HIPAA HistoryHIPAA History

March 3, 2005March 3, 2005

HIPAA HIPAA RulingRuling

Health Insurance Portability Health Insurance Portability Accountability ActAccountability Act

Passed by Congress in 1996Passed by Congress in 1996 Also known as the Kassebaum-Kennedy Also known as the Kassebaum-Kennedy A focus Protecting the Privacy of A focus Protecting the Privacy of

Patient’s Health InformationPatient’s Health Information Legislation was not introduced and so it Legislation was not introduced and so it

was left to Health and Human Services to was left to Health and Human Services to craft the legislation.craft the legislation.

HIPAA TimelineHIPAA Timeline August 21, 1996: August 21, 1996: Congress enacted the Health Congress enacted the Health

Insurance Portability and Accountability Act (HIPAA.) It Insurance Portability and Accountability Act (HIPAA.) It required the Secretary of Health and Human Services required the Secretary of Health and Human Services (HHS) to propose standards protecting the privacy of (HHS) to propose standards protecting the privacy of individually identifiable health information by August 21, individually identifiable health information by August 21, 1997. 1997.

September 11, 1997: September 11, 1997: The Secretary submitted a report The Secretary submitted a report to Congress recommending and urging to Congress recommending and urging comprehensive comprehensive privacyprivacy legislation by August 21, 1999. If Congress failed legislation by August 21, 1999. If Congress failed to act by that date, the Secretary was directed to finalize to act by that date, the Secretary was directed to finalize regulations containing proposed standards relating to theregulations containing proposed standards relating to the electronic transfer of medical information by February 21, electronic transfer of medical information by February 21, 2000. 2000.

HIPAA TimelineHIPAA Timeline August 21, 1999: August 21, 1999: Congress was unable to reach Congress was unable to reach

consensus on comprehensive privacy legislation. The consensus on comprehensive privacy legislation. The Secretary of HHS took action to finalize regulations.Secretary of HHS took action to finalize regulations.

October 29, 1999October 29, 1999: The Clinton Administration : The Clinton Administration announced proposed rules. announced proposed rules.

November 3, 1999:November 3, 1999: Proposed privacy standards Proposed privacy standards were published in the were published in the Federal RegisterFederal Register. .

January 3, 2000:January 3, 2000: Initial deadline for the 60-day Initial deadline for the 60-day comment period on proposed privacy standards comment period on proposed privacy standards ends. This deadline was extended to February 17, ends. This deadline was extended to February 17, 2000. 2000.

HIPAA TimelineHIPAA Timeline

August 17, 2000:August 17, 2000: Transaction and Code Sets Final Transaction and Code Sets Final Rule published. Rule published.

December 20, 2000December 20, 2000: The Secretary released the final : The Secretary released the final regulations setting a compliance deadline of February regulations setting a compliance deadline of February 26, 2003. This deadline was later extended to April 26, 2003. This deadline was later extended to April 14, 2003. 14, 2003.

December 28, 2000:December 28, 2000: Privacy Final Rule published in Privacy Final Rule published in the the Federal RegisterFederal Register. .

July 6, 2001:July 6, 2001: HHS issued first guidance on privacy HHS issued first guidance on privacy protections. protections.

HIPAA TimelineHIPAA Timeline December 27, 2001:December 27, 2001: H.R. 3323, the Administrative H.R. 3323, the Administrative

Simplification Compliance Act (now known as Public Simplification Compliance Act (now known as Public Law 107-105), was signed into law by President Law 107-105), was signed into law by President Bush. It provided for a one-year extension for Bush. It provided for a one-year extension for complying with the standard transactions and code complying with the standard transactions and code set requirements. set requirements.

March 27, 2002:March 27, 2002: Proposed changes to the privacy Proposed changes to the privacy standards were published in thestandards were published in the Federal Register Federal Register. .

October 16, 2002:October 16, 2002: Compliance deadline for Compliance deadline for Transaction and Code Sets unless request for Transaction and Code Sets unless request for extension and compliance plan filed with DHHS by extension and compliance plan filed with DHHS by October 15, 2002. October 15, 2002.

HIPAA TimelineHIPAA Timeline

February 20, 2003: Final rule adopting February 20, 2003: Final rule adopting standards for the security of electronic PHI standards for the security of electronic PHI was published in the Federal Register.was published in the Federal Register.

April 14, 2003:April 14, 2003: Compliance deadline for Compliance deadline for Privacy standards for all covered entities Privacy standards for all covered entities except small health plans. except small health plans.

October 16, 2003:October 16, 2003: Compliance deadline for Compliance deadline for Transaction and Code Sets.Transaction and Code Sets.

HIPAA TimelineHIPAA Timeline

April 14, 2004:April 14, 2004: Compliance deadline for Compliance deadline for Privacy standards for small health plans Privacy standards for small health plans with less than $5 million in annual with less than $5 million in annual receipts.receipts.

April 21, 2005:April 21, 2005: Compliance deadline for Compliance deadline for complying with the standards for complying with the standards for security electronic PHI. security electronic PHI.

Glossary Look UpGlossary Look UpHealth Insurance Portability and Accountability Act (HIPPA), also known as the Kassebaum-Kennedy law:

Milestone legislation passed by Congress and signed into law in 1996. It sends a strong message that the federal government wants Americans to plan for their own long-term care protection. The law clarifies tax treatment of qualified long-term care policies. It also includes a provision that makes it a federal crime to willfully dispose of assets to qualify for Medicaid coverage of nursing home and other long-term care services. www.newmanltc.com/glossary.asp

HIPAA 3 PartsHIPAA 3 Parts

Privacy Privacy Code SetsCode Sets SecuritySecurity

HIPAA SecurityHIPAA Security

AdministrativeAdministrative PhysicalPhysical TechnicalTechnical

General Security General Security RequirementsRequirements

Ensure the confidentiality, integrity and Ensure the confidentiality, integrity and availability of all electronic protected health availability of all electronic protected health information the covered entity creates receives information the covered entity creates receives maintains or transmits. maintains or transmits.

Protect against any reasonably anticipated threats Protect against any reasonably anticipated threats or hazards to the security of such information.or hazards to the security of such information.

Protect against any reasonably anticipated uses or Protect against any reasonably anticipated uses or disclosures of such information that are not disclosures of such information that are not permitted or required under the final HIPAA permitted or required under the final HIPAA privacy rule. privacy rule.

Ensure compliance with the HIPAA security rule by Ensure compliance with the HIPAA security rule by its workforce.its workforce.

Who is effected by HIPAAWho is effected by HIPAA

  Covered EntitiesCovered Entities Healthcare organizationsHealthcare organizations Health PlansHealth Plans ProvidersProviders Clearing HousesClearing Houses EmployersEmployers Health Care Vendors Health Care Vendors 

HIPAA “Another View”HIPAA “Another View”

Resident Safety

Information Security

Resident Quality

Triad Of Resident Confidence