Just a few short years ago, employers and their vendors and advisors struggled to understand and implement the privacy rules mandated by the Health Insurance Portability and Accountability Act (HIPAA). The privacy rules took effect April 2003 for "large" group health plans--defined as plans with premiums (in the case of insured plans) or claims (in the case of self-funded plans) of $5,000,000 or more. The privacy rule effective date was April 2004 for all other group health plans. But privacy is only one part of a larger suite of "administrative simplification" rules. Administrative simplification refers, of course, to the streamlining of the U.S. health care system with a focus in the adoption of uniform standards for the electronic storage and transmission of medical records.
Set out in this Advisory, in question and answer format, is a primer for employers concerning their compliance with the HIPAA security rule. Click here to view the entire publication.