HIPAA Security Regulations Still Under DiscussionA great deal is being written and discussed with respect to the Health Insurance Portability and Accountability Act’s (HIPAA), final privacy regulations that become effective April 14, 2003. Easily forgotten but not to be ignored are HIPAA’s proposed security regulations that go hand in hand with the privacy regulations. At this point, however, the security regulations are still in their proposed stage whereas the privacy regulations have become final. Healthcare providers will have 2 years from the effective date of the final HIPAA security regulations to implement a compliance program that focuses on said security regulations. Our recommendation is that now is the time, while you are implementing a privacy compliance program, to simultaneously implement a security compliance program.The HIPAA proposed security regulations deal with the security and confidentiality of Protected Health Information (PHI). Issues covered include, but are not limited to, password maintenance, incident reporting, as well as addressing viruses and any other software destroyers. Like the privacy compliance, security compliance will require training employees, agents and independent contractors on security policies and procedures. An example of a security situation dealing with protected health information follows. An office manager for a physician’s office keeps back-up billing information on her laptop computer. The office manager inadvertently leaves the laptop on her back seat and thieves break-into the car and steal the laptop, along with all of the protected health information of the practice’s patients. Potential harm that might arise from this incident: the thieves might try to sell the confidential patient information or, at a minimum, publish the information maliciously. The medical practice, under such an occurrence, might lose the confidence of its patients if the patients lose their confidence that the medical practice will protect their protected health information. That would be a serious blow to the medical practice’s reputation. There may also be HIPAA penalties for the medical practice as well as possible state penalties for breach of patient confidentiality laws. It is not beyond the imagination to also envision the possibility of patient lawsuits over the unauthorized disclosure of protected health information. The proposed security regulations require developing policies and procedures similar to those required by the privacy regulations; i.e.; regulations that help to ensure that protected health information is kept secure. For more information, please Call or E-mail Articles page HIPAA page top of this article |