HIPAA Compliance and Application Security

Health Insurance Portability and Accountability Act of 1996
[HIPAA; Public Law 104–191, 110 Stat. 1936, enacted August 21, 1996]

Reference: www.govinfo.gov
Wikipedia: www.wikipedia.org

Security Rule

The Security Rule requires covered entities to maintain reasonable and appropriate administrative, technical, and physical safeguards for protecting e-PHI.

Specifically, covered entities must:

• Ensure the confidentiality, integrity, and availability of all e-PHI they create, receive, maintain or transmit;
• Identify and protect against reasonably anticipated threats to the security or integrity of the information;
• Protect against reasonably anticipated, impermissible uses or disclosures;

Privacy Rule

The Privacy Rule standards address the use and disclosure of individuals’ health information - called “protected health information” by organizations subject to the Privacy Rule - called “covered entities,” as well as standards for individuals' privacy rights to understand and control how their health information is used.

A covered entity must maintain reasonable and appropriate administrative, technical, and physical safeguards to prevent intentional or unintentional use or disclosure of protected health information in violation of the Privacy Rule and to limit its incidental use and disclosure pursuant to otherwise permitted or required use or disclosure.