Compliance basics
What HIPAA requires of your practice, in plain English
HIPAA asks three things of a practice: that it protect health information, that it use and disclose it only as the rules allow, and that it tell people when something has gone wrong. Each is a rule of its own, and each has a plain reading.
HIPAA is three rules
The Security Rule
How your practice protects electronic health information: the safeguards it must have in place, administrative, physical and technical, and the person responsible for them.
The Privacy Rule
When your practice may use or disclose health information, what it must tell patients, and the rights patients have over their own records.
The Breach Notification Rule
What your practice must do when protected information is exposed: whom to notify, by when, and what the notice must say.
The Security Rule
The Security Rule is the one most practices find hardest to read, because it is written as standards and implementation specifications rather than as instructions. Med Practice Core shows each standard with its specifications beneath it, the regulation's own text beside a plain reading, and a place to record what your practice decided and did about it.
What HIPAA asks: assigned security responsibility
Identify the security official who is responsible for the development and implementation of the policies and procedures required by this subpart for the covered entity or business associate.
45 CFR 164.308(a)(2)
It is a required standard with no implementation specifications of its own, so it is satisfied directly.
What it asks. Name one person who is responsible for your practice's security program: the policies and procedures the Security Rule requires, and seeing that they are carried out. The rule calls this person the security official; most practices say Security Officer.
Why it comes first. Everything else in the Security Rule is something your practice must decide, write down and do. Until one person owns that work, it belongs to everyone and gets done by no one.
What counts as done. A written designation naming the person by name and role, dated, and kept where you can produce it. One person, not a committee: others may help, but the responsibility must rest with someone. The person does not need to be technical; in a small practice it is often the practice manager or a physician-owner. The designation is reviewed when the person or their role changes.
What does not count. Assuming the IT vendor holds the role. Naming a committee. A verbal understanding.
Every standard and implementation specification of the Security Rule reads like this on Med Practice Core, and the Privacy Rule and Breach Notification Rule follow.
The Privacy Rule
The Privacy Rule governs the information itself: the uses and disclosures your practice may make without asking, the ones that need a patient's authorisation, the notice of privacy practices, and the patient's rights of access and amendment. Most of its obligations are policies your practice writes once and follows.
The Breach Notification Rule
The Breach Notification Rule applies after something has gone wrong. It sets who must be told, how soon, and in what form, and it expects your practice to have decided in advance how it will assess an incident. The record you keep under the other two rules is what makes that assessment possible.