HIPAA Security Standards

Status

The final Security Rule, published February 20, 2003, adopts standards for the security of electronic protected health information to be implemented by health plans, health care clearinghouses, and certain health care providers. The compliance date for most covered entities will be April 21, 2005 (April 21, 2006 for small health plans).

The proposed electronic signatures component of the rule has been delayed until a later date.

Background

The confidentiality of health information is threatened not only by the risk of improper access to stored information, but also by the risk of interception during electronic transmission of the information. Currently, no standard measures exist in the health care industry that address all aspects of the security of electronic health information while it is being stored or during the exchange of that information between entities.

Purpose

The purpose of the final Security Rule is to adopt national standards for safeguards to protect the confidentiality, integrity, and availability of electronic protected health information and require that measures to be taken to secure this information while in the custody of entities covered by HIPAA (covered entities) as well as in transit between covered entities and from covered entities to others.

• Ensures integrity, confidentiality and availability of electronic protected health information
• Protects against reasonably anticipated threats or hazards, and improper use or disclosure

Scope

• Includes all electronic protected health information (EPHI)
• Includes protected health information that is transmitted or maintained electronically
• Applies to all covered entities

General Concepts

• Flexible, Scalable - Permits standards to be interpreted and implemented appropriately from the smallest provider to the largest plan
• Comprehensive - Covers all aspects of security, behavioral as well as technical
• Technology Neutral - Allows the utilization of future technological advances

Standards

The standards are general requirements and include:

• Eighteen administrative, physical and technical standards
• Four organizational standards - Hybrid entities, affiliated entities, business associate contracts, group health plan requirements
• Two overarching standards - Policies and procedures; and documentation requirements