Regulatory and Legislative Issues Paper

Regulatory and Legislative Issues Paper

The Health Insurance Portability and Accountability Act (HIPAA) was passed in 1996 by the U.S. Congress. February 26, 2003-the date compliance is required (Bowers, 2001). “It established federal regulations that force doctors, hospitals, and other health care providers to meet some baseline standards when handling electronic protected health information (ePHI), such as medical records and medical patient accounts and national identifiers for providers, health plans, and employers” (Security Innovation, Inc. 2006,). “However, these standards are not meant to be a final set of objectives for health care providers. Rather, they are meant to serve as a starting point to make sure that all entities responsible for handling patient PHI are all following a standard, minimum set of rules to ensure there is some typical expected level of protection enforcement. It is also meant as the starting point for achieving more ambitious goals in the national health care system (Office of the National Coordinator for Health Information Technology (ONC): Directory of Federal HIT Programs). 

Prior to HIPAA legislation, personal information on patients that accumulated in various private databases were thought to be the property of the organization that owned the database. The major underlying concept of HIPAA is the notion that the owners of databases are not necessarily the owners of data contained therein - they are only intermediaries” (Security Innovation, Inc. 2006,). This is a fundamental paradigm shift affecting the administration of health care records, because HIPAA compliant organizations must ensure that record owners are guaranteed:

1) Access to their own records and the right to request corrections of errors.

2) Prior knowledge pertaining to how their information will be used.

3) Explicit consent from the involved individuals before ePHI can be used for marketing.

4) The right to ask and expect health organizations to take...