HIPAA Fundamentals

Learning objectives

What the workforce should be able to do after this module.

• Understand the history of HIPAA — the 1996 origin, the 2009 HITECH Act, and the 2013 Omnibus Rule — and why each was enacted
• Define and understand the key HIPAA terminology used across the rest of the series (PHI, ePHI, encryption, breach, covered entity, business associate)
• Differentiate between the Privacy Rule and the Security Rule and understand the role each plays

Assessment: 5 knowledge-check questions per module, 80% passing standard.

Module outline

Section-by-section walkthrough.

1. 01

   The evolution of HIPAA — 1996, 2009, 2013

   HIPAA (Health Insurance Portability and Accountability Act) was passed in 1996 to protect the communication and disclosure of health information. The HITECH Act (2009) extended liability to Business Associates, increased breach penalties, and made breach reporting mandatory. The Omnibus Rule (2013) finalized HITECH — updated BAA requirements, mandated electronic encryption, expanded patient rights over PHI, and prohibited marketing and sales of patient information.

2. 02

   HHS and OCR — the enforcement bodies

   The Department of Health and Human Services (HHS) and its Office for Civil Rights (OCR) are the federal bodies that implement and enforce HIPAA. They determine fees, conduct audits, and issue penalties. Both are at record levels due to the growth of tech in patient care and the misuse of ePHI.

3. 03

   The two main HIPAA Rules — Privacy and Security

   The Privacy Rule ensures rules, regulations, and physical privacy restrictions are in place for PHI and ePHI, and gives patients the right to access, control, and request changes to their information. The Security Rule ensures technical security measures — including data encryption and secure platforms — are in place to protect ePHI in transit and at rest.

4. 04

   PHI vs ePHI

   PHI (Protected Health Information) is any patient health information the covered entity maintains. ePHI (electronic Protected Health Information) is that information in electronic form. The Privacy Rule covers all PHI; the Security Rule covers ePHI specifically.

5. 05

   Encryption — what it is and why it matters

   Encryption converts readable text into unreadable text while data is at rest and in transit, protecting against breaches. It is a foundational safeguard under the Security Rule and one of the two conditions (along with proper destruction) that renders PHI "secured" under the Breach Notification Rule.

6. 06

   What is a breach?

   A breach is when confidential information — PHI or ePHI — is compromised through a cyberattack or security neglect, or when an unauthorized source has gained access to patient information. HIPAA exists to prevent breaches and protect patient confidentiality.

7. 07

   Covered Entities (CE) — the three types

   A Covered Entity is a provider that electronically transmits health information. There are three types: Healthcare Providers (doctors, dentists, therapists), Health Plans (insurance companies), and Healthcare Clearinghouses (entities that process nonstandard health information into standard formats).

8. 08

   Business Associates (BA)

   HHS defines a Business Associate as a person or entity that performs certain functions or activities involving the use or disclosure of protected health information on behalf of — or provides services to — a covered entity. Vendors that touch PHI require a signed Business Associate Agreement (BAA).