Significance of HIPAA Risk Assessment

HIPAA, or the Health Insurance Portability and Accountability Act, was first enacted in 1996. This federal regulation guarantees the privacy of individuals’ protected health information (PHI) within medical and legal settings.

The Department of Health and Human Services (HHS) has adopted national standards to which electronic health care transactions must conform. Part of HIPAA regulation is dedicated to protecting individually identifiable health information.

With the transfer of electronic health records (EHR) in so many hospitals, hospital systems, and doctor’s offices, the need for privacy of individual records has increased.

In order to keep patients’ records private, health care employees are often required to undergo training on HIPAA regulation and are expected to uphold certain privacy and security standards. Hospital and medical office employees are bound to keep medical information private and can access patient information only when absolutely necessary for treatment or for payment of bills. Computerized systems in hospitals and medical offices must track personnel access to EHR.

The amount of people who actually have access to private patient information is higher than one would expect. Health insurance companies clearly would have access to that information. On worker’s compensation and no fault insurance cases, attorneys and their office personnel often have access to patient information as well. Insurance companies and law office are also accountable to HIPAA privacy standards, and anyone in violation of the regulation can be fined and even jailed. Violations of these laws are being taken increasingly seriously by HHS.

The mandatory counseling of employees through training on HIPAA risk assessment regulation and on policies and procedures put in place to protect patients’ PHI is meant to help reduce the risk of HIPAA violations and breaches of PHI. Anyone whose job involves seeing or handling of patients’ personal medical data must be educated about its privacy and held accountable in the event that a violation does occur.