The Administrative Simplification provisions of the Health Insurance Portability and Accountability Act of 1996 (HIPAA, Title II) required the Secretary of HHS to publish national standards for the security of electronic protected health information (e-PHI), electronic exchange, and the privacy and security of health information.In the event of a conflict between this summary and the Rule, the Rule governs. Visit our Security Rule section to view the entire Rule, and for additional helpful information about how the Rule applies. To make it easier to review the complete requirements of the Security Rule, provisions of the Rule referenced in this summary are cited in the end notes. Entities regulated by the Privacy and Security Rules are obligated to comply with all of their applicable requirements and should not rely on this summary as a source of legal information or advice. This is a summary of key elements of the Security Rule and not a complete or comprehensive guide to compliance. Given that the health care marketplace is diverse, the Security Rule is designed to be flexible and scalable so a covered entity can implement policies, procedures, and technologies that are appropriate for the entity’s particular size, organizational structure, and risks to consumers’ e-PHI. While this means that the medical workforce can be more mobile and efficient (i.e., physicians can check patient records and test results from wherever they are), the rise in the adoption rate of these technologies increases the potential security risks.Ī major goal of the Security Rule is to protect the privacy of individuals’ health information while allowing covered entities to adopt new technologies to improve the quality and efficiency of patient care. Health plans are providing access to claims and care management, as well as member self-service applications. Today, providers are using clinical applications such as computerized physician order entry (CPOE) systems, electronic health records (EHR), and radiology, pharmacy, and laboratory systems.

At the same time, new technologies were evolving, and the health care industry began to move away from paper processes and rely more heavily on the use of electronic information systems to pay claims, answer eligibility questions, provide health information and conduct a host of other administrative and clinically based functions. Prior to HIPAA, no generally accepted set of security standards or general requirements for protecting health information existed in the health care industry. Within HHS, the Office for Civil Rights (OCR) has responsibility for enforcing the Privacy and Security Rules with voluntary compliance activities and civil money penalties. The Security Standards for the Protection of Electronic Protected Health Information (the Security Rule) establish a national set of security standards for protecting certain health information that is held or transferred in electronic form. The Security Rule operationalizes the protections contained in the Privacy Rule by addressing the technical and non-technical safeguards that organizations called “covered entities” must put in place to secure individuals’ “electronic protected health information” (e-PHI). The Privacy Rule, or Standards for Privacy of Individually Identifiable Health Information, establishes national standards for the protection of certain health information. 1 To fulfill this requirement, HHS published what are commonly known as the HIPAA Privacy Rule and the HIPAA Security Rule. Department of Health and Human Services (HHS) to develop regulations protecting the privacy and security of certain health information. The Health Insurance Portability and Accountability Act of 1996 (HIPAA) required the Secretary of the U.S.Because it is an overview of the Security Rule, it does not address every detail of each provision. This is a summary of key elements of the Security Rule including who is covered, what information is protected, and what safeguards must be in place to ensure appropriate protection of electronic protected health information. Other Administrative Simplification Rules.Covered Entities & Business Associates has sub items, about Covered Entities & Business Associates.Patient Safety has sub items, about Patient Safety.Mental Health & Substance Use Disorders.Gender Affirming Care, Civil Rights, and Privacy.Special Topics has sub items, about Special Topics.Compliance & Enforcement has sub items, about Compliance & Enforcement.Breach Notification has sub items, about Breach Notification.

Hipaa compliance forms umbraco