HIPAA Privacy Rule: 2 Things You Should Know About It

1. First of all, there are three kinds of "covered entity" that fall under the HIPAA privacy rule. The first group is the health plan group which includes any company/professional/organization that pays the cost of medical care in some form. It can be health insurer, both private and public, managed care organizations like HMO to military/veteran plans. The next group is the health care provider i.e. the persons/organization who is involved in health and is paid for that. Doctors, hospitals, nurses all fall under this group. The last group is termed as health care clearinghouse and they are involved in processing or facilitating the processing of health information.

2. Now comes what these covered entities are supposed to do. They are supposed to:

a. Tell the patient what their privacy rights are and how information taken from them can be used.

b. Adopt and implement this privacy procedure for their business which can be a practice, hospital or plan.

c. Make sure there is a designated person as a privacy officer who will oversee that privacy procedures are properly being adopted and followed within the organization. It is not necessary to have a post for this position; if the business is small, an existing employee can be given this duty.

d. Provide HIPAA training on this regard to all their employees so that they know how to follow the procedures and privacy policies. As for the training, it is expected that new hires will be trained for getting a HIPAA certificate within a reasonable time. The entities have to however provide documentation to show that these training have taken place.

e. Keep all patient information securely so that people, who are not authorized to access, can get to it.