HIPAA and HITECH

Last week, I discussed possible “reasonable” Health Care reform if the Affordable Care Act (Obamacare) was overturned by the Supreme Court. I recommended developing decentralized medical databases that first responders could access in order to provide you better quality care by reducing errors based upon your own medical history. In doing more research, I came across two acronyms that are associated with this idea: HIPAA and HITECH.

Title II of the Health Insurance Portability and Accountability Act of 1996 (also known as HIPAA) placed a set of rules on how to handle electronic medical information for individuals. These rules, know as the “Administrative Simplification” requirements are: the privacy rule, the transaction and code set rule, the security rule, the unique identifiers rule, and the enforcement rule. In short, the rules (primarily the privacy and security rules) were to ensure that your information could be shared between medical providers in a secure manner, using coding that – if there was a security breach – the data would not be easily linked to the patient(s) involved without access to additional information.

HIPAA was updated in 2009 when the American Recovery and Reinvestment Act (the “Stimulus Package”) was passed. Within it was the Health Information Technology for Economic and Clinical Health Act (HITECH), the privacy and security rules from HIPAA were expanded to cover more entities involved with handling electronic medical records as well as lay out the rules covering breaches of protected medical information. When a breach occurs, the individual and the entities associated are to be notified, and in cases where 500 or more patients are impacted, the media is also to be notified.

With security measures already in place, I feel that a decentralized medical database accessible to first responders would would something practical that can be rolled out sooner rather than later without the need of an over-arching reform bill such as the Affordable Care Act. With proper security features, HIPAA compliance training, and broad acceptance, I see this as being a safe practice that can result in better care up front, meaning less costs and risks of medical mistakes in the future.