Medical Records and the Law

Summary of Confidentiality Requirements 117on December 28, 2000; became effective on April 14, 2001; andwere modified on August 14, 2002. 48• National health plan identifiers. No rules have yet been promulgated(in proposed form or otherwise) for this component of the AdministrativeSimplification provisions.• Enforcement. Interim final regulations establishing Privacy Ruleenforcement procedures were issued on April 17, 2003. 49 DHHScharacterized these regulations as the “first installment” of the enforcementrule. More comprehensive enforcement regulations wereproposed on April 18, 2005. 50 These regulations are known as theEnforcement Rule.• Claims attachments. No rules have yet been promulgated (in proposedform or otherwise) for this component of the AdministrativeSimplification provisions.• National individual identifiers. No rules have yet been promulgated(in proposed form or otherwise) for this component of the AdministrativeSimplification provisions.The privacy, security and transactions, and code set regulations issuedunder HIPAA by DHHS are known as the Privacy Rule, 51 theSecurity Rule, 52 and the TCS Rule, respectively. 53 The Privacy Rulegoverns the use and disclosure of PHI, and addresses how healthcareproviders, clearinghouses, and health plans handle health informationin the conduct of their affairs. The Security Rule establishes standardsfor the protection of the physical security of electronic PHI (ePHI),and, together with the Privacy Rule, provides for the comprehensiveprotection of PHI. The TCS Rule establishes federal standards for thecomputer codes that may be used in routine business transactions concerningthe billing and payment for healthcare services. HIPAA is anextensive statute that also governs a variety of other activities that arenot within the scope of this text.The Privacy and Security Rules apply to PHI used or disclosed by“covered entities.” The rules define covered entities as healthcare4865 Fed. Reg. 82462 (Dec. 28, 2000); 67 Fed. Reg. 53182 (Aug. 14, 2002).4968 Fed. Reg. 18895 (Apr. 17, 2003).5070 Fed. Reg. 20224 (Apr. 18, 2005).5145 C.F.R. §§ 160 and 164.5245 C.F.R. §§ 164.302 through 164.318.5345 C.F.R. §§ 162.100 through 162.1802.