HIPAA Compliance Check for Small Practices

The Health Insurance Portability and Accountability Act of 1996 (HIPAA) and its regulations at 45 CFR Parts 160 and 164 apply to “covered entities” (health plans, health care clearinghouses and health care providers who send health information electronically for standard transactions such as insurance billing) and to their “business associates”, the vendors and contractors that handle protected health information (PHI) for them. That means a solo therapist who bills insurance, a small dental or chiropractic clinic, a medical billing freelancer or an IT provider to a clinic can all be within HIPAA. The Privacy Rule controls how PHI is used and disclosed and gives patients rights such as access to their records, the Security Rule requires administrative, physical and technical safeguards for electronic PHI, and the Breach Notification Rule sets strict timelines for telling patients and HHS when things go wrong.

The HHS Office for Civil Rights (OCR) enforces HIPAA and has run repeated enforcement initiatives against small providers, especially for failing to give patients timely access to records and for never carrying out a Security Rule risk analysis. Civil penalties are tiered by culpability and adjusted for inflation each year, with annual caps of over $2 million per provision violated, and knowingly misusing PHI is a federal crime under 42 U.S.C. §1320d-6. State attorneys general can also sue under the HITECH Act. HHS has also proposed tougher Security Rule requirements, so getting the basics in place now matters.