J&D Benefits Perspective

HIPAA Security Rules & Resource Guide

Jody Lee, Corporate Training Manager, Johnson & Dugan

The HIPAA security compliance deadline for small health plans (those with $5 million or less in annual receipts) is April 20, 2006. For highlights of the security regulation, and a list of compliance resources, continue reading.

Final HIPAA Portability Regulations

Jody Lee, Corporate Training Manager, Johnson & Dugan

Since taking effect in 1996, there has been little change to the HIPAA (Health Insurance Portability and Accountability Act) rules governing group health plan portability provisions, and the procedures for compliance have become routine.

On December 20, 2004, final regulations were jointly released by the Internal Revenue Service (IRS), the Department of Labor (DOL) and the Department of Health and Human Services (HHS). These regulations take effect on the first day of the first plan year on or after July 1, 2005, and provide clarification to certificates of creditable coverage, special open enrollments and pre-existing condition limitations. A brief overview and compliance guidelines are included below.

Legilsative Brief - HIPAA Security Regulations

On February 20, 2003, the Department of Health and Human Services (HHS) released final HIPAA Security Regulations which establish a minimum standard for security of electronic Protected Health Information (ePHI). The standards require that basic safeguards be implemented to protect ePHI from unauthorized access, alteration, deletion, or transmission. With the exception of small health plans, Covered Entities are required to comply by April 20, 2005. Small health plans (a health plan with annual receipts of $5 million or less) have an additional year to comply.

The HIPAA Privacy Regulations govern a) who may access Protected Health Information (PHI) and b) how PHI may be used and disclosed. The HIPAA Privacy Regulations govern PHI that is oral, electronic, or written.

In contrast, the HIPAA Security Regulations set forth administrative, physical, or technical security standards that are intended to ensure that only those individuals who should have access to ePHI have access. The HIPAA Security Regulations only govern ePHI and require that security measures be in place to protect ePHI.