requests information in writing (typically using the provider's form for this purpose), a provider has up to 30 days to provide a copy of the information to the individual. an individual may request the information in electronic form or hard-copy, and the provider is obligated to attempt to conform to the requested format. for providers using an electronic health record (ehr) system that is certified using cehrt (certified electronic health record technology) criteria, individuals must be allowed to obtain the phi in electronic form. providers are encouraged to provide the information expediently, especially in the case of electronic record requests. individuals have the broad right to access their health-related information, including medical records, notes, images, lab results, and insurance and billing information. explicitly excluded are the private psychotherapy notes of a provider, and information gathered by a provider to defend against a lawsuit. providers can charge a reasonable amount that relates to their cost of providing the copy, however, no charge is allowable when providing data electronically from a certified ehr using the "view, download, and transfer" feature which is required for certification. when delivered to the individual in electronic form, the individual may authorize delivery using either encrypted or unencrypted email, delivery using media (usb drive, cd, etc., which may involve a charge), direct messaging (a secure email technology in common use in the healthcare industry), or possibly other methods. when using un-encrypted email, the individual must understand and accept the risks to privacy using this technology (the information may be intercepted and examined by others). regardless of delivery technology, a provider must continue to fully secure the phi while in their system and can deny the delivery method if it poses additional risk to phi while in their system. an individual may also request (in writing) that their phi is delivered to a designated third party such as a family care provider. an individual may also request (in writing) that the provider send phi to a designated service used to collect or manage their records, such as a personal health record application. for example, a patient can request in writing that her ob-gyn provider digitally transmit records of her latest pre-natal visit to a pregnancy self-care app that she has on her mobile phone. disclosure to relatives according to their interpretations of hipaa, hospitals will not reveal information over the phone to relatives of admitted patients. this has in some instances impeded the location of missing persons. after the asiana airlines flight 214 san francisco crash, some hospitals were reluctant to disclose the identities of passengers that they were treating, making it difficult for asiana and the relatives to locate them. in one instance, a man in washington state was unable to obtain information about his injured mother. janlori goldman, director of the advocacy group health privacy project, said that some hospitals are being "overcautious" and misapplying the law, the times reports. suburban hospital in bethesda, md., has interpreted a federal regulation that requires hospitals to allow patients to opt out of being included in the hospital directory as meaning that patients want to be kept out of the directory unless they specifically say otherwise. as a result, if a patient is unconscious or otherwise unable to choose to be included in the directory, relatives and friends might not be able to find them, goldman said. transactions and code sets rule hipaa was intended to make the health care system in the united states more efficient by standardizing health care transactions. hipaa added a new part c titled "administrative simplification" to title xi of the social security act. this is supposed to simplify healthcare transactions by requiring all health plans to engage in health care transactions in a standardized way. the hipaa/edi (electronic data interchange) provision was scheduled to take effect from october 16, 2003, with a one-year extension for certain "small plans". however, due to widespread confusion and difficulty in implementing the rule, cms granted a one-year extension to all parties. on january 1, 2012 newer versions, asc x12 005010 and ncpdp d.0 become effective, replacing the previous asc x12 004010 and ncpdp 5.1 mandate. the asc x12 005010 version provides a mechanism allowing the use of icd-10-cm as well as other improvements. after july 1, 2005 most medical providers that file electronically had to file their electronic claims using the hipaa standards in order to be paid. under hipaa, hipaa-covered health plans are now required to use standardized hipaa electronic transactions. see, 42 usc § 1320d-2 and 45 cfr part 162. information about this can be found in the final rule for hipaa electronic transaction standards (74 fed. reg. 3296, published in the federal register on january 16, 2009), and on the cms website. key edi (x12) transactions used for hipaa compliance are: edi health care claim transaction set (837) is used to submit health care claim billing information, encounter information, or both, except for retail pharmacy claims (see edi retail pharmacy claim transaction). it can be sent from providers of health care services to payers, either directly or via intermediary billers and claims clearinghouses. it can also be used to transmit health care claims and billing payment information between payers with different payment responsibilities where coordination of benefits is required or between payers and regulatory agencies to monitor the rendering, billing, and/or payment of health care services within a specific health care/insurance industry segment. for example, a state mental health agency may mandate all healthcare claims, providers and health plans who trade professional (medical) health care claims electronically must use the 837 health care claim: professional standard to send in claims. as there are many different business applications for the health care claim, there can be slight derivations to cover off claims involving unique claims such as for institutions, professionals, chiropractors, and dentists etc. edi retail pharmacy claim transaction (ncpdp telecommunications standard version 5.1) is used to submit retail pharmacy claims to payers by health care professionals who dispense medications, either directly or via intermediary billers and claims clearinghouses. it can also be used to transmit claims for retail pharmacy services and billing payment information between payers with different payment responsibilities where coordination of benefits is required or between payers and regulatory agencies to monitor the rendering, billing, and/or payment of retail pharmacy services within the pharmacy health care/insurance industry segment. edi health care claim payment/advice transaction set (835) can be used to make a payment, send an explanation of benefits (eob), send an explanation of payments (eop) remittance advice, or make a payment and send an eop remittance advice only from a health insurer to a health care provider either directly or via a financial institution. edi benefit enrollment and maintenance set (834) can be used by employers, unions, government agencies, associations or insurance agencies to enroll members to a payer. the payer is a healthcare organization that pays claims, administers insurance or benefit or product. examples of payers include an insurance company, healthcare professional (hmo), preferred provider organization (ppo), government agency (medicaid, medicare etc.) or any organization that may be contracted by one of these former groups. edi payroll deducted and another group premium payment for insurance products (820) is a transaction set for making a premium payment for insurance products. it can be used to order a financial institution to make a payment to a payee. edi health care eligibility/benefit inquiry (270) is used to inquire about the health care benefits and eligibility associated with a subscriber or dependent. edi health care eligibility/benefit response (271) is used to respond to a request inquiry about the health care benefits and eligibility associated with a subscriber or dependent. edi health care claim status request (276) this transaction set can be used by a provider, recipient of health care products or services or their authorized agent to request the status of a health care claim. edi health care claim status notification (277) this transaction set can be used by a healthcare payer or authorized agent to notify a provider, recipient or authorized agent regarding the status of a health care claim or encounter, or to request additional information from the provider regarding a health care claim or encounter. this transaction set is not intended to replace the health care claim payment/advice transaction set (835) and therefore, is not used for account payment posting. the notification is at a summary or service line detail level. the notification may be solicited or unsolicited. edi health care service review information (278) this transaction set can be used to transmit health care service information, such as subscriber, patient, demographic, diagnosis or treatment data for the purpose of the request for review, certification, notification or reporting the outcome of a health care services review. edi functional acknowledgement transaction set (997) this transaction set can be used to define the control structures for a set of acknowledgments to indicate the results of the syntactical analysis of the electronically encoded documents. although it is not specifically named in the hipaa legislation or final rule, it is necessary for x12 transaction set processing. the encoded documents are the transaction sets, which are grouped in functional groups, used in defining transactions for business data interchange. this standard does not cover the semantic meaning of the information encoded in the transaction sets. brief 5010 transactions and code sets rules update summary transaction set (997) will be replaced by transaction set (999) "acknowledgment report". the size of many fields will be expanded, causing a need for all it providers to expand corresponding fields, element, files, gui, paper media, and databases. some segments have been removed from existing transaction sets. many segments have been added to existing transaction sets allowing greater tracking and reporting of cost and patient encounters. capacity to use both "international classification of diseases" versions 9 (icd-9) and 10 (icd-10-cm) has been added. security rule the final rule on security standards was issued on february 20, 2003. it took effect on april 21, 2003, with a compliance date of april 21, 2005, for most covered entities and april 21, 2006, for "small plans". the security rule complements the privacy rule. while the privacy rule pertains to all protected health information (phi) including paper and electronic, the security rule deals specifically with electronic protected health information (ephi). it lays out three types of security safeguards required for compliance: administrative, physical, and technical. for each of these types, the rule identifies various security standards, and for each standard, it names both required and addressable implementation specifications. required specifications must be adopted and administered as dictated by the rule. addressable specifications are more flexible. individual covered entities can evaluate their own situation and determine the best way to implement addressable specifications. some privacy advocates have argued that this "flexibility" may provide too much latitude to covered entities. software tools have been developed to assist covered entities in the risk analysis and remediation tracking. the standards and specifications are as follows: administrative safeguards – policies and procedures designed to clearly show how the entity will comply with the act covered entities (entities that must comply with hipaa requirements) must adopt a written set of privacy procedures and designate a privacy officer to be responsible for developing and implementing all required policies and procedures. the policies and procedures must reference management oversight and organizational buy-in to compliance with the documented security controls. procedures should clearly identify employees or classes of employees who have access to electronic protected health information (ephi). access to ephi must be restricted to only those employees who have a need for it to complete their job function. the procedures must address access authorization, establishment, modification, and termination. entities must show that an appropriate ongoing training program regarding the handling of phi is provided to employees performing health plan administrative functions. covered entities that out-source some of their business processes to a third party must ensure that their vendors also have a framework in place to comply with hipaa requirements. companies typically gain this assurance through clauses in the contracts stating that the vendor will meet the same data protection requirements that apply to the covered entity. care must be taken to determine if the vendor further out-sources any data handling functions to other vendors and monitor whether appropriate contracts and controls are in