Home Services Procedures News Contact us    
 
 

Regulation 1: Patient Privacy
What is it?
Who must comply?

Regulation 2: Electronic Data Interchange
What is it?
Who must comply?

Regulation 3: Security
What is it?
Who must comply?

HIPAA News

 

 

 

 

At Dentcon, your compliance with HIPAA regulations is one of our top priorities. We make sure that your technology is up-to-date and your patients’ information is well-protected. If you are a health care provider, you maintain, process, or have access to Patient Healthcare Information, you are considered a ‘covered entity’ and you must comply with some or all of the following:

 

Regulation 1: Patient Privacy
Status: Finalized
Compliance Date: April 14, 2003
[top]

What is it?

[top]

The Privacy rule requires covered entities to implement formal policies, procedures and best practices regarding who has the right to access patient identifiable health information. The rule covers all individually identifiable health information in the past, present and future, regardless of the form – including oral, written and electronic. The Privacy portion of HIPAA includes numerous requirements which protect the patients’ rights, including:

  • limit the use and release of private health information without prior consent
  • give patients new rights to access their medical records and to know who else has accessed them
  • restrict most disclosure of health information to the minimum needed for the intended purpose

Who must comply?

[top]

The Privacy regulations have been finalized and are due by all covered entities April 14, 2003 with the following except for Small Health Plans (A Group or individual Health plan with less than 50 participants) have until April 14, 2004.

 

Regulation 2: Electronic Data Interchange
Status: Finalized
Compliance Date: October 15, 2003

[top]

What is it?

[top]

Many healthcare providers and health plans already use Electronic Data Interchange (EDI) when exchanging data with their business partners. The DHHS estimates there are over 400 formats currently being used, making standardization almost impossible. In order to perform EDI efficiently, HIPAA requires a common format and data structure be used when exchanging specific transaction types, code sets and Identifiers electronically.

Who must comply?

[top]

  • If you currently transmit identifiable patient information electronically you must comply with the HIPAA regulations.
  • If you are not EDI compliant, you should have filed for an extension Oct. 15, 2002.
  • If you filed for the extension, you must be in compliance with EDI by Oct. 16, 2003.
  • If you did not file, you are expected to be compliant with EDI today and could be subject to fines.

Health plans are required to have the capability to send and receive all HIPAA transactions now or by Oct. 16, 2003 if you filed for an extension.
Medicare will not accept paper claims after Oct. 16, 2003. However, if you have less than 10 employees, you are allowed an exception.
Other payers will follow suit and require electronic transmission in the near future.

 

Regulation 3: Security
Status: Finalized
Compliance Date: April 20, 2005

[top]

What is it?

[top]

The Security rule requires covered entities that maintain or transmit Patient Identifiable Data to develop and implement formal policies, procedures and best practices that will safeguard the integrity, confidentiality, and availability of its electronic data. The Security Standards include numerous requirements under the following four categories:

  • Administrative procedures to guard data integrity, confidentiality, and availability. Documented, formal practices that will protect data and manage the conduct of personnel with regards to patient data. This includes items such as Business Agreements, Chain of Trust Agreements and Contingency Plans.
  • Physical safeguards to guard data integrity, confidentiality, and availability. Protection of physical computer systems and related buildings and equipment from fire, environmental hazards or intrusion. This covers the use of locks, keys, and administrative measures used to control access to computer systems and facilities.
  • Technical security services to guard data integrity, confidentiality, and availability patient data. This requirement includes access control, audit controls and system requirements that must be put in place to protect information and to control individual access to information.
  • Technical security mechanisms - processes that are put in place to guard against unauthorized access to data that is transmitted over a communications network. This covers items such as alarms, audit trails and access controls over the network.

Who must comply?

[top]


The Data Security standards, requirements, and implementation specifications apply to the following entities:

  1. A health plan.
  2. A health care clearinghouse.
  3. A health care provider who transmits any health information in electronic form in connection with a HIPAA transaction

When a health care clearinghouse creates or receives protected health information as a business associate of another covered entity, or other than as a business associate of a covered entity, the clearinghouse must comply with the organizational requirements for covered entities, including the designation of health care components of a covered entity.

 

HIPAA News from the American Dental Association (ADA)

[top]
 
 
Home · Services · Procedures · News · Contact Us
Dentcon Systems, Inc. © 2005 · Terms of Use