Health Insurance Portability and Accountability Act(HIPAA)

HISTORYThe Health Insurance Portability and Accountability Act (HIPAA), Public Law 104-191, was enacted by Congress on August 21, 1996.

2The Health Insurance Portability and Accountability Act (HIPAA), Public Law 104-191, was enacted by Congress on August 21, 1996. to improve portability and continuity of health insurance coverage, to combat waste, fraud and abuse in health care delivery and to improve access to long-term care services and coverage. The final HIPAA Privacy rule was signed and became effective in April 2001. The Privacy compliance date was 14 April 2003.HIPAA LEGISLATIONHIPAA was enacted toImprove portability & continuity of health insurance coverage Improve access to long-term care services and coverageSimplify the administration of health careProtect privacy of patients health information

To assure that individuals health information is properly protected while allowing the flow of health information needed to provide and promote high quality health care.

HIPAA strikes a balance that permits important uses of information, while protecting the privacy of people who seek health care.Goals

PENALTIESCivil penaltiesCivil money penalties are $100 per violationUp to $25,000 per person

Federal criminal penaltiesWrongful Disclosure: Fine of not more than $50,000 and not more than 1 year imprisonmentDisclosure under False Pretenses: Fine of not more than $100,000 and not more than 5 years imprisonmentCommercial Advantage, Personal Gain, or Malicious Harm: fine of not more than $250,000 and 10 years imprisonment

EXCEPTIONSAs required by law Avert serious threats to health or safetySpecialized government functionsJudicial and administrative proceedingsCadaver organ, eye or tissue donation purposes Victims of abuse, neglect or domestic violence

Inmates in correctional institutions or in custodyWorkers compensationResearch purposesPublic health activitiesHealth oversight activitiesAbout decedentsLaw enforcement purposes

MILITARY EXEMPTION

Uses and Disclosures for Specialized Government Functions: Military and Veterans Activities. 45 CFR 164.512 and C7.11 of the DoD 6025.18-R.

Very Broad in Nature.

Has been published in the Federal Register. 68 Fed Reg 17357 (April 9, 2003)

RELEASABILITYThe PHI that is released to a command authority is on a need to know basis. Appropriate military command authorities may, however, use and disclose protected health information of Army personnel for activities deemed necessary to assure the proper execution of the military mission (DoD 6025.18-R, paragraph c7.11.1.1.). Appropriate military command authorities include all commanders who exercise authority over an individual (DoD 6025.18-R, paragraph C7.11.1.2.1.). 8The PHI that is released to a command authority is on a need to know basis. They can only be provided information that is necessary to assess the active duty soldiers ability to carry out a specific dutyAppropriate military command authorities may, however, use and disclose protected health information of Army personnel for activities deemed necessary to assure the proper execution of the military mission (DoD 6025.18-R, paragraph c7.11.1.1.). Appropriate military command authorities include all commanders who exercise authority over an individual (DoD 6025.18-R, paragraph C7.11.1.2.1.).

RELEASABILITY (CONTINUED)The phrase deemed necessary to assure the proper execution of the military mission includes:(a) determining soldiers fitness for duty (DoD 6025.18-R, paragraph C7.11.1.3.1);(b) determining soldiers fitness to perform any particular mission, assignment, order, or duty (DoD 6025.18-R, paragraph C7.11.1.3.2.); (c) carrying out activities under the authority of DoD Directive 6490.2, Joint Medical Surveillance, 30 August 1997 (DoD 6025.18-R, paragraph C7.11.1.3.3.), which includes, for example, monitoring the health of a population for the purposes of preventive medicine;(d) reporting on military casualties in any military operation or activity (DoD 6025.18-R, paragraph C7.11.1.3.4.); and(e) carrying out any other activity necessary to the proper execution of the mission of the Army (DoD 6025.18-R, paragraph C7.11.1.3.5.). PRIVACY ACT There are some instances where permitted disclosures under the HIPAA

The Privacy Act (5 USC 552a(g)) permits civil suits against DoD components if the act has been violated and allows recovery of damages, court costs and attorney fees in some cases.

10Privacy Rule are not allowed by the DoD implementation of the Privacy Act. For example, the Defense Privacy Board requires us to review subpoenas to determine if they were actually signed by a judge of a court of competent jurisdiction, a requirement not found in the HIPAA Privacy Rule. The HIPAA Privacy Rule also allows some releases of PHI about terminally ill patients (the near dead) not allowed under the Privacy Act. But please remember that in situations where you may not make a release under the Privacy Act, HIPAA does not give you authorization to do so. In the regulation, weve made the payment provisions for individual patients' requests for copies of their designated records set be consistent with those under the Privacy Act and mandated that those denied their request for records (these should be few and far between and will probably involve psychotherapist notes) follow the Privacy Act appeals procedure.

REFERENCESDoD 6025.18-R, DoD Health Information Privacy Regulation, 24 January 2003DoD Instruction 6025.18, Privacy of Individually Identifiable Health Information in DoD Health Care Programs, 2 December 2009 Public Law 104-191, Health Insurance Portability and Accountability Act of 1996, Section 264, 21 August 1996 Title 42, United States Code, Sections 1320a-1320d-8. 45 CFR Part 160 and Subparts A and E of Part 164

DODDirectives11

Questions?

1212