HIPAA

The Health Insurance Portability and Accountability Act of 1996 (HIPAA), Public Law 104-191, is a federal law seeking simplification and easing burdens in health care transactions through uniform rules affecting electronic transactions, code sets, security of electronic transactions and uniform identifiers for parties involved in electronic health care transactions and the health care delivery system. HIPAA also seeks uniformity in the privacy practices of HIPAA covered-entities and assurances of certain rights that individuals enjoy relative to their medical records. While HIPAA's statutory provisions were passed by Congress and signed by the President in 1996, regulations implementing the law came much later and at staggered times.

HIPAA has four (4) parts:
1) privacy;
2) electronic transactions and code sets;
3) security, and
4) uniform identifiers for employers, providers, patients, and health plans.

The Department of Health and Human Services (HHS) is the federal agency responsible for HIPAA implementation, education and enforcement. HHS' Centers for Medicare and Medicaid Services (CMS) is the HIPAA enforcement agency for electronic transactions and code sets, security of electronic transactions, and national identifiers. HHS' Office of Civil Rights is the HIPAA enforcement agency for the Privacy Rule.

HIPAA is complex, technical, and governed in large measure by its own definitions and terms of art. This web page is not a tutorial on HIPAA. Rather, it provides links to resources that may be helpful to IMS member practices that either are new to HIPAA or continue to have HIPAA-related questions.

• Are You A HIPAA Covered Entity?
• HIPAA FAQs and Advisories
• HIPAA Privacy Rule
• HIPAA Electronic Transactions and Code Set (TCS) Rule
• HIPAA Security Rule
• HIPAA National Provider Identifier (NPI) Rule
• WEDI SNIP
• Iowa HIPAA SNIP
• Iowa HIPAA Statutory Preemption Report
• Iowa Medical Society - HIPAA Resources