August 1996: President Bill Clinton signs a law whose name promises two things, portability and accountability. Thirty years later most Americans know it as the reason a clinic asks them to sign a privacy form.
The original idea was narrower than that. Portability meant that a worker between jobs would not simply lose health insurance and then struggle to pay for care. Accountability meant cutting fraud and abuse by forcing organizations to keep patient data secure. The privacy regime people recognise today was built afterward, rule by rule, by the Department of Health and Human Services.
A slow build, rule by rule
The timeline is long. HHS put a draft Privacy Rule out for public comment in November 1999 and published the final version in December 2000. It tweaked that rule in August 2002. The Security Rule, which covers electronic records, was finalised in February 2003. Most covered entities had to start following the Privacy Rule in April 2003; small health plans got an extra year. The Security Rule followed in April 2005.
The enforcement machinery lagged. HHS issued an interim Enforcement Rule in April 2003, explaining how it would investigate complaints, and a final one in February 2006.
The next big change came with the HITECH Act, passed in February 2009 as Title XIII of the American Recovery and Reinvestment Act. It tightened HIPAA’s protections and added incentives for providers to adopt electronic health records. In July 2009 the HHS Office for Civil Rights was handed the job of policing the Security Rule too, alongside the Privacy Rule. A final Breach Notification Rule came in August 2009.
Then the Omnibus rule. HHS published it in January 2013, bundling changes to four existing rules into one package, and covered entities and their business associates had to comply by September 2013. In January 2021 the department floated further Privacy Rule changes meant to improve coordinated care, with the comment period stretched to May 2021.
Who is covered
The CDC describes HIPAA as a federal law setting standards meant to “protect sensitive health information from disclosure without patient’s consent.” It reaches healthcare providers that transmit information electronically, health plans from insurers and HMOs to Medicare and employer-sponsored plans, clearinghouses, and business associates doing work such as claims processing or data analysis. The law can even apply outside the United States when a foreign company handles data on US residents through a covered partner.
Consent is not absolute. Without authorisation, covered entities may share protected information for treatment, payment and day-to-day operations, for public health work, in response to police requests, in some research, and when someone’s safety is at serious risk. The statute lists 12 national priority purposes, among them abuse reports, court proceedings and workers’ compensation.
The Security Rule asks covered entities to “ensure the confidentiality, integrity, and availability of all e-PHI.” The HHS Office for Civil Rights enforces the lot, and violations can bring civil monetary or criminal penalties.
Sources
- History of HIPAA: How the Standard Has Evolved Since 1996
- Health Insurance Portability and Accountability Act of 1996 (HIPAA) | CDC
