Electronic Medical Record Policies

The Health Insurance Portability and Accountabilitypermitted under the Privacy Rule. Such
Act, or HIPAA, went into effect in 1996, with ansafeguards include physician and medical staff
aim to protect the privacy of individuallydiscretion in discussing a patient's medical
identifiable medical records. In April 2003, ainformation, and structural safeguards such as
mandatory Privacy Rule to protect individuallystoring patient files in a secure location with
identifiable health information came into effect forcontrolled access, protecting electronic records
all health plans, health care clearinghouses, andwith passwords and firewalls, etc.
providers who use electronic medical records. TheAnother guiding principle of the Privacy Rule is
Privacy Rule mandates the adoption of certainthat when medical information is disclosed for
standards across the United States to protect,permitted purposes, the minimum necessary
and prevent the misuse of, individually identifiableinformation, and no more, should be revealed. The
medical information. Failure to do may carry civilminimum necessary standard does not apply to
and criminal penalties under federal law. HIPAA isdisclosures to or requests by physicians for
not meant to replace any existing laws thatpatient information for treatment purposes. It also
protect individual medical records, and somedoes not apply if an individual wants to access his
states have even more stringent laws in place toor her own medical records, or authorizes others
protect patients' privacy.to access these records. Disclosures are also
An entity covered under HIPAA is permitted topermitted where dictated by HIPAA, including
use medical information and to make certaindisclosures to the Department of Health and
incidental disclosures regarding medical informationHuman Services where such disclosure is required
if reasonable safeguards are in place to preventfor enforcement purposes.
the use of such information for purposes not