2013 Practitioner and Provider Manual - Presbyterian Healthcare ...

Health Insurance Portability and Accountability ActWhich Providers Must Be HIPAA Compliant?All providers who handle members’ protectedhealth information (PHI) for treatment purposes arelegally obliged to observe HIPAA regulations.Those providers who perform a service on behalf ofPresbyterian for non-treatment purposes are alsolegally obliged to observe HIPAA regulations. Sucha service might include any function or activityspecified in the definition of business associate in45 CFR §160.103. These activities performedinclude:Claims processing or administrationData analysis, processing, or administrationUtilization reviewQuality assurancePatient safety activitiesBilling, benefit management, practice management,and/or repricingAdditional services such as legal, actuarial,accounting, consulting, data aggregation,management administration, accreditation, orfinancial where the provision of services involvesthe disclosure of PHIKey HIPAA DefinitionsThe three definitions in this section are derivedfrom 45 CFR 160.103. HIPAA definitions can alsobe found in 45 CFR 160.202, 160.401, 160.502,164.103, 164.304, 164.402, and 164.501. (Seehttp://www.ecfr.gov/cgi-bin/textidx?c=ecfr&tpl=/ecfrbrowse/Title45/45cfr164_main_02.tpl.)Covered entity meansA health planA health care clearinghouseA health care provider who transmits any healthinformation in electronic form in connection with atransaction covered by 45 CFR 160Protected Health Information (PHI) meansindividually identifiable health information that iscreated or received by a health care provider,health plan, or health care clearinghouse relating tothe past, present, or future physical or mentalhealth or condition of an individual or payment forhealth care and is transmitted by electronic media,maintained in electronic media, or transmitted ormaintained in any other form or medium, excludingeducation records or employment records held by acovered entity in its role as employer.Business associate means a person who is not amember of the workforce that creates, receives,maintains, or transmits PHI for a function or activityinvolving the use or disclosure of PHI on behalf of acovered entity. See Appendix E in this manual for acopy of the Business Associate Agreement.HIPAAHIPAA contains several key components:Title I protects a workers’ health insurancecoverage when they lose or change jobsTitle II, which is also known as the AdministrativeSimplification Regulation, mandates that the DHHScreate national regulations to address several keyconcerns relating to the privacy and security ofpatient health information including13-22014 Practitioner and Provider Manual - Ver. 3