Protected health information (PHI) is any information about health status, provision of health care, or payment for health care that is created or collected by a “Covered Entity” and can be linked to a specific individual.
Electronic Protected Health Information (EPHI) is protected health information in electronic form.
Covered Entities are generally health care clearinghouses, employer sponsored health plans, health insurers, and medical service providers that engage in certain transactions related to PHI.
The HIPAA Privacy Rule regulates the use and disclosure of Protected Health Information (PHI). It establishes standards to protect individuals’ medical records and other personal health information. The Rule requires appropriate safeguards to protect the privacy of personal health information, and sets limits and conditions on the uses and disclosures that may be made of such information without patient authorization.
The Security Rule complements the Privacy Rule. While the Privacy Rule pertains to all Protected Health Information (PHI) including paper and electronic, the Security Rule deals specifically with Electronic Protected Health Information (EPHI).
The HIPAA Security Rule establishes standards to protect individuals’ electronic personal health information that is created, received, used, or maintained by a covered entity. The Security Rule requires appropriate administrative, physical and technical safeguards to ensure the confidentiality, integrity, and security of electronic protected health information.
It lays out three types of security safeguards required for compliance: administrative, physical, and technical. For each of these types, the Rule identifies various security standards, and for each standard, it names both required and addressable implementation specifications. Required specifications must be adopted and administered as dictated by the Rule. Addressable specifications are more flexible. Individual covered entities can evaluate their own situation and determine the best way to implement addressable specifications.
Administrative Safeguards – policies and procedures designed to clearly show how the entity will comply with the act
Physical Safeguards – controlling physical access to protect against inappropriate access to protected data
Technical Safeguards – controlling access to computer systems and enabling covered entities to protect communications containing PHI transmitted electronically over open networks from being intercepted by anyone other than the intended recipient.
We help organizations with our 6 step approach for successful implementation of HIPAA compliance.
For more information write to us: