The Health Insurance Portability and Accountability Act of 1996 (HIPAA) is a law that seeks to accomplish many admirable goals. The public may be most familiar with the portion of the law that relates to the portability of health insurance because it has been in effect since 1996. That portion of the law made it possible for individuals to retain some form of health insurance when transferring from one employer to another. Individuals may be less familiar with the portion of the law that relates to Administrative Simplification.

Recently the U.S. Department of Health and Human Services has released several sets of regulations authorized by HIPAA under the heading of Administrative Simplification. The most frequently discussed of these regulations relate to standardized code sets, patient privacy, security of health information, and national provider identifiers.

While the original compliance deadline for the electronic code sets regulations was October 2002, the University applied for an extension, so that the compliance deadline is now October 2003. This means that any department that is covered by HIPAA and that bills insurance companies for health care services, must do so using the new, standardized code sets.

The HIPAA Privacy Regulations become effective on April 14, 2003. These regulations place limitations upon covered entities' use of "protected health information" (PHI). Protected health information is information that is individually identifiable and that relates to an individual's past, present, or future medical condition or treatment. The Privacy Regulations also create or formalize several rights patients or enrollees in a health plan have regarding their health information. Patients now have a right to request access to or a copy of their health information, to request an amendment to their health information if they believe their health information is inaccurate, or to request an accounting of the covered entity's uses and disclosures of their health information. Finally, the regulations establish an individual, called a Privacy Officer or Privacy Official, to whom patients or enrollees may address their questions, complaints, or requests.

The HIPAA Security Regulations were finalized in February 2003 and went into effect in April 2004. These regulations require covered entities, including affected portions of the University campus, to take steps to protect the security of electronic protected health information ("ePHI"). Therefore, this set of regulations only applies to PHI that appears in electronic form.

If you have further questions or concerns about the HIPAA Privacy Regulations, please contact the university's Privacy Official, Diane Fashinpaur by phone at 330-972-6577 or by email at djf1@uakron.edu.

If you have general questions about HIPAA, please contact the Office of General Counsel at 330-972-7830.


Back to overview.