8 Things Know HIPAAThe federal government passed a law known as the Health Insurance Portability and Accountability Act in 1996. Commonly referred to as HIPAA, the measure was written to serve two main functions. The law’s primary purpose–portability–is to protect workers and their families from losing health insurance coverage when changing jobs or suffering a layoff. HIPAA’s secondary purpose–accountability– protects the privacy and security of individual health information. In 2016 HIPAA turned twenty. Here’s what you should know.

1. PHI wears many hats

HIPAA has been amended every few years since it was signed into law. An update implemented in 2003, known as the Privacy Rule, defined private health information (PHI) as any health-related information that can be used to identify a particular individual.

2. Organizations are slow on the uptake

In 2005 the Security Rule was added to HIPAA creating administrative, physical, and technical guidelines to standardize the handling of electronic PHI. Unfortunately a 2016 HIPAA compliance survey, found that only 70 percent of healthcare organizations planned to become compliant.

3. HHS has power to enforce these laws

The Department of Health and Human Services (HSS) was granted power in 2006 to monitor organizations under the Enforcement Rule. HSS has the power to investigate complaints related to the Privacy and Security Rules. It also allows HSS to fine organizations which fail to comply with HIPAA regulations.

4. BAAs must comply with HIPAA too

All health-related businesses must follow HIPAA guidelines. The HITECH rule requires healthcare organizations to notify their Business Associate Agreements (BAAs) that they are legally bound to comply with HIPAA. The 2016 survey indicated that only 60 percent of healthcare organizations were aware of these expectations.

5. You may be subject to a compliance audit

HHS has conducted compliance audits for just over five years. Your company may be subject to an audit as a method to increase HIPAA compliance and expectation awareness. Last year only 40 percent of healthcare organizations were informed that an audit may take place.

6. It’s legal to store encrypted health info indefinitely

The omnibus rule of 2013 allows companies to store PHI forever, but the information must be encrypted. Last year’s survey showed only 69 percent of healthcare organizations were aware of this HIPAA update three years later.

7. HIPAA compliance declines in some areas

The survey also showed a decrease in the number of organizations providing HIPAA compliance training since, and a decrease in the number of security and privacy officers employed since 2014.

8. Many providers are moving to electronic communication

More healthcare providers are using mobile apps, email, social media, and text messages to communicate with patients. As more organizations move to electronic communication, it is important to regulate the security of these processes. Over the last two years, more organizations claim they are confident that when communicating sensitive information electronically they are following HIPAA regulations. As we settle into the technology era maybe more than 25 percent of organizations (on average) will claim their process is HIPAA approved.