# data[].attributes.attachment_link.readable_text
This is a summary of key elements of the Security Rule including who is covered, what information is protected, and what safeguards must be in place to ensure appropriate protection of electronic protected health information. Because it is an overview of the Security Rule, it does not address every detail of each provision.

Introduction

The Health Insurance Portability and Accountability Act of 1996 (HIPAA) required the Secretary of the U.S. Department of Health and Human Services (HHS) to develop regulations protecting the privacy and security of certain health information.¹ To fulfill this requirement, HHS published what are commonly known as the HIPAA Privacy Rule and the HIPAA Security Rule. The Privacy Rule, or Standards for Privacy of Individually Identifiable Health Information, establishes national standards for the protection of certain health information. The Security Standards for the Protection of Electronic Protected Health Information (the Security Rule) establish a national set of security standards for protecting certain health information that is held or transferred in electronic form. The Security Rule operationalizes the protections contained in the Privacy Rule by addressing the technical and non-technical safeguards that organizations called "covered entities" must put in place to secure individuals' "electronic protected health information" (e-PHI). Within HHS, the Office for Civil Rights (OCR) has responsibility for enforcing the Privacy and Security Rules with voluntary compliance activities and civil money penalties.

Prior to HIPAA, no generally accepted set of security standards or general requirements for protecting health information existed in the health care industry. At the same time, new technologies were evolving, and the health care industry began to move away from paper processes and rely more heavily on the use of electronic information systems to pay claims, answer eligibility questions, provide health information and conduct a host of other administrative and clinically based functions.

Today, providers are using clinical applications such as computerized physician order entry (CPOE) systems, electronic health records (EHR), and radiology, pharmacy, and laboratory systems. Health plans are providing access to claims and care management, as well as member self-service applications. While this means that the medical workforce can be more mobile and efficient (i.e., physicians can check patient records and test results from wherever they are), the rise in the adoption rate of these technologies increases the potential security risks.

A major goal of the Security Rule is to protect the privacy of individuals' health information while allowing covered entities to adopt new technologies to improve the quality and efficiency of patient care. Given that the health care marketplace is diverse, the Security Rule is designed to be flexible and scalable so a covered entity can implement policies, procedures, and technologies that are appropriate for the entity's particular size, organizational structure, and risks to consumers' e-PHI.

This is a summary of key elements of the Security Rule and not a complete or comprehensive guide to compliance. Entities regulated by the Privacy and Security Rules are obligated to comply with all of their applicable requirements and should not rely on this summary as a source of legal information or advice. To make it easier to review the complete requirements of the Security Rule, provisions of the Rule referenced in this summary are cited in the end notes. Visit our Security Rule section to view the entire Rule, and for additional helpful information about how the Rule applies. In the event of a conflict between this summary and the Rule, the Rule governs.

Statutory and Regulatory Background

The Administrative Simplification provisions of the Health Insurance Portability and Accountability Act of 1996 (HIPAA, Title II) required the Secretary of HHS to publish national standards for the security of electronic protected health information (e-PHI), electronic exchange, and the privacy and security of health information.

HIPAA called on the Secretary to issue security regulations regarding measures for protecting the integrity, confidentiality, and availability of e-PHI that is held or transmitted by covered entities. HHS developed a proposed rule and released it for public comment on August 12, 1998. The Department received approximately 2,350 public comments. The final regulation, the Security Rule, was published February 20, 2003. ² The Rule specifies a series of administrative, technical, and physical security procedures for covered entities to use to assure the confidentiality, integrity, and availability of e-PHI.

The text of the final regulation can be found at 45 CFR Part 160 and Part 164, Subparts A and C.

Who is Covered by the Security Rule

Business Associates

What Information is Protected

Electronic Protected Health Information. The HIPAA Privacy Rule protects the privacy of individually identifiable health information, called protected health information (PHI), as explained in the Privacy Rule and here - PDF. The Security Rule protects a subset of information covered by the Privacy Rule, which is all individually identifiable health information a covered entity creates, receives, maintains or transmits in electronic form. The Security Rule calls this information "electronic protected health information" (e-PHI).³ The Security Rule does not apply to PHI transmitted orally or in writing.

General Rules

The Security Rule requires covered entities to maintain reasonable and appropriate administrative, technical, and physical safeguards for protecting e-PHI.

Specifically, covered entities must:

1. Ensure the confidentiality, integrity, and availability of all e-PHI they create, receive, maintain or transmit;

2. Identify and protect against reasonably anticipated threats to the security or integrity of the information;

3. Protect against reasonably anticipated, impermissible uses or disclosures; and

4. Ensure compliance by their workforce.⁴

The Security Rule defines "confidentiality" to mean that e-PHI is not available or disclosed to unauthorized persons. The Security Rule's confidentiality requirements support the Privacy Rule's prohibitions against improper uses and disclosures of PHI. The Security rule also promotes the two additional goals of maintaining the integrity and availability of e-PHI. Under the Security Rule, "integrity" means that e-PHI is not altered or destroyed in an unauthorized manner. "Availability" means that e-PHI is accessible and usable on demand by an authorized person. ⁵

HHS recognizes that covered entities range from the smallest provider to the largest, multi-state health plan. Therefore the Security Rule is flexible and scalable to allow covered entities to analyze their own needs and implement solutions appropriate for their specific environments. What is appropriate for a particular covered entity will depend on the nature of the covered entity's business, as well as the covered entity's size and resources.

Therefore, when a covered entity is deciding which security measures to use, the Rule does not dictate those measures but requires the covered entity to consider:

Its size, complexity, and capabilities,

Its technical, hardware, and software infrastructure,

The costs of security measures, and

The likelihood and possible impact of potential risks to e-PHI.⁶

Covered entities must review and modify their security measures to continue protecting e-PHI in a changing environment. ⁷

Risk Analysis and Management

The Administrative Safeguards provisions in the Security Rule require covered entities to perform risk analysis as part of their security management processes. The risk analysis and management provisions of the Security Rule are addressed separately here because, by helping to determine which security measures are reasonable and appropriate for a particular covered entity, risk analysis affects the implementation of all of the safeguards contained in the Security Rule.

A risk analysis process includes, but is not limited to, the following activities:

Evaluate the likelihood and impact of potential risks to e-PHI;⁸

Implement appropriate security measures to address the risks identified in the risk analysis;⁹

Document the chosen security measures and, where required, the rationale for adopting those measures;¹⁰ and

Maintain continuous, reasonable, and appropriate security protections.11

Risk analysis should be an ongoing process, in which a covered entity regularly reviews its records to track access to e-PHI and detect security incidents, ¹² periodically evaluates the effectiveness of security measures put in place, ¹³ and regularly reevaluates potential risks to e-PHI. ¹⁴

Administrative Safeguards

Security Management Process. As explained in the previous section, a covered entity must identify and analyze potential risks to e-PHI, and it must implement security measures that reduce risks and vulnerabilities to a reasonable and appropriate level.

Security Personnel. A covered entity must designate a security official who is responsible for developing and implementing its security policies and procedures.15

Information Access Management. Consistent with the Privacy Rule standard limiting uses and disclosures of PHI to the "minimum necessary," the Security Rule requires a covered entity to implement policies and procedures for authorizing access to e-PHI only when such access is appropriate based on the user or recipient's role (role-based access).¹⁶

Workforce Training and Management. A covered entity must provide for appropriate authorization and supervision of workforce members who work with e-PHI.¹⁷ A covered entity must train all workforce members regarding its security policies and procedures,¹⁸ and must have and apply appropriate sanctions against workforce members who violate its policies and procedures.¹⁹

Evaluation. A covered entity must perform a periodic assessment of how well its security policies and procedures meet the requirements of the Security Rule.²⁰

Physical Safeguards

Facility Access and Control. A covered entity must limit physical access to its facilities while ensuring that authorized access is allowed.²¹

Workstation and Device Security. A covered entity must implement policies and procedures to specify proper use of and access to workstations and electronic media.²² A covered entity also must have in place policies and procedures regarding the transfer, removal, disposal, and re-use of electronic media, to ensure appropriate protection of electronic protected health information (e-PHI).²³

Technical Safeguards

Access Control. A covered entity must implement technical policies and procedures that allow only authorized persons to access electronic protected health information (e-PHI).²⁴

Audit Controls. A covered entity must implement hardware, software, and/or procedural mechanisms to record and examine access and other activity in information systems that contain or use e-PHI.²⁵

Integrity Controls. A covered entity must implement policies and procedures to ensure that e-PHI is not improperly altered or destroyed. Electronic measures must be put in place to confirm that e-PHI has not been improperly altered or destroyed.²⁶

Transmission Security. A covered entity must implement technical security measures that guard against unauthorized access to e-PHI that is being transmitted over an electronic network.27

Required and Addressable Implementation Specifications

Covered entities are required to comply with every Security Rule "Standard." However, the Security Rule categorizes certain implementation specifications within those standards as "addressable," while others are "required." The "required" implementation specifications must be implemented. The "addressable" designation does not mean that an implementation specification is optional. However, it permits covered entities to determine whether the addressable implementation specification is reasonable and appropriate for that covered entity. If it is not, the Security Rule allows the covered entity to adopt an alternative measure that achieves the purpose of the standard, if the alternative measure is reasonable and appropriate.²⁸

Organizational Requirements

Covered Entity Responsibilities. If a covered entity knows of an activity or practice of the business associate that constitutes a material breach or violation of the business associate's obligation, the covered entity must take reasonable steps to cure the breach or end the violation.²⁹ Violations include the failure to implement safeguards that reasonably and appropriately protect e-PHI.

Business Associate Contracts. HHS developed regulations relating to business associate obligations and business associate contracts under the HITECH Act of 2009.

Policies and Procedures and Documentation Requirements

A covered entity must adopt reasonable and appropriate policies and procedures to comply with the provisions of the Security Rule. A covered entity must maintain, until six years after the later of the date of their creation or last effective date, written security policies and procedures and written records of required actions, activities or assessments.³⁰

Updates. A covered entity must periodically review and update its documentation in response to environmental or organizational changes that affect the security of electronic protected health information (e-PHI).³¹

State Law

Preemption. In general, State laws that are contrary to the HIPAA regulations are preempted by the federal requirements, which means that the federal requirements will apply.³² "Contrary" means that it would be impossible for a covered entity to comply with both the State and federal requirements, or that the provision of State law is an obstacle to accomplishing the full purposes and objectives of the Administrative Simplification provisions of HIPAA.³³

Enforcement and Penalties for Noncompliance

Compliance. The Security Rule establishes a set of national standards for confidentiality, integrity and availability of e-PHI. The Department of Health and Human Services (HHS), Office for Civil Rights (OCR) is responsible for administering and enforcing these standards, in concert with its enforcement of the Privacy Rule, and may conduct complaint investigations and compliance reviews.

Learn more about enforcement and penalties in the Privacy Rule Summary - PDF and on OCR's Enforcement Rule page.

Compliance Dates

Compliance Schedule. All covered entities, except "small health plans," must have been compliant with the Security Rule by April 20, 2005. Small health plans had until April 20, 2006 to comply.

Copies of the Rule and Related Materials

See our Combined Regulation Text of All Rules section of our site for the full suite of HIPAA Administrative Simplification Regulations and HIPAA for Professionals for additional guidance material.
[1]Pub. L. 104-191. [3] 45 C.F.R. § 160.103. [4] 45 C.F.R. § 164.306(a). [5] 45 C.F.R. § 164.304. [6] 45 C.F.R. § 164.306(b)(2). [7] 45 C.F.R. § 164.306(e). [8] 45 C.F.R. § 164.306(b)(iv). [9] 45 C.F.R. § 164.308(a)(1)(ii)(B). [10] 45 C.F.R. § 164.306(d)(3)(ii)(B)(1); 45 C.F.R. § 164.316(b)(1). [11] 45 C.F.R. § 164.306(e). [12] 45 C.F.R. § 164.308(a)(1)(ii)(D). [13] 45 C.F.R. § 164.306(e); 45 C.F.R. § 164.308(a)(8). [14] 45 C.F.R. § 164.306(b)(2)(iv); 45 C.F.R. § 164.306(e). [15] 45 C.F.R. § 164.308(a)(2). [16] 45 C.F.R. § 164.308(a)(4)(i). [17] 45 C.F.R. § 164.308(a)(3) & (4). [18] 45 C.F.R. § 164.308(a)(5)(i). [19] 45 C.F.R. § 164..308(a)(1)(ii)(C). [20] 45 C.F.R. § 164.308(a)(8). [21] 45 C.F.R. § 164.310(a). [22] 45 C.F.R. §§ 164.310(b) & (c). [23] 45 C.F.R. § 164.310(d). [24] 45 C.F.R. § 164.312(a). [25] 45 C.F.R. § 164.312(b). [26] 45 C.F.R. § 164.312(c). [27] 45 C.F.R. § 164.312(e). [28] 45 C.F.R. § 164.306(d). [29] 45 C.F.R. § 164.314(a)(1). [30] 45 C.F.R. § 164.316. [31] 45 C.F.R. § 164.316(b)(2)(iii). [32] 45 C.F.R. § 160.203. [33] 45 C.F.R. § 160.202.

# data[].attributes.attachment_link.description
This is a summary of key elements of the Security Rule including who is covered, what information is protected, and what safeguards must be in place to ensure appropriate protection of electronic protected health information. Because it is an overview of the Security Rule, it does not address every detail of each provision.

# data[].attributes.attachment_link.readable_text
By

HIPAA (Health Insurance Portability and Accountability Act) is United States legislation that provides data privacy and security provisions for safeguarding medical information. The law has emerged into greater prominence in recent years with the many health data breaches caused by cyber attacks and ransomware attacks on health insurers and providers.

The federal law was signed by President Bill Clinton on Aug. 21, 1996. HIPAA overrides state laws regarding the safety of medical information, unless the state law is considered more stringent than HIPAA.

What is the purpose of HIPAA?

HIPAA, also known as Public Law 104-191, has two main purposes: to provide continuous health insurance coverage for workers who lose or change their job and to ultimately reduce the cost of healthcare by standardizing the electronic transmission of administrative and financial transactions. Other goals include combating abuse, fraud and waste in health insurance and healthcare delivery, and improving access to long-term care services and health insurance.

What are the 5 main components of HIPAA?

HIPAA contains five sections, or titles:

Title I: HIPAA Health Insurance Reform. Title I protects health insurance coverage for individuals who lose or change jobs. It also prohibits group health plans from denying coverage to individuals with specific diseases and preexisting conditions and from setting lifetime coverage limits.

Title II: HIPAA Administrative Simplification. Title II directs the U.S. Department of Health and Human Services (HHS) to establish national standards for processing electronic healthcare transactions. It also requires healthcare organizations to implement secure electronic access to health data and to remain in compliance with privacy regulations set by HHS.

Title III: HIPAA Tax-Related Health Provisions. Title III includes tax-related provisions and guidelines for medical care.

Title IV: Application and Enforcement of Group Health Plan Requirements. Title IV further defines health insurance reform, including provisions for individuals with preexisting conditions and those seeking continued coverage.

Title V: Revenue Offsets. Title V includes provisions on company-owned life insurance and the treatment of those who lose their U.S. citizenship for income tax purposes.

In healthcare circles, adhering to HIPAA Title II is what most people mean when they refer to HIPAA compliance. Also known as the Administrative Simplification provisions, Title II includes the following HIPAA compliance requirements:

National Provider Identifier Standard. Each healthcare entity, including individuals, employers, health plans and healthcare providers, must have a unique 10-digit National Provider Identifier number, or NPI.

Transactions and Code Sets Standard. Healthcare organizations must follow a standardized mechanism for electronic data interchange (EDI) in order to submit and process insurance claims.

HIPAA Privacy Rule. Officially known as the Standards for Privacy of Individually Identifiable Health Information, this rule establishes national standards to protect patient health information.

HIPAA Security Rule. The Security Standards for the Protection of Electronic Protected Health Information (ePHI) sets standards for patient data security.

HIPAA Enforcement Rule. This rule establishes guidelines for investigations into HIPAA compliance violations.

The HHS Office for Civil Rights (OCR), which enforces HIPAA, performs audits and can issue penalties for HIPAA noncompliance. HIPAA violations can prove quite costly for healthcare organizations.

A HIPAA compliance checklist

HIPAA Privacy Rule

The Standards for Privacy of Individually Identifiable Health Information, commonly known as the HIPAA Privacy Rule, establishes the first national standards in the United States to protect patients' personal or protected health information ( PHI).

HHS issued the rule to limit the use and disclosure of sensitive PHI. It seeks to protect the privacy of patients by requiring doctors to provide patients with an account of each entity to which the doctor discloses PHI for billing and administrative purposes, while still allowing relevant health information to flow through the proper channels.

The Privacy Rule also guarantees patients the right to receive their own PHI, upon request, from healthcare providers covered by HIPAA.

The HIPAA Privacy Rule applies to organizations that are considered HIPAA-covered entities. It also requires covered entities that work with a HIPAA business associate to produce a contract that imposes specific safeguards on the PHI that the BA uses or discloses.

What are HIPAA-covered entities?

HIPAA only applies to covered entities and their BAs.

A HIPAA-covered entity is any organization or corporation that directly handles PHI or personal health records ( PHRs). Covered entities are required to comply with HIPAA and HITECH (Health Information Technology for Economic and Clinical Health) Act mandates for the protection of PHI and PHRs.

Covered entities fall into three categories:

1. Healthcare provider. Healthcare providers include doctors, clinics, psychologists, dentists, chiropractors, nursing homes and pharmacies.

2. Health plan. Health plans include health insurance companies, health maintenance organizations (HMOs), company health plans and government healthcare programs, such as Medicare, Medicaid and military healthcare programs.

3. Healthcare clearinghouse. Healthcare clearinghouses are entities that process nonstandard health information they receive from another entity into a standard format or vice versa. Examples include billing services and community healthcare systems for managing health data.

Entities can use the HHS online tool to determine if they qualify as a HIPAA-covered entity or BA and, consequently, if they must comply with HIPAA or not.

What information is protected under HIPAA?

The HIPAA Privacy Rule protects all individually identifiable health information that is held or transmitted by a covered entity or a BA. This information can be held in any form, including digital, paper or oral.

PHI includes but is not limited to the following:

a patient's name, address, birth date, Social Security number, biometric identifiers or other personally identifiable information (PII);

an individual's past, present or future physical or mental health condition;

any care provided to an individual; and

information concerning the past, present or future payment for the care provided to the individual that identifies the patient or information for which there is a reasonable basis to believe could be used to identify the patient.

PHI does not include the following:

employment records, including information about education, as well as other records subject to or defined in the Family Educational Rights and Privacy Act (FERPA); and

deidentified data, meaning data that does not identify or provide information that could identify an individual -- there are no restrictions to its use or disclosure.

Specific examples of PHI include a medical record, laboratory report or hospital bill because these documents contain identifying information -- the patient's name, for example -- associated with health data.

One example of information that is not PHI would be blood pressure or heart rate data collected by a consumer health device, like a smartwatch, because it is not shared with a covered entity.

Administrative requirements

The Privacy Rule lays out certain administrative requirements that covered entities must have in place.

These requirements include the following:

A privacy official, such as a chief privacy officer (CPO), must be appointed who is responsible for developing and implementing policies and procedures at a covered entity.

Employees, including volunteers and trainees, must be trained on policies and procedures.

Appropriate administrative, technical and physical safeguards must be maintained to protect the privacy of PHI in a covered entity.

A process for individuals to make complaints concerning policies and procedures must be in place at a covered entity.

If PHI is disclosed in violation of its policies and procedures, a covered entity must mitigate -- to the furthest extent actionable -- any harmful effects.

HIPAA-permitted uses and disclosures

The HIPAA Privacy Rule defines when a covered entity may use or disclose an individual's PHI. There are two conditions in which use or disclosure is allowed:

1. if the Privacy Rule specifically permits or requires it -- if the covered entity is using the data themselves, or transmitting it to another covered entity, the Privacy Rule permits it; and

2. if the subject of the information gives written authorization.

These stipulations aim to facilitate the interoperability of the health information technology (IT) environment by making sure that electronic health information is made available to the right people at the right time. In certain cases -- like a national emergency (a pandemic, for example) -- parts of the Privacy Rule may be changed to permit PHI disclosure that would, in normal circumstances, be a violation.

HIPAA Privacy Rule penalties

Under the HIPAA Privacy Rule, falling victim to a healthcare data breach, as well as failing to give patients access to their PHI, could result in a fine from OCR.

Privacy rule penalties vary depending on the severity of the infraction. They are split into four categories:

1. Unknowingly violating HIPAA is $100 per violation, with an annual maximum of $25,000 for repeat violations.

2. Reasonable cause for violating HIPAA is $1,000 per violation, with an annual maximum of $100,000 for repeat violations.

3. Willful neglect of HIPAA, but the violation is corrected within a given time period, is $10,000 per violation, with an annual maximum of $250,000 for repeat violations.

4. Willful neglect of HIPAA, and the violation remains uncorrected, is $50,000 per violation, with an annual maximum of $1.5 million for repeat violations.

Covered entities and individuals who intentionally obtain or disclose PHI in violation of the HIPAA Privacy Rule can be fined up to $50,000 and receive up to one year in prison. If the HIPAA Privacy Rule is violated under false pretenses, the penalties can be increased to a $100,000 fine and up to 10 years in prison.

Organizations can lower their risk of regulatory action through HIPAA compliance training programs. OCR offers guidance through educational programs on complying with privacy and security rules. A number of consultancies and training groups offer programs as well. Healthcare providers may also choose to create their own training programs, which often encompass each organization's current HIPAA privacy and security policies, the HITECH Act, mobile device management ( MDM) processes and other applicable guidelines.

While there is no official HIPAA compliance certification program, training companies offer certification credentials to indicate an understanding of the guidelines and regulations specified by the act.

HIPAA Security Rule

The Security Standards for the Protection of Electronic Protected Health Information, commonly known as the HIPAA Security Rule, establishes national standards for securing patient data that is stored or transferred electronically. It draws from the National Institute of Standards and Technology's ( NIST) Cybersecurity Framework.

OCR enforces the HIPAA Security Rule, which aims to balance patient security with the advancement of health technology.

The rule requires the placement of safeguards, both physical and electronic, to ensure the secure passage, maintenance and reception of PHI. When addressing the risks and vulnerabilities associated with PHI and ePHI, healthcare organizations should ask three key risk analysis questions:

1. Can the sources of ePHI and PHI within the organization -- including all PHI created, received, maintained or transmitted -- be identified?

2. What are the external sources of PHI?

3. What are the human, natural and environmental threats to information systems that contain ePHI and PHI?

Using the answers to these questions, organizations can decide what measures they need to take to maintain or develop a HIPAA-compliant security management process, for example:

design a personnel screening process;

identify which data to back up;

determine how and where to back up data;

determine how and where encryption should be used;

determine what data should be authenticated for data integrity; and

implement access control for physical workstations and electronic media, as well as data.

Under HHS' meaningful use program for certified health IT, healthcare organizations receiving federal incentive payments must attest to following privacy and security procedures based on HIPAA.

HIPAA Omnibus Rule

The HIPAA Omnibus Rule modifies the HIPAA Privacy, Security and Enforcement Rules to implement statutory amendments under the HITECH Act.

The HIPAA Omnibus Rule marked the most extensive changes to the HIPAA Privacy and Security Rules since they were first implemented. Changes include the following:

strengthening the privacy and security protection for individuals' PHI;

modifying the Breach Notification Rule for unsecured PHI and putting in place more objective standards for assessing a healthcare provider's liability following a data breach;

modifying the HIPAA Privacy Rule to strengthen the privacy protections for genetic information;

outlining OCR's data privacy and security enforcement strategies, as updated for the electronic health record (EHR) era and as mandated by the HITECH Act;

extending the Breach Notification Rule to vendors of EHRs and EHR-related systems;

holding HIPAA BAs to the same standards for protecting PHI as covered entities, including subcontractors of BAs, in the compliance sense;

stipulating that, when patients pay by cash, they can instruct their provider not to share information about their treatment with their health plan;

setting new limits on how information is used and disclosed for marketing and fundraising purposes;

prohibiting the sale of an individual's health information without their permission;

making it easier for parents and others to give permission to share proof of a child's immunization with a school;

streamlining an individual's ability to authorize the use of their health information for research purposes;

increasing penalties for noncompliance based on the level of negligence, with a maximum penalty of $1.5 million per violation; and

guaranteeing that organizations can operate with certainty that their privacy and security policies comply with all the applicable regulations

What are HIPAA business associates and their contract requirements?

HIPAA defines a BA as any organization or person working in association with or providing services to a covered entity who handles or discloses PHI or PHRs.

Under the HITECH Act, any HIPAA BA that serves a healthcare provider or institution is subject to audits by OCR within HHS and can be held accountable for a data breach and penalized for noncompliance.

According to the HHS, some examples of BAs include the following:

when a health plan uses a third-party administrator to help with claims processing;

if a certified public accountant (CPA) firm provides accounting services to a healthcare provider and has access to protected health information;

when a hospital has a consultant perform utilization reviews;

when a healthcare clearinghouse translates a claim from a nonstandard format to a standard format for a healthcare provider and then sends the process transaction to a payer;

when a physician uses an independent medical transcriptionist's services;

when a pharmacy benefits manager manages a health plan's pharmacist network; and

when a covered entity uses a cloud storage service to store PHI.

Mobile application developers could also be considered HIPAA BAs because many healthcare mobile applications handle PHI.

HHS gave a scenario where an app developer would be considered a HIPAA BA: A patient is told by their provider to download a health app to their smartphone. The app developer and the provider have a contract for patient management services that includes remote patient health counseling, patient messaging, food and exercise monitoring, and EHR integration and application program interfaces (APIs). Furthermore, the information the patient inputs into the application is automatically incorporated in the EHR.

A HIPAA BA agreement (BAA) is a contract between a HIPAA-covered entity and a HIPAA BA. The contract protects PHI in accordance with HIPAA guidelines.

According to HHS, HIPAA BA contracts or other written arrangements should do the following:

describe how the BA is permitted and required to use PHI;

require that the BA not use or disclose PHI, other than as specified in the contract or as required by law;

require the BA to use appropriate safeguards to ensure the PHI is used as detailed in the contract;

demonstrate how a BA would report and respond to a data breach, including data breaches that are caused by a BA's subcontractors;

demonstrate how the BA would respond to an OCR investigation; and

require the covered entity to take reasonable steps to cure any breach by the HIPAA BA if and when they know of one -- if this is unsuccessful, the covered entity is required to terminate the contract with the BA; if termination is unsuccessful as well, the covered entity should report the incident to the OCR.

Continue Reading About HIPAA (Health Insurance Portability and Accountability Act)

# data[].attributes.attachment_link.title
What is HIPAA (Health Insurance Portability and Accountability Act)?

# data[].attributes.attachment_link.description
By HIPAA (Health Insurance Portability and Accountability Act) is United States legislation that provides data privacy and security provisions for safeguarding medical information. The law has emerged into greater prominence in recent years with the many health data breaches caused by cyber attacks and ransomware attacks on health insurers and providers.

# data[].attributes.attachment_link.readable_text
The Family Educational Rights and Privacy Act (FERPA) (20 U.S.C. § 1232g; 34 CFR Part 99) is a Federal law that protects the privacy of student education records. The law applies to all schools that receive funds under an applicable program of the U.S. Department of Education.

FERPA gives parents certain rights with respect to their children's education records. These rights transfer to the student when he or she reaches the age of 18 or attends a school beyond the high school level. Students to whom the rights have transferred are "eligible students."

Parents or eligible students have the right to inspect and review the student's education records maintained by the school. Schools are not required to provide copies of records unless, for reasons such as great distance, it is impossible for parents or eligible students to review the records. Schools may charge a fee for copies.

Parents or eligible students have the right to request that a school correct records which they believe to be inaccurate or misleading. If the school decides not to amend the record, the parent or eligible student then has the right to a formal hearing. After the hearing, if the school still decides not to amend the record, the parent or eligible student has the right to place a statement with the record setting forth his or her view about the contested information.

Generally, schools must have written permission from the parent or eligible student in order to release any information from a student's education record. However, FERPA allows schools to disclose those records, without consent, to the following parties or under the following conditions (34 CFR § 99.31):

School officials with legitimate educational interest;

Other schools to which a student is transferring;

Specified officials for audit or evaluation purposes;

Appropriate parties in connection with financial aid to a student;

Organizations conducting certain studies for or on behalf of the school;

Accrediting organizations;

To comply with a judicial order or lawfully issued subpoena;

Appropriate officials in cases of health and safety emergencies; and

State and local authorities, within a juvenile justice system, pursuant to specific State law.

Schools may disclose, without consent, "directory" information such as a student's name, address, telephone number, date and place of birth, honors and awards, and dates of attendance. However, schools must tell parents and eligible students about directory information and allow parents and eligible students a reasonable amount of time to request that the school not disclose directory information about them. Schools must notify parents and eligible students annually of their rights under FERPA. The actual means of notification (special letter, inclusion in a PTA bulletin, student handbook, or newspaper article) is left to the discretion of each school.

# data[].attributes.attachment_link.keywords[]
policy; privacy; academic records; technical assistance; parent rights; student rights; ferpa

# data[].attributes.attachment_link.title
Family Educational Rights and Privacy Act (FERPA)

# data[].attributes.attachment_link.description
Family Educational Rights and Privacy Act (FERPA) Home Page.

# data[].attributes.attachment_link.title
United States Corporate Governance - Getting The Deal Through - GTDT

# data[].attributes.attachment_link.description
The essential workflow tool for legal professionals with an international outlook. GTDT provides first-step legal analysis of the legal frameworks in 102 practice areas and over 150 jurisdictions.

# data[].attributes.attachment_link.title
NACD - National Association of Corporate Directors

# data[].attributes.attachment_link.description
The National Association of Corporate Directors (NACD), a nonprofit membership organization for corporate board members, provides corporate governance resources, education, information, and research on leading board practices.

# data[].attributes.attachment_link.title
National Security Agency | Central Security Service

# data[].attributes.attachment_link.description
The National Security Agency/Central Security Service leads the U.S. Government in cryptology that encompasses both signals intelligence insights and cybersecurity products and services that enables computer network operations to gain a decisive advantage for the nation and our allies.

# data[].attributes.attachment_link.description
Single adults and family units were removed to Venezuela, Ecuador, India, Peru, and Central America

# data[].attributes.body
ITIL Foundation Certification

# data[].attributes.attachment_link.description
The ITIL best practices provide a framework for businesses to more effectively manage their IT services. Find out more about ITIL with Axelos.

# data[].attributes.body
ECBA Code of Conduct

# data[].attributes.attachment_link.keywords[]
international institute of business analysis

# data[].attributes.attachment_link.title
Certification Levels - IIBA | International Institute of Business Analysis

# data[].attributes.attachment_link.description
International Institute of Business Analysis (IIBA), the association for business analysts, offers the BABOK Guide, CBAP and CCBA certifications

# data[].attributes.body
Lecture Notes

# data[].attributes.body
Public Company Accounting Reform and Investor Protection Act

Sarbanes-Oxley Act

# data[].attributes.attachment_link.readable_text
Official websites use .gov

A .gov website belongs to an official government organization in the United States.

Secure .gov websites use HTTPS

A lock ( ) or https:// means you've safely connected to the .gov website. Share sensitive information only on official, secure websites. .

FEMA's veterans have continued serving their country after leaving military service. We proudly recognize and celebrate all veterans this Veterans Day, especially those within our workforce.

Individual Assistance

Grants to disaster survivors (in millions) so far in 2023.

2023 Mitigation Grants

Number of hazard mitigation assistance sub-grants so far in 2023.

2023 Disaster Declarations

# data[].attributes.attachment_link.description
Official websites use .gov A .gov website belongs to an official government organization in the United States. Secure .gov websites use HTTPS A lock ( ) or https:// means you've safely connected to the .gov website. Share sensitive information only on official, secure websites. .

# data[].attributes.body
OSHA Law and Regulations

Injury and Illness Record keeping and Reporting Requirements

Enforcement

# data[].attributes.attachment_link.title
OSHA Worker Rights and Protections | Occupational Safety and Health Administration

# data[].attributes.body
Employee Rights:

Disability Resources

Employer Responsibilities

Social Security

# data[].attributes.attachment_link.description
An official website of the United States government.

# data[].attributes.attachment_link.description
The FDA is responsible for protecting the public health by ensuring the safety, efficacy, and security of human and veterinary drugs, biological products, and medical devices; and by ensuring the safety of our nation's food supply, cosmetics, and products that products that emit radiation.

# data[].attributes.attachment_link.provider_name
Centers for Disease Control and Prevention

# data[].attributes.attachment_link.description
CDC is the nation's leading science-based, data-driven, service organization that protects the public's health. For more than 70 years, we've put science into action to help children stay healthy so they can grow and learn; to help families, businesses, and communities fight disease and stay strong; and to protect the public's health.

# data[].attributes.attachment_link.title
European Commission reorganises its Information Society and Media DG

# data[].attributes.attachment_link.description
From 01 February, the Information Society and Media Directorate General of the Commission has two new Directorates and three new Units. This reorganisation completes the changes following President Barroso's decision to bring together under the responsibility of Commissioner Viviane Reding, all three aspects of modern day electronic communications -in the fields of broadcasting, computer networks and of electronic communication services.

# data[].attributes.attachment_link.readable_text
New York, United States / Geneva, Switzerland - 20 September 2023 The International Organization for Standardization (ISO) and the United Nations Development Programme (UNDP) have signed a landmark Statement of Intent, signaling their commitment to the role of International Standards in addressing global ...

# data[].attributes.attachment_link.title
ISO - International Organization for Standardization

# data[].attributes.attachment_link.description
We're ISO, the International Organization for Standardization. We develop and publish International Standards.

# data[].attributes.attachment_link.readable_text
The 5G-IA highlights its key role and new team to ensure European leadership in 5G global development and harmonization
BRUSSELS May 17 th, 2017 - The 5G-Public Private Partnership (5G-PPP) has made a dramatic impact to European leadership in supporting European industrial 5G research and technology strategies leading notably to the launch and execution of 19 first-phase research projects. As the first phase of 5G-PPP projects draw to a close and the second phase of projects starts, the time is right to renew the governance and leadership of the 5G-PPP. In the new structure, the 5G Industry Association is the organisation representing and responsible for the private side of the 5G-PPP.

In this context, the 5G-IA has issued new statutes and renewed its Board, leading to a clarified and simpler governance. The 5G-IA formally interacts with the European Commission through a partnership Board, and closely coordinates its Policy Work Groups with the 5G Initiative Projects and Technical Work Groups. As for the Networld 2020 Experts and Task Groups, they no longer formally belong to the 5G PPP organization, however it is planned to continue actively collaborating in relevant areas.

The new leadership of the 5G-IA is as follows:

Dr. Colin Willcock, Head of Radio Network Standardization at Nokia, is the new Chairman of the Board of the 5G-IA.

Christine Leurquin, VP Institutional Relations and Communications at SES, is the Vice-Chair of the Board of the 5G-IA, after being Acting Chair in the first months of this year.

Jean-Pierre Bienaimé is Secretary General, in charge of the overall visibility and management of the 5G-IA.

Alessandro Bedeschi is Head of Office, ensuring the operational well-functioning of the 5G-IA.

The 11 companies represented in the new Board - Orange, Telecom Italia, Telenor, SES, Nokia, Ericsson, Huawei, Thales, Nextworks, Interinnov and CTTC (Centre Tecnologic de Telecomunicacions de Catalunya) - are key stakeholders from the ecosystem and membership of 5G-IA: industry, research & academics, verticals and SMEs. The nearly 70 current members of the 5G Infrastructure Association represent various industry manufacturers, telecommunications operators, service providers, vertical industries, research institutes and universities, SMEs, providers of satellite and terrestrial infrastructure, with the aim of having a constructive dialogue and jointly interfacing with the Commission in shaping the future of 5G and developing the regulatory framework to make 5G a European success. This provides a globally unique platform for ensuring European leadership on 5G and investments needed to roll out essential 5G infrastructure.

Therefore, the 5G-IA highlights its objectives and action plan:

ensuring a clear European voice on 5G around the world

reaching out to vertical industry sectors ("verticals") and ensuring the EU's support/enforcement of the required policies and regulations to embrace 5G in the various vertical sectors in Europe

Steering the 5G PPP programme implementation through cross project cooperation in Europe, and targeting in a consistent way the exploitation of the 5G PPP results: phase 1 (research), phase 2 (optimization) beginning on 1st June 2017, and phase 3 (large scale trials)

promoting the availability of radio spectrum, as well as a holistic standardization roadmap with the aim of reaching a globally harmonized and interoperable 5G communications standard

defining its "5G trials roadmap strategy" for the implementation of advanced pre-commercial and pan-European trials to be launched in key sectors, promoted through European public events, with the aim of ensuring European leadership in the context of the accelerated global agenda for the introduction of 5G.

Press Contact: Alessandro Bedeschi Mail to: alessandro.bedeschi@5g-ppp.eu
About the 5G Public-Private Partnership & the 5G Infrastructure Association
The 5G Public Private Partnership (5G PPP) is the 5G collaborative research program that is organized as part of the European Commission's Horizon 2020 program - The European Union Program for Research and Innovation. It is aimed at fostering industry-driven research, monitored by business-related, technological performance and societal KPIs. The 5G PPP will deliver solutions, architectures, technologies and standards for ubiquitous next-generation communication infrastructure over the coming decade.
In the 5G PPP, the 5G Infrastructure Association (5G-IA) represents the private side and the European Commission the public side. The 5G-IA is committed to the advancement of 5G in Europe and to building global consensus on 5G. To this aim, the Association brings together a global industry community of telecoms & digital actors, such as operators, manufacturers, research institutes, universities, verticals and SMEs. The 5G-IA carries out a wide range of activities in strategic areas including standardization, frequency spectrum, R&D projects, technology skills, collaboration with key vertical industry sectors, notably for the development of trials, and international cooperation.
Membership applications are open, and more information is available at http://5g-ppp.eu/.

# data[].attributes.attachment_link.title
5G Infrastructure Association (5G-IA): a step forward with new governance

# data[].attributes.attachment_link.description
The 5G-IA highlights its key role and new team to ensure European leadership in 5G global development and harmonization BRUSSELS May 17th, 2017 - The 5G-Public Private Partnership (5G-PPP) has made a dramatic impact to European leadership in supporting European industrial 5G research and technology strategies leading notably to the launch and execution of 19 first-phase research projects.

# data[].attributes.attachment_link.description
UL Standards encompass UL's extensive safety research and scientific expertise. With over a century of experience in the development of more than 1,50

# data[].attributes.attachment_link.title
COBIT - IT Governance Framework - Information Assurance Control | ISACA

# data[].attributes.attachment_link.description
COBIT is an IT governance framework and toolset that allows managers to bridge the gap between control requirements, technical issues and business risks.

# data[].attributes.attachment_link.readable_text
Explore COVID-19 and Health Equity Resources

#WeStandWithDocs

Jesse Ehrenfeld, MD, MPH

We salute the health professionals committed to applying their knowledge and skills when needed, though doing so may put them at risk.

AMA Insurance

AMA member physicians get a 35% discount on own-specialty disability insurance premiums.

Calculate Your Quote Now

# data[].attributes.attachment_link.description
The American Medical Association, founded in 1847 and incorporated in 1897, is the largest association of physicians-both MDs and DOs-and medical students in the United States. The AMA's mission is "to promote the art and science of medicine and the betterment of public health."

# data[].attributes.body
Family Educational Rights and Privacy Act

IDEA: Individuals with Disabilities Education Act

# data[].attributes.attachment_link.description
Find federal education legislation, regulations, guidance, and other policy documents.

# data[].attributes.attachment_link.title
Home | Occupational Safety and Health Administration

# data[].attributes.attachment_link.description
Department of Labor seeks nominations for vacant position on Federal Advisory Council on Occupational Safety and Health

# data[].attributes.attachment_link.title
IEEE - The world's largest technical professional organization dedicated to advancing technology for the benefit of humanity.

# data[].attributes.attachment_link.description
IEEE is the world's largest technical professional organization dedicated to advancing technology for the benefit of humanity.

# data[].attributes.attachment_link.description
The IGF is a global multistakeholder platform that facilitates the discussion of public policy issues pertaining to the Internet