Question:
We are concerned about potential HIPAA violations. Where can our
nonprofit turn to find out if we are violating HIPAA and what we
need to do to fix this problem?
Answer:
The
Health Insurance Portability and Accountability Act of 1996
("HIPAA") impacts any business that is a "covered
entity" and those entities that work with them directly or
indirectly, known as "business associates." HIPAA
has been implemented through a series of separate, but
inter-connected, regulations. The Privacy Rule governs the
use and disclosure of certain health information that is known as
protected health information (or "PHI"), whether in oral,
written, or electronic form. It requires safeguards to
protect the privacy of PHI, sets boundaries on uses and disclosures
that may be made of such information without patient authorization,
and grants patients certain rights regarding their health
information. The Security Rule provides various
administrative, physical, and
