What is HIPAA?

This federal act was originally passed in 1996 as Public Law 104-191 and has also been called the Kennedy-Kassebaum Act. One part of this law addressed how health coverage was to be continued when a person changed employers. This was the ‘portability’ portion of the act.

The ‘accountability’ portion of the act applies to health information created or maintained by health care providers who engage in certain electronic transactions, health plans, and health care clearinghouses. These provisions address maintaining the privacy of medical information. Some of these provisions are effective on April 14, 2003. Other provisions that deal with security of medical records in computer systems will be effective in April 2005.

The Office of Civil Rights of the Department of Health & Human Services is charged with enforcing HIPAA provisions. More details on HIPAA and the specific provision rules may be found at www.hhs.gov/ocr/hipaa.

What has Hillsborough County done to comply with HIPAA?

A task force was formed in January 2002 comprised of representatives from departments reporting to the Board of County Commissioners through the County Administrator. The departments were those that provided services that might fall under HIPAA. The County obtained the services of a consultant with expertise in HIPAA. As a result of a detailed study of the services provided by the departments coupled with the consultant’s expertise, we determined that four departments deal with health information that falls under HIPAA.

The four departments that were determined to be ‘covered entities’ under HIPAA are Health & Social Services, Aging Services, Fire/Rescue, and Human Resources. Policies and procedures on how to handle the medical information in accordance with HIPAA requirements within each of these departments have been developed and training in them is underway. This is not the only training that HIPAA requires. HIPAA requires that every person in every department under the BOCC receive ‘HIPAA Awareness Training’. This is also underway.

HIPAA requires certain administrative actions. One of these is the issuance of a Notice of Privacy Practices. This notice is being sent to every person currently receiving HIPAA covered services. New clients will receive it when they first get services. This notice describes how Hillsborough County uses medical information to provide services, your rights regarding your medical information, and how to exercise those rights.