Hipaa Law And Regulation

Main articles: information privacy and privacy law

Information privacy laws cover the protection of information on private individuals from intentional or unintentional disclosure or misuse. The European Directive on Protection of Personal Data, released on July 25, 1995 was an attempt to unify the laws on data protection within the European Community. As a result, customers of international organizations such as Amazon and eBay in the EU have the ability to review and delete information, while Americans do not. In the United States the equivalent guiding philosophy is the Code of Fair Information Practice (FIP). This was developed by the Office of Technology Assessment in response to concerns about the potential for electronic surveillance.

The difference in language here is important: in the United States the debate is about privacy where in the European Community the debate is on data protection. Moving the debate from privacy to data protection is seen by some philosophers as a mechanism for moving forward in the practical realm while not requiring agreement on fundamental questions about the nature of privacy.

The basic principles of data protection in the EU are:

• For all data collected there should be a stated purpose
• Information collected by an individual cannot be disclosed to other organizations of individuals unless authorized by law or by consent of the individual.
• Records kept on an individual should be accurate and up to date.
• There should be mechanisms for individuals to review data about them, to ensure accuracy. This may include periodic reporting.
• Data should be deleted when it is no longer needed for the stated purpose.
• Transmission of personal information to locations where "equivalent" personal data protection cannot be assured is prohibited.
• Some data is too sensitive to be collected, unless there are extreme circumstances (e.g., sexual orientation, religion)

Despite the data protection requirements European national ID schemes include data coding standards with religion as a defined (but unused in the EU except in Greece) field.

Because of this, in theory the transfer of personal information from the EU to the US is prohibited when equivalent privacy protection is not in place in the US. In practice, data is transmitted from the EU to the US, India and other data havens. What is required is that the non-EU organization have a data protection or privacy policy. American companies that would work with EU data must comply with the Safe Harbour framework. The core principles of data protected are limited collection, consent of the subject, accuracy, integrity, security, subject right of review and deletion.

United States

Main article: Privacy laws of the United States

HIPAA

The Health Insurance Portability and Accountability Act (HIPAA) was enacted by the U.S. Congress in 1996. HIPAA is also known as the Kennedy-Kassebaum Health Insurance Portability and Accountability Act (HIPAA-Public Law 104-191), effective August 21 , 1996 . The basic idea of HIPAA is that an individual who is a subject of individually identifiable health information should have:

• Established procedures for the exercise of individual health information privacy rights.
• The use and disclosure of individual health information should be authorized or required.

One difficulty with HIPAA is that there must be a mechanism to authenticate the patient who demands access to his or her data. As a result, medical facilities have begun to ask for Social Security Numbers from patients, thus arguably decreasing privacy by simplifying the act of correlating health records with other records. The issue of consent is problematic under HIPAA, because the medical providers simply make care contingent upon agreeing to the privacy standards in practice.

FCRA

The Fair Credit Reporting Act applies the principles of the Code of Fair Information Practice to credit reporting agencies. The FCRA allows individuals to opt out of unwanted credit offers:

• Equifax (888) 567-8688 Equifax Options, P.O. Box 740123 Atlanta GA 30374-0123.

• Experian (800) 353-0809 or (888) 5OPTOUT P.O. Box 919, Allen, TX 75013

• Trans Union (800) 680-7293 or (888) 5OPTOUT P.O Box 97328, Jackson, MS 39238.

Because of the Fair and Accurate Credit Transactions Act, each person can obtain a free annual credit report.

The Fair Credit Reporting Act has been effective in preventing the proliferation of specious so-called private credit guides. Previously, private credit guides offered detailed, if unreliable, information on easily identifiable individuals. Before the Fair Credit Reporting Act salacious unsubstantiated material could be included, in fact gossip was widely included in credit reports. EPIC has a FCRA page. The Consumer Data Industry Association, which represents the consumer reporting industry, also has a Web site with FCRA information.

The Fair Credit Reporting Act provides consumers the ability to view, correct, contest, and limit the uses of credit reports. The FCRA also protects the credit agency from the charge of negligent release in the case of misrepresentation by the requester. Credit agencies must ask the requester the purpose of a requested information release, but need make no effort to verify the truth of the requester's assertions. In fact, the courts have ruled that, "The Act clearly does not provide a remedy for an illicit or abusive use of information about consumers" (Henry v Forbes, 1976). It is widely believed that in order to avoid the FCRA, ChoicePoint was created by Equifax at which time the parent company copied all its records to its newly created subsidiary. ChoicePoint is not a credit reporting agency, and thus FCRA does not apply.

The Fair Debt Collection Practices Act similarly limits dissemination of information about a consumer's financial transactions. It prevents creditors or their agents from disclosing the fact that an individual is in debt to a third party, although it allows creditors and their agents to attempt to obtain information about a debtor's location. It limits the actions of those seeking payment of a debt. For example, debt collection agencies are prohibited from harassment or contacting individuals at work. The Bankruptcy Abuse Prevention and Consumer Protection Act of 2005 (which actually gutted consumer protections, for example in case of bankruptcy resulting from medical cost) limited some of these controls on debtors.

ECPA

The Electronic Communications Privacy Act (ECPA) establishes criminal sanctions for interception of electronic communication. However, the loopholes are so large as to render the Act effectively meaningless. For example, consent can be implied to any reading of electronic communications by accepting employment with an organization that practices surveillance against its employees.

"Safe Harbor" Privacy Framework

Main article: Safe harbor arrangement

Unlike the U.S. approach to privacy protection, which relies on industry-specific legislation, regulation and self-regulation, the European Union relies on comprehensive privacy legislation. The European Directive on Data Protection that went into effect in October 1998, includes, for example, the requirement to create government data protection agencies, registration of databases with those agencies, and in some instances prior approval before personal data processing may begin. In order to bridge these different privacy approaches and provide a streamlined means for U.S. organizations to comply with the Directive, the U.S. Department of Commerce in consultation with the European Commission developed a "safe harbor" framework. The safe harbor - approved by the EU in July 2000 - is a way for U.S. companies to comply with European privacy laws.

Computer Security, Privacy and Criminal Law

The following summarized some of the laws, regulations and directives related to the protection of information systems:

• 1970 U.S. Fair Credit Reporting Act
• 1970 U.S. Racketeer Influenced and Corrupt Organization (RICO) Act
• 1974 U.S. Privacy Act
• 1980 Organization for Economic Cooperation and Development (OECD) Guidelines
• 1984 U.S. Medical Computer Crime Act
• 1984 U.S. Federal Computer Crime Act (strengthened in 1986 and 1994)
• 1986 U.S. Computer Fraud and Abuse Act (amended in 1986, 1994, 1996 and 2001)
• 1986 U.S. Electronic Communications Privacy Act (ECPA)
• 1987 U.S. Computer Security Act
• 1988 U.S. Video Privacy Protection Act
• 1990 United Kingdom Computer Misuse Act
• 1991 U.S. Federal Sentencing Guidelines
• 1992 OECD Guidelines to Serve as a Total Security Framework
• 1994 Communications Assistance for Law Enforcement Act
• 1995 Council Directive on Data Protection for the European Union (EU)
• 1996 U.S. Economic and Protection of Proprietary Information Act
• 1996 Health Insurance Portability and Accountability Act (HIPAA) (requirement added in December 2000)
• 1998 U.S. Digital Millennium Copyright Act (DMCA)
• 1999 U.S. Uniform Computer Information Transactions Act (UCITA)
• 2000 U.S. Congress Electronic Signatures in Global National Commerce Act ("ESIGN")
• 2001 U.S. Provide Appropriate Tools Required to Intercept and Obstruct Terrorism (PATRIOT) Act

See also

• Privacy Commissioner of Canada

HIPAA.ORG

HHS Administrative Simplification HIPAA Web site. CMS HIPAA Web site. The Law. Title II, Subtitle F of HIPAA. HIPAA-REGS LIST-SERV. HHS HIPAA FAQ. NCVHS. Consolidated HIPAA regulations ...

...

The HIPAA Law and Related Information HIPAA - General Information

The HIPAA Law and Related Information; Rule Making Process (creating and publishing regulations) ... HIPAA Law ? You can download the entire law. See ...

...

Health Information Privacy

The Office for Civil Rights enforces the HIPAA Privacy Rule, which protects the privacy of individually identifiable health information, and the confidentiality provisions of the ...

...

Laws, Regulations & Directives - HIPAA

Health Insurance Portability and Accountability Act establishes standards for electronic health care transactions

...

Overview HIPAA - General Information

HIPAA - General Information. Overview; The HIPAA Law and Related Information; Rule Making Process (creating and publishing regulations) ... Act of 1996 (HIPAA, Title ...

...

HIPAA-HIPAA Law and HIPAA Regulation

What is the HIPAA Law? How does the HIPAA Law affect me? How do I make sure my healthcare provider is taking steps to comply with the HIPAA Regulations?

...

Cozen O'Connor: Practice Areas: HIPAA & Privacy Law & Regulation

Overview. Healthcare privacy law has become an increasingly important business issue for providers, insurers, and employers since the enactment of the Health Insurance Portability ...

...

HIPAA Basics: State Law Regulation of Healthcare Privacy and Data ...

1 7289 Effect on State Law -HIPAA, Sec. 1178 Effect on State Law -HIPAA, Sec. 1178 General Rule: HIPAA will supersede any contrary provision of State law • Includes provisions of ...

...

HIPAA Law and Guidelines for Employers: HR Hot Topic: HRhero.com

Related articles on HIPAA law and regulations featured in HR Hero Line, HR Hero White Papers, and Employment Law Post. What to Do When Contagious Illnesses Comes to Work

...

Navigating HIPAA - HIPAA Regulations and Laws

The following chart contains HIPAA regulation timelines and status. Revised .

...