HIMSS: HIPAA

The Health Insurance Portability and Accountability Act (HIPAA) is a U.S. law that sets standards for the protection of personal health information (PHI). HIPAA applies to healthcare providers, health plans, and healthcare clearinghouses that handle PHI. HIPAA requires these entities to implement safeguards to protect the privacy of PHI and to ensure that it is used and disclosed appropriately. HIPAA also gives individuals the right to access and control their PHI.

Under HIPAA, covered entities must have policies and procedures in place to ensure the confidentiality, integrity, and security of PHI. They must also provide individuals with notice of their privacy rights and the uses and disclosures of their PHI that are permitted or required by law. HIPAA also requires covered entities to have mechanisms in place to report and investigate any potential breaches of PHI.

HIPAA is enforced by the U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR). Covered entities that violate HIPAA may be subject to civil and criminal penalties.