In the U.S., HIPAA privacy compliance refers to a set of policies enacted in 1996 that secure and protect the private health information of U.S. citizens. Those policies are summed up in the act's Standards for Privacy of Individually Identifiable Health Information, otherwise known as the Privacy Rule. Under HIPAA privacy compliance codes, entities that must adhere to the government's private health information standards include health care providers, health plans and health care clearinghouses. Compliance is voluntary for medical facilities as well as for other businesses that may handle private health information, such as adoption agencies, welfare programs and health insurance companies.
HIPAA privacy compliance standards protect all "individually identifiable health information." This is any information that is private and could be used to identify someone, such as a person's name, address, and Social Security Number. This could also be classified as demographic data and information relating to a specific individual's health and medical history.
Entities subject to the guidelines of the privacy rule include health plans, health care providers and healthcare clearinghouses. Essentially, entities subject to the Privacy Rule are restricted from using or sharing an individual's private health information unless it's for a purpose deemed permissible by HIPAA. Release of information also requires authorization from the patient.
Not all medically-related businesses fall under the Privacy Rule guidelines. The the U.S. Department of Health and Human Services (HHS) has a specific set of criteria to identify which businesses need to adhere to the HIPAA privacy compliance rules. Health care providers, for example, only fall under HIPAA privacy compliance if they transmit electronic information in a way that falls under HIPAA's standards. Health care providers include individual practitioners, such as doctors, dentists and psychologists, as well as such businesses as clinics, pharmacies and nursing homes.
Health plan entities that must follow the HIPAA privacy compliance rules include company health plans, health insurance companies, and HMOs. Government programs such as Medicare and Medicaid are included in this group as well. Health care clearinghouses required to comply include any entities that process nonstandard health information received from a third party, such as billing service companies and community health information systems.
If businesses are found in violation of HIPAA privacy compliance policies, they may be fined a civil penalty of up to $11,000 US Dollars (USD) for every violation. Compliance is monitored by the HHS Office for Civil Rights (OCR). The OCR has the power to conduct reviews to ensure compliance as well as to investigate complaints of privacy violation. Under HIPAA, individual states still retain the ability to impose more stringent privacy standards on health care entities.