health insurance portability and accountability act health insurance portability and accountability act the health insurance portability and accountability act of 1996 (hipaa or the kennedy–kassebaum act) is a united states act of congress enacted by the 104th united states congress and signed into law by president bill clinton on august 21, 1996. it modernized the flow of healthcare information, stipulates how personally identifiable information maintained by the healthcare and healthcare insurance industries should be protected from fraud and theft, and addressed some limitations on healthcare insurance coverage. it generally prohibits healthcare providers and healthcare businesses, called covered entities, from disclosing protected information to anyone other than a patient and the patient's authorized representatives without their consent. with limited exceptions, it does not restrict patients from receiving information about themselves. it does not prohibit patients from voluntarily sharing their health information however they choose, nor does it require confidentiality where a patient discloses medical information to family members, friends, or other individuals not a part of a covered entity. health insurance portability and accountability act of 1996other short titleskassebaum–kennedy act, kennedy–kassebaum actlong titlean act to amend the internal revenue code of 1996 to improve portability and continuity of health insurance coverage in the group and individual markets, to combat waste, fraud, and abuse in health insurance and health care delivery, to promote the use of medical savings accounts, to improve access to long-term care services and coverage, to simplify the administration of health insurance, and for other purposes.acronyms (colloquial)hipaa (pronounced /ˈhɪpə/, hip-uh)enacted bythe 104th united states congresscitationspublic lawpub. l. 104–191 (text) (pdf)statutes at large110 stat. 1936legislative historyintroduced in the house as h.r. 3103 by bill archer (r-tx) on march 18, 1996committee consideration by house ways and meanspassed the house on march 28, 1996 (267–151)passed the senate on april 23, 1996 (100–0, in lieu of s. 1028)reported by the joint conference committee on july 31, 1996; agreed to by the house on august 1, 1996 (421–2) and by the senate on august 2, 1996 (98–0)signed into law by president bill clinton on august 21, 1996 the act consists of five titles. title i of hipaa protects health insurance coverage for workers and their families when they change or lose their jobs. title ii of hipaa, known as the administrative simplification (as) provisions, requires the establishment of national standards for electronic health care transactions and national identifiers for providers, health insurance plans, and employers. title iii sets guidelines for pre-tax medical spending accounts, title iv sets guidelines for group health plans, and title v governs company-owned life insurance policies. titles there are five sections to the act, known as titles. title i: health care access, portability, and renewability title i of hipaa regulates the availability and breadth of group health plans and certain individual health insurance policies. it amended the employee retirement income security act, the public health service act, and the internal revenue code. furthermore, title i addresses the issue of "job lock" which is the inability for an employee to leave their job because they would lose their health coverage. to combat the job lock issue, the title protects health insurance coverage for workers and their families if they lose or change their jobs. title i requires the coverage of and also limits restrictions that a group health plan can place on benefits for preexisting conditions. group health plans may refuse to provide benefits in relation to preexisting conditions for either 12 months following enrollment in the plan or 18 months in the case of late enrollment. title i allows individuals to reduce the exclusion period by the amount of time that they have had "creditable coverage" before enrolling in the plan and after any "significant breaks" in coverage. "creditable coverage" is defined quite broadly and includes nearly all group and individual health plans, medicare, and medicaid. a "significant break" in coverage is defined as any 63-day period without any creditable coverage. along with an exception, allowing employers to tie premiums or co-payments to tobacco use, or body mass index. title i also requires insurers to issue policies without exclusion to those leaving group health plans with creditable coverage (see above) exceeding 18 months, and renew individual policies for as long as they are offered or provide alternatives to discontinued plans for as long as the insurer stays in the market without exclusion regardless of health condition. some health care plans are exempted from title i requirements, such as long-term health plans and limited-scope plans like dental or vision plans offered separately from the general health plan. however, if such benefits are part of the general health plan, then hipaa still applies to such benefits. for example, if the new plan offers dental benefits, then it must count creditable continuous coverage under the old health plan towards any of its exclusion periods for dental benefits. an alternate method of calculating creditable continuous coverage is available to the health plan under title i. that is, 5 categories of health coverage can be considered separately, including dental and vision coverage. anything not under those 5 categories must use the general calculation (e.g., the beneficiary may be counted with 18 months of general coverage, but only 6 months of dental coverage, because the beneficiary did not have a general health plan that covered dental until 6 months prior to the application date). since limited-coverage plans are exempt from hipaa requirements, the odd case exists in which the applicant to a general group health plan cannot obtain certificates of creditable continuous coverage for independent limited-scope plans, such as dental to apply towards exclusion periods of the new plan that does include those coverages. hidden exclusion periods are not valid under title i (e.g., "the accident, to be covered, must have occurred while the beneficiary was covered under this exact same health insurance contract"). such clauses must not be acted upon by the health plan. also, they must be re-written so they can comply with hipaa. title ii: preventing health care fraud and abuse; administrative simplification; medical liability reform title ii of hipaa establishes policies and procedures for maintaining the privacy and the security of individually identifiable health information, outlines numerous offenses relating to health care, and establishes civil and criminal penalties for violations. it also creates several programs to control fraud and abuse within the health-care system. however, the most significant provisions of title ii are its administrative simplification rules. title ii requires the department of health and human services (hhs) to increase the efficiency of the health-care system by creating standards for the use and dissemination of health-care information. these rules apply to "covered entities", as defined by hipaa and the hhs. covered entities include health plans, health care clearinghouses (such as billing services and community health information systems), and health care providers that transmit health care data in a way regulated by hipaa. per the requirements of title ii, the hhs has promulgated five rules regarding administrative simplification: the privacy rule, the transactions and code sets rule, the security rule, the unique identifiers rule, and the enforcement rule. privacy rule the hipaa privacy rule is composed of national regulations for the use and disclosure of protected health information (phi) in healthcare treatment, payment and operations by covered entities. the effective compliance date of the privacy rule was april 14, 2003, with a one-year extension for certain "small plans". the hipaa privacy rule regulates the use and disclosure of protected health information (phi) held by "covered entities" (generally, health care clearinghouses, employer-sponsored health plans, health insurers, and medical service providers that engage in certain transactions). by regulation, the hhs extended the hipaa privacy rule to independent contractors of covered entities who fit within the definition of "business associates". phi is any information that is held by a covered entity regarding health status, provision of health care, or health care payment that can be linked to any individual. this is interpreted rather broadly and includes any part of an individual's medical record or payment history. covered entities must disclose phi to the individual within 30 days upon request. also, they must disclose phi when required to do so by law such as reporting suspected child abuse to state child welfare agencies. covered entities may disclose protected health information to law enforcement officials for law enforcement purposes as required by law (including court orders, court-ordered warrants, subpoenas) and administrative requests; or to identify or locate a suspect, a fugitive, a material witness, or a missing person. a covered entity may disclose phi to certain parties to facilitate treatment, payment, or health care operations without a patient's express written authorization. any other disclosures of phi require the covered entity to obtain written authorization from the individual for the disclosure. in any case, when a covered entity discloses any phi, it must make a reasonable effort to disclose only the minimum necessary information required to achieve its purpose. the privacy rule gives individuals the right to request a covered entity to correct any inaccurate phi. also, it requires covered entities to take some reasonable steps on ensuring the confidentiality of communications with individuals. for example, an individual can ask to be called at their work number instead of home or cell phone numbers. the privacy rule requires covered entities to notify individuals of uses of their phi. covered entities must also keep track of disclosures of phi and document privacy policies and procedures. they must appoint a privacy official and a contact person responsible for receiving complaints and train all members of their workforce in procedures regarding phi. an individual who believes that the privacy rule is not being upheld can file a complaint with the department of health and human services office for civil rights (ocr). in 2006 the wall street journal reported that the ocr had a long backlog and ignores most complaints. "complaints of privacy violations have been piling up at the department of health and human services. between april of 2003 and november 2006, the agency fielded 23,886 complaints related to medical-privacy rules, but it has not yet taken any enforcement actions against hospitals, doctors, insurers or anyone else for rule violations. a spokesman for the agency says it has closed three-quarters of the complaints, typically because it found no violation or after it provided informal guidance to the parties involved." however, in july 2011, the university of california, los angeles agreed to pay $865,500 in a settlement regarding potential hipaa violations. an hhs office for civil rights investigation showed that from 2005 to 2008, unauthorized employees repeatedly and without legitimate cause looked at the electronic protected health information of numerous uclahs patients. it is a misconception that the privacy rule creates a right for any individual to refuse to disclose any health information (such as chronic conditions or immunization records) if requested by an employer or business. hipaa privacy rule requirements merely place restrictions on disclosure by covered entities and their business associates without the consent of the individual whose records are being requested; they do not place any restrictions upon requesting health information directly from the subject of that information. 2013 final omnibus rule update in january 2013, hipaa was updated via the final omnibus rule. the updates included changes to the security rule and breach notification portions of the hitech act. the most significant changes related to the expansion of requirements to include business associates, where only covered entities had originally been held to uphold these sections of the law. in addition, the definition of "significant harm" to an individual in the analysis of a breach was updated to provide more scrutiny to covered entities with the intent of disclosing breaches that previously were unreported. previously, an organization needed proof that harm had occurred whereas now organizations must prove that harm had not occurred. protection of phi was changed from indefinite to 50 years after death. more severe penalties for violation of phi privacy requirements were also approved. the hipaa privacy rule may be waived during natural disaster. this was the case with hurricane harvey in 2017. hitech act: privacy requirements see the privacy section of the health information technology for economic and clinical health act (hitech act). right to access one's phi the privacy rule requires medical providers to give individuals access to their phi. after an individual