Network Computing is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them. Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

2003 Survivor's Guide to Business Applications: Page 9 of 15

HIPAA Compliance

If you're in the health sector, it will be difficult to sidestep a legal entity the size of HIPAA (Health Insurance Portability and Accountability Act). HIPAA aims to combat fraud and abuse in health care and improve health care systems by encouraging the electronic transfer of health care information. It applies to all health care providers--doctors, hospitals and pharmacists, for example--who conduct electronic transactions for health claims, health plans such as HMOs, Medicare and state Medicaid programs, and health-care clearinghouses that process health-care information. Small, self-administered health plans are excluded from HIPAA.

The act requires the U.S. Department of Health and Human Services to establish national standards for health care provider identifiers, security and electronic signatures, transaction code sets, and privacy of individually identifiable health information. The privacy rules and transaction code sets will take effect in 2003, though the rules for provider identifiers and security and electronic signatures are not final.

This is a huge beast to grapple with. The privacy rules, for example, require enterprises to inform patients of their privacy rights and how their information is used; adopt and implement clear privacy procedures; train employees regarding the privacy procedures; designate a responsible individual to oversee the procedures' adoption and implementation; and secure patient records that contain individually identifiable health information. Granted, there's already software that can provide secure access to patient records. Critical Path's directory and metadirectory technology is one example. But that's only one aspect of one rule; the rest remains a moving target on the legislative calendar.

No software vendor has an umbrella big enough to cover every aspect of HIPAA compliance. If you want a one-stop shop, you'll need to look at a consulting service, such as Phoenix Health Systems, where a number of solutions will apply to ensure network security, data integrity and privacy in the storage and transfer of health information, such as patient records.