HIPAA Compliance

The Health Insurance Portability and Accountability Act (HIPAA) was originally enacted to ensure continued health insurance coverage for employees who changed or lost their jobs—this is the "portability" aspect. Later, the "Administrative Simplification" provisions were introduced to enhance the efficiency of the healthcare system while safeguarding patients' personal health information—this is the "accountability" aspect. While the portability provisions have been in effect since 1996, the accountability measures have gained increased attention in recent years.

HIPAA stands as the most comprehensive healthcare privacy law in U.S. history. It applies to all healthcare providers, including hospitals, physicians, dentists, pharmacies, health plans, and healthcare clearinghouses (such as third-party billing services). The law protects health information in all forms: electronic, written, and verbal. To enforce its goals set forth by HIPAA, the Department of Health and Human Services (DHHS) established three key regulatory standards:

Electronic Transactions and Code Sets
Privacy
Security

Electronic Transaction Standards

In the past, healthcare providers and health plans used various electronic formats to process medical claims and related administrative tasks. HIPAA's adoption of national standards aims to streamline these processes by requiring the use of uniform formats, thereby "simplifying" and improving the efficiency of transactions nationwide.

The standards specifically apply to eight key administrative and financial transactions:

Claims encounter and coordination of benefits (837)
Remittance advice (835)
Eligibility inquiry and response (270/271)
Status inquiry and response (276/277)
Authorization request and response (278)
Enrollment and disenrollment (834)
Premium payments (820)

Healthcare providers who submit electronic transactions to health plans are required to use these standardized formats. In addition, Medicare mandates the use of electronic transactions, making compliance with these standards essential for all Medicare providers.

The rule also establishes standardized code sets to support these transactions, including:

ICD-10-CM for diagnoses and inpatient procedures
HCPCS (Healthcare Common Procedure Coding System) for medical procedures, supplies, and equipment
NDC (National Drug Code) for drugs

Fortunately, these code sets were already widely in use prior to HIPAA, easing the transition for most providers and plans.

Unique Identifier Standards

In the past, healthcare organizations relied on a variety of identification formats when conducting business with one another, often leading to confusion, errors, and unnecessary costs. The implementation of standard identifiers aims to eliminate these inefficiencies and promote consistency across the healthcare industry.

Unique Employer Identifier Standard: Finalized in 2002, this rule designates an employer's Tax Identification Number (TIN) or Employer Identification Number (EIN) as the standard identifier for electronic transactions. Compliance with this standard became mandatory on July 30, 2004.
Unique Healthcare Provider Identifier Standard (NPI): Published on January 23, 2004, this rule introduced a National Provider Identifier (NPI) as the standardized ID for all healthcare providers under HIPAA. Providers were able to begin applying for NPIs on May 23, 2005, with full compliance required by May 23, 2008.
Unique Health Plan Identifier: This proposed rule would create a standard identifier for health plans involved in processing and paying electronic healthcare transactions. However, an official publication or implementation date has not yet been finalized.

Claim Attachment Standards

This proposed rule introduces an electronic standard for transmitting claim attachments under HIPAA. These attachments would provide supplemental clinical information, beyond what is included in the standard claim, to support medical necessity and coverage decisions. The anticipated publication date for this rule was August 2004.

Privacy Standards

HIPAA’s Privacy Rule established the first national standards to safeguard individuals' medical records and personal health information. These standards give patients greater control over how their health information is used and disclosed. Key provisions include:

Setting clear boundaries on the use and release of health records
Requiring healthcare providers to implement safeguards that protect patient privacy
Holding violators accountable through civil and criminal penalties
Giving patients the right to access, review, and request corrections to their medical records
Ensuring patients are informed about how their health data is used and to whom it has been disclosed

Compliance with the HIPAA Privacy Rule became mandatory on April 14, 2003.

Modifications to Standards for Privacy of Individually Identifiable Health Information

Modifications to Standards for Privacy of Individually Identifiable Health Information were published August 14, 2002. The compliance date remained April 14, 2003. The modification changed the standards for:

Marketing
Consent and Notice
Uses and Disclosures Regarding FDA-Regulated Products and Activities
Incidental Use and Disclosure
Authorization
Minimum Necessary
Parents and Minors
Business Associates
Research
Limited Data Set
Hybrid Entities
Health Care Operations: Changes in Legal Ownership
Group Health Plan Disclosures of Enrollment and Disenrollment Information
Accounting of Disclosures
Disclosure for Treatment, Payment, or Health Care Operations of Another Entity
Protected Health Information: Exclusion for Employment

Security Standards

The Final Security Rule was published on February 20, 2003, with a compliance deadline of April 21, 2005. As the first rule of its kind in healthcare, it mandates that all HIPAA-covered entities adhere to federal guidelines for safeguarding electronic protected health information (ePHI).

In general terms, this rule requires that covered entities must do certain things:

Ensure the confidentiality, integrity, and availability of all electronic protected health information (PHI) that the covered entity creates, receives, maintains, or transmits.
Protect against any reasonably anticipated threats or hazards to the security or integrity of such information.
Protect against any reasonably anticipated uses or disclosures of such information that are not permitted or required under the rule.
Ensure workforce compliance through appropriate training and oversight

The rule outlines a comprehensive framework, divided into three primary safeguard categories:

Administrative safeguards (e.g., policies, workforce training)
Physical safeguards (e.g., facility and device security)
Technical safeguards (e.g., access control, encryption, audit controls)

Together, these are organized into 18 security standards and 42 specific security areas that the covered organization must address.

While this rule reflects widely accepted best practices from other industries, it is uniquely tailored to meet the specific needs of the healthcare sector. Many of its requirements may already be partially in place, for example, employee security training and the use of authentication protocols to access computer systems. The rule also mandates the development and enforcement of formal policies and procedures that guide daily operations and protect sensitive data.

However, other components, such as encrypting electronic transmissions of protected health information (PHI) that leave the organization’s internal network, may be entirely new and require additional planning and implementation to ensure compliance.

Importantly, the Security Rule is flexible and technology-neutral. It does not prescribe specific software or methods, nor does it dictate exactly how policies should be developed. Instead, it allows each organization to assess its unique environment and adopt reasonable and appropriate security measures that fulfill the rule’s core objectives.

Frequently Asked Questions

What is HIPAA?

The Health Insurance Portability and Accountability Act (HIPAA) is the most comprehensive healthcare privacy law in the United States. It was created to safeguard the privacy and security of individuals’ medical records and personal health information. HIPAA applies to all healthcare providers (hospitals, physicians, pharmacies, dentists, etc.), health plans, and healthcare clearinghouses (third-party vendors for billing, claims, etc.). These entities must follow strict rules on how patient information is handled, whether it's written, electronic, or spoken. As a healthcare provider, Grand Forks Clinic is fully committed to complying with HIPAA regulations.

What is PHI?

PHI stands for Protected Health Information. This includes any personal health data collected by Grand Forks Clinic that can be used to identify an individual and that relates to:

Individual’s physical or mental health (past, present, or future)
Healthcare services provided
Payment for those services

PHI may include names, addresses, birthdates, medical histories, and more. HIPAA ensures this information is kept confidential and secure.

What does the Privacy Rule require healthcare providers, including Grand Forks Clinic, to do?

Under the HIPAA Privacy Rule, healthcare providers must take specific steps to protect patients’ health information. These include:

Informing patients of their privacy rights and how their health information may be used or disclosed.
Obtaining patient authorization for certain uses and disclosures of Protected Health Information (PHI).
Establishing and implementing written privacy policies and procedures.
Training staff members to understand and follow these privacy practices.
Appointing a Privacy Officer to oversee compliance and ensure procedures are followed.
Safeguarding patient records so that only authorized individuals can access PHI.

Can healthcare providers share patient information for treatment without the patient's authorization?

Yes. The Privacy Rule permits doctors, nurses, hospitals, and other healthcare professionals to use or share PHI for treatment purposes without needing the patient’s written consent. However, some other uses or disclosures may require written authorization, depending on state law. For clarification on specific situations, contact Health Information Management.

What is the Notice of Privacy Practices?

The Notice of Privacy Practices is a document given to every patient at the time of registration with Grand Forks Clinic. It outlines how personal health information may be used and shared, and explains the rights patients have regarding their health data, including how to access or request corrections to their records.