HIPAA is a set of rules to help protect patient health
information and privacy.
It includes any information that can
be used to identify a specific person
as well as any health related information or even payment.
This information is referred to as PHI. So
who is required to keep PHI private?
The obvious answer is doctors, health care providers,
pharmacies, and clearinghouses.
They are referred to as "covered entities"
but, it also includes business associates
that have access to PHI information
through working with "covered entities" such as an attorney
that is working on a case that may expose PHI data,
a consultant, or an auditor.
Lastly, there are also the subcontractors
that have indirect access to PHI data
such as third party companies that
provide storage for PHI data.
HIPAA is composed of three main rules.
The first is the privacy rule.
It basically defines the patient's rights
for accessing their records or changing their information.
Patients must be notified when information is shared
and decide what will be shared.
The second is the security rule.
It defines how the information will be secured and protected
against fraud hackers or even accidental sharing
of the information.
And lastly, is the enforcement rule.
Enforcement rules are required to ensure adherence
to the first two rules and provides a method
to deter breaching the rules through fines.
So, if your organization is handling PHI data
directly or indirectly, you will need to follow these rules.