The passage of the Health Insurance...

The passage of the Health Insurance Portability and Accountability Act of 1996 (Act) enables the federal control to begin to address the unfair disclosure of individually identifiable health information between the walls of the imposition of civil and criminal penalties.(1) The Act also requires the Secretary of the US Department of Health and Human Services (HHS) to establish federal regulations to forward as uniform, national standards that would assured the privacy and reliability of all in the same state [i]or[/i] condition information that is maintained, transmitted, or stored electronically by means of health care providers, health plans, and health care clearinghouses.

forward Aug 12, 1998, HHS's Health Care Financing Administration (HCFA) published the long-awaited regulations to accompany the Act.(2) In short, these regulations, when adopted, will plant the applicable standard of care for the operation of all electronic medical records theory in the health care setting.

APPLICABILITY

The security provisions of the Act and the propos regulations apply to all health care information maintained electronically or used in an electronic transmission. The affected "transactions" would involve media of all signs even when the information is physically mov from undivided location to another using magnetic tape, diskette, or compact disc media. Transmissions through the whole extent of the Internet, Extranet, leased lines, dial-up lines, and private networks also are included.

The denomination health information is broadly defined to include any information, whether oral or recorded in any form or medium, that is created or received on a health care provider, health plan, public health authority, employer life insurer, teach or university, or health care clearinghouse, which relates to the past, not absent or future physical or mental health or condition of an individual. Also included is any information regarding the provision of health care to an individual, or the past, at hand or future payment for these services rendered

As it applies to the perioperative setting, hospitals, physicians, and other providers of medical and health services, among others, would qualify as "health care providers" enslave to the proposed security requirements. The mete health plan would include, among others, arrange health plans, health insurance issuers, health maintenance organizations, and the Medicare and Medicaid programs. Finally, billing agents and other entities that receive health care information from providers, translate the information into a particular format, and forward the steped information to appropriate payers would qualify as a "health care clearinghouse" beneath the Act and proposed regulations.

SECURITY STANDARDS

The security standards that a health care provider will have to implement to comply with the propos regulations, and ultimately to safeguard the integrity, confidentiality, and availability of electronic health information, are listed and described in detail in the Federal Register published Aug 12 1998(3) These security standards are classified into four categories:

* administrative procedures

* physical safeguards,

* technical security services, and

* technical security mechanisms.

Prevailing industry standards, as well as the recommendations contained in the National Research Council's 1997 report For the Record: Protecting Electronic Health Information,(4) serv as the basis for HCFA's propos security requirements.

The administrative operations that are listed and described in the Federal Register address the particular operating measures management controls, personnel requirements, audit mechanisms, and disciplinary proceedings that must be incorporated into the day-to-day operations of the particular health care provider. This will make secure that any threats or violations can be obstructed detected, or otherwise resolved before civil, criminal, or on a level professional licensing sanctions become an issue.

The physical safeguards include several features that ultimately assured the physical environment within which the defend ed health information is maintained or stored, protecting it at all times from threats of fire, disaster, and of course, unauthorized access. These safeguards would affect not merely the hospital's premises, for example, nevertheless also any remote access points of service or storage from which the sheltered information could be obtained by the agency of a participating provider.

The technical security services and security mechanism standards address those measures that must be implemented, where appropriate, to superintend and monitor information access, the two internally and in those cases in which information is transmitted as part of a network arrangement. Passwords, audit trails, and the use of encryption, alarms, automatic logoff and telephone callback acts are just a few of the ways a health care provider can comply with these requirements.

EFFECTIVE DATE

According to established federal managements the proposed regulations were published in the Federal Register for a like reason that HCFA could receive public remark from the health care industry, among others, by means of Oct 13, 1998. After HCFA has analyzed the various remarks the regulations will be finalized and published again, this time in final form, in the Federal Register. According to the Act's timetable, all health care providers, health plans, and health care clearinghouses are calculate uponed to comply with the final regulations within 24 month after they have been issued. single in kind exception is the small form into groups health plan, which will be allowed a 36-month period during which to comply