HIPAA Regulation

The mandates of the HIPAA privacy regulation apply to everyone in the health care industry including physicians, physician groups, health plans, hospitals, pharmacies, clearinghouses, nursing homes and billing companies that transmit any health information in electronic form or have others transmit such data for them. Therefore, if a physician practice has a billing company or clearinghouse transmit electronic data for them, then the practice is covered.

The type of record covered by the HIPAA regulation includes both medical and billing records maintained by a physician practice, as well as a patient’s demographic information. It covers records “used, in whole or in part, by or for the physician practice to make decisions about individuals.” Which records may apply, will differ from office to office. But in general, most of the medical or billing record maintained by a physician practice - whether paper or electronic - is covered by the regulation. This includes information or data created by or received from another health care provider.

Some directives of the privacy regulation do not apply to physicians with an “indirect treatment relationship.” Such a relationship exists when a physician provides health care services based on the orders of another health care provider and the services or reports are characteristically provided directly to another health care provider, who then provides the services or reports to the patient. Services provided by pathologists and radiologists are examples of services that may fit into this section.

HIPAA regulations are proposed to regulate Covered Entities (CE). One type of HIPAA Covered Entity is a “health care provider” who “transmits health information in electronic form” in relation with “defined covered transaction(s)”. Clinicians in an EAP practice or organization only may qualify as “health care providers”.

Another type of Covered Entity often found is a “health care plan”. Some EAPs will, depending on how they are defined, structured and/or paid by the employer, will become “welfare benefit plans” under this definition of covered entity. It is also possible to be at the same time both a “health care provider” and a “health care plan”.