A US federal law enacted in 1996 to protect the privacy and security of personal health information. It sets guidelines for covered entities, including healthcare providers, health plans, and clearinghouses, as well as their business associates who handle PHI. The law aims to ensure the confidentiality, integrity, and availability of PHI, particularly electronic PHI (ePHI).
Covered Entities and Business Associates
HIPAA applies to covered entities, which include healthcare providers, health plans, and healthcare clearinghouses. Business associates who handle PHI on behalf of covered entities are also subject to HIPAA regulations. These entities must comply with the law's requirements for protecting PHI and ePHI.
Key Requirements
- Confidentiality: Ensures that PHI is accessed only by authorized individuals.
- Integrity: Guarantees that PHI is accurate and not altered improperly.
- Availability: Ensures that PHI is accessible when needed for healthcare operations.
Individual Rights
HIPAA grants individuals the right to access and control their PHI. It also outlines procedures for reporting and investigating HIPAA violations to ensure compliance and protect patient privacy.
