HIPAA Basics

The Health Insurance Portability and Accountability Act (HIPAA) of 1996 was signed into law by President Clinton on August 21, 1996. The act was originally conceived to guarantee that health insurance coverage is available to workers and their families when they change or lose their jobs. The law's original scope has expanded and now requires the Secretary of Health and Human Services to include provisions for standardizing the data content and format for electronic transactions (administrative simplification), privacy of confidential personal health care information, secure physical access to records, and national identifiers for providers, employers, and health plans.

Administrative Simplification - Three major components of the healthcare industry are treatment, payment, and operations. The Secretary of Health and Human Services was given the authority, through Title II of HIPAA, to simplify these three necessary functions of the health care industry by adopting "administrative simplification" rules designed to reduce the cost of administering both private and public health plans. This authority allows the Secretary to adopt standards for transactions, and data elements for such transactions, to enable health information to be exchanged electronically.

Code Sets - Code sets are defined as either internal or external. Internal code sets are specified by the Accredited Standards Committee X12N Implementation Guides and are transaction specific. External codes can be medical or non-medical, and are maintained by external organizations to allow for more rapid implementation of revisions.

Taxonomy - Provider taxonomy was developed by a committee with members representing the provider, payer, state and federal governments and standard setting organizations as a method of codifying and simplifying the current billing classifications of provider type, provider specialty, and category of service. Codes for these three areas are often redundant and overlapping; and are not consistent from one payer to another.

Covered Entity - Administrative Simplification defines a covered entity as a health plan, a health care clearinghouse, or a health care provider who transmits any health information in electronic form in connection with a covered transaction. The law does not require providers to submit transactions electronically, but it does require that all transactions submitted electronically comply with the standards. To comply with the transaction standards, health care providers and health plans may exchange the standard transactions directly, or they may contract with a clearinghouse to perform this function. Clearinghouses may receive non-standard transactions from a provider, but they must convert these into standard transactions for submission to the health plan. Similarly, if a health plan contracts with a clearinghouse, the health plan may submit non-standard transactions to the clearinghouse, but the clearinghouse must convert these into standard transactions for submission to the provider.

National Identifier Standards

• National Provider Identifier Standard - health care providers can begin applying for NPIs on the effective date of the final rule, which is May 23, 2005.
• Standard Unique Employer Identifier - published May 31, 2002 and became effective July 30, 2004 for healthcare providers, health plans, and healthcare clearinghouses. Small health plans have until August 1, 2005 to comply.
• National Health Plan Identifier - under development; not yet available
• Unique Health Identifier for Individuals - suspended, as directed by Congress

Privacy - The Privacy Rule for the first time creates national standards to protect individuals' medical records and other personal health information. The rule gives the patients more control over their health information by setting boundaries on the use and release of health records and by establishing appropriate safeguards that health care providers and others must achieve to protect the privacy of health information.

Security - The purpose of the Security Rule is to adopt national standards for safeguards to protect the confidentiality, integrity, and availability of electronic protected health information and require that measures to be taken to secure this information while in the custody of entities covered by HIPAA (covered entities) as well as in transit between covered entities and from covered entities to others.

HIPAA Mandated Transactions - The law does not require providers to submit transactions electronically. It does require that all transactions submitted electronically comply with the standards. To comply with the transaction standards, health care providers and health plans may exchange the standard transactions directly, or they may contract with a clearinghouse to perform this function.