COMPLIANCE INFO - Laserfiche WebLink

Home Browse Search

' What4 HIPAA?-A Basic HIPAA Primer 08/25/2005 09:01`PM Most entities have 24 months from the effective date of the final rules to achieve compliance. Normally, the effective date is 60 days after a rule is published. The Transactions Rule was published on August 17, 2000; the compliance date for that rule was October 16, 2003. The Privacy Rule was published on December 28, 2000, but.due to a minor glitch didn't become effective until April 14, 2001. Compliance with the Privacy Rule was required as of April 14, 2003. The final Security Rule was published April 21, 2003, with compliance required as of April 21, 2005. The final Standard Unique Employer Identifier was published on May 31, 2002.Compliance was required by July 30, 2004. The final rule establishing the National Provider Identifier(NPI) rule was published January 23, 2004. The compliance date is May 23, 2007 for most covered entities. Healthcare providers may begin applying for NPIs beginning May 23, 2005. A final standard for a Health Plan Identifier has not yet been published. • For more information, see our Comoliance Calendar on the Status of HIPAA Regulations. How are healthcare organizations affected? Broadly and deeply. Required compliance responses aren't standard, because organizations aren't. For example, an organization.with a computer network will be required to implement one or more security authentication access mechanisms— "user-based,""role-based," and/or"context-based" access—depending on its network environment. Effective compliance requires organization=wide implementation. . Compliance requirements? include: • Building initial organizational awareness of HIPAA • Comprehensive assessment of the organization's privacy practices, information security systems and procedures, and use of electronic transactions • Developing an action plan for compliance with each rule • Developing a technical.and management infrastructure to implement the plans • Implementing a comprehensive implementation action plan, including o Developing new policies, processes,and procedures to ensure privacy, security and patients' rights o Building business associate agreements with business partners to support HIPAA objectives o Developing a`secure technical and physical information infrastructure o Updating information systems to safeguard.protected health information (PHI) and enable use of standard claims and related transactions c, Training of all workforce members o Developing and maintaining an internal privacy and security management and enforcement ifrfrastructure, including providing a Privacy Officer and a Security Officer The Rules Under HIPAA HIPAA's"Administrative Simplification" provision is composed of four parts, each of which have generated a variety of"rules" promulgated by the Department of Health and Human Services. The four parts of Administrative Simplification are: 1. Standards for Electronic Transactions 2. Unique Identifiers Standards 3. Security Rule 4. Privacy Rule 1. Standards for Electronic Transactions The term "Electronic Health Transactions" includes health claims, health plan eligibility, enrollment and disenrollment, payments for care and health plan premiums, claim status, first injury reports, coordination of benefits, and related transactions. http://www.hipaadvisory.com/RECS/HIPAAprimer.htm Page 2 of 4