician’s specific responsibilities for monitoring and protecting patient data vary by location.

References

1. Rights (OCR), Office for Civil. “Privacy.” Text. HHS.gov, May 7, 2008. https://www.hhs.gov/hipaa/for-professionals/privacy/index.html.
2. HIPAA Guide. “HIPAA for Dummies.” Accessed February 18, 2020. https://www.hipaaguide.net/hipaa-for-dummies/.
3. Smart Insights. “Wearable Technology Statistics and Trends 2018,” November 15, 2017. https://www.smartinsights.com/digital-marketing-strategy/wearables-statistics-2017/.
4. “Health Information Privacy Beyond HIPAA: A 2018 Environmental Scan of Major Trends and Challenges,” n.d., 68.
5. “Rice Expert: Be Concerned about How Apps Collect, Share Health Data.” Accessed February 18, 2020. http://news.rice.edu/2017/10/19/rice-expert-be-concerned-about-how-apps-collect-share-health-data/.

The healthcare business is continually developing to meet federal prerequisites for electronic PHI upkeep, transmission, and capacity. The present healthcare organizations are picking HIPAA-compliant partners that diminish the risk of PHI breaches, decrease network unpredictability, counterbalance capital expenses, and upgrade network nimbleness to convey better patient care and healthcare service conveyance at a lower cost. As these healthcare organizations coordinate their data and business structures in the virtual space, they have to constantly put resources into hardware-improved security technologies and software arrangements that ensure personalities, data, and frameworks. Somebody from the C-Suite needs to trust in the inborn advantages of HIPAA, for required consistency as well as a positive impact to improve the client experience and upgrade the brand esteem. Healthcare organizations and their partners need to grow best practices, measures, and administration models to guarantee HIPAA-compliant procedures and policies are incorporated with their operational models, instead of being an insignificant idea in retrospect.

Healthcare organizations are endowed with the absolute generally close and personal information over a patient’s lifetime identifying with bank accounts and identity, just as healthy. Patients expect that their data will be kept hidden. At the point when that trust is penetrated, the consequences for the healthcare association can be gigantic. The HIPAA Privacy Rule tries to ensure a patient’s private and personal health information. It sets protects, cutoff points, and conditions on the utilization and disclosure of PHI without patient approval. It likewise gives patients rights over their health information, including the option to analyze and acquire a duplicate of their health records and solicitation rectifications.

HIPAA gives patients the option to acquire duplicates of their medical records so they can recognize blunders and solicitation revisions. HIPAA additionally shields patients from having their health care information utilized for purposes not identified with health care by different parties, for example, disaster protection companies, marketing firms, or financial establishments. Likewise, the refined technologies engaged with the execution of HIPAA give a point-by-point review trail to the recognizable proof and authentication of people who have gotten to and altered information at various degrees of access, which expands responsibility and straightforwardness. HIPAA has surely made clinicians increasingly sensitive to their obligation to secure patients’ medical information (Dorward, 2020).

Even though the HIPPA Privacy Rule has been set up for longer than 10 years, its ambiguity and coming about misinterpretations have made boundaries to the progression of logical and medical research in the United States. The subsequent eased back pace of research from the ambiguous wording of HIPAA has expanded expenses for research foundations. In light of the unpredictability of health information management, HIPAA gauges are here, and they are hard to apply, causing health information management experts to decipher the rules for themselves. This has prompted misinterpretations and conflicting applications that have purportedly caused delays in health care treatment. HIPAA, albeit good-natured, has made a culture of neurosis in which a medical transcriptionist can confront genuine career repercussions for coincidentally sending patient information to an inappropriate specialist and medical experts are reluctant to communicate with one another in cases that include various patients, for example, transplants or infectious disease outbreaks (Wei, 2015).

References

1. Dorward, L. (2020). The Positive and Negative Effects of HIPAA Employment Laws. Chron Articles.
2. Wei, W. (March 12, 2015). The Effects of HIPAA’s Privacy Rule on Medical Research [PDF file]. Retrieved from https://scholarworks.arcadia.edu/cgi/viewcontent.cgi?article=1032&context=undergrad_works