HIPAA and the Privacy Rule

Public Law 104-191, approved on 21 August 1996, aimed to improve the portability and continuity of health insurance in the group and individual markets, to fight waste, fraud and abuse in health care, to promote medical savings accounts and to simplify the administration of health insurance. Its first title dealt with access, portability and renewability of coverage and barred group health plans from discriminating against members on the basis of health status, a ban later spelled out in federal rules.

An administrative simplification subtitle in Title II told the Secretary of Health and Human Services to adopt standards within 18 months for electronic claims, enrollment, eligibility and payment, including standards for the security of electronic health information. The Secretary was to recommend privacy standards to Congress within 12 months; if Congress had not passed privacy legislation within three years, the department was to issue privacy regulations.

No such law came, and the final Privacy Rule appeared in the Federal Register on 28 December 2000. Until then, its preamble said, virtually no federal rules had protected the privacy of health information or guaranteed patients access to it; the rule set, for the first time, basic national privacy standards. It cited surveys in which one in six Americans said they had given a provider false information, changed physicians or avoided care to protect their privacy.

Most health plans, clearinghouses and providers who billed electronically had to comply by 14 April 2003. Patients gained the right to inspect and obtain copies of their records, to ask for corrections, to receive a notice of privacy practices and to get an accounting of certain disclosures, and covered entities were generally to use or disclose only the minimum information needed. The rule also let covered entities report protected health information without the patient's authorization to public health authorities working to prevent or control disease.