HIPAA and Electronic Medical Records:

The most revolutionary idea in the medical recordIn a situation where the disclosure of PHI is
keeping practice is the introduction of electronicrequired the minimum possible exposure has to be
medical records technology. Earlier, before theconsidered. The privacy rule under HIPAA also
introduction of electronic medical records system,needs the concerned entity to make the
the records of the patients like their personalcommunication confidential as per the requirement
details, reports, x-ray reports, scan reports andof the individual. All the paper and electronic
other billing related information were kept andmedical records used should be notified to the
stored manually. Usually record books and filesindividual as per the use. And if any one feels that
were used for the same purpose, which in turnhis personal confidentiality under the Privacy Law
made it impossible to access at the time ofhas been breached he can file a complaint against
immense requirement due to its space consumingthe concerned entity with the Department of
nature. Apart from that due to the lack of properHealth & Human Services Office for Civil
privacy law the data with record keeper mostRights.
often landed in the hand of an ancillary medicalHIPAA under its Title II (two) covers the security
service provider, who in turn used these data torule also. The security rule deals specifically with
sell his goods and services. Same type ofthe electronic medical records systems. The rule
discrepancy was also found in case of electronicof security was finally issued on 20th Feb, 2003
medical records of that time as well. A proper lawwhich came to effect on 21st April, 2003. The
in this accord was the need of the hour;compliance of this security law which started
otherwise the practice of medical record keepingfrom 21st April, 2005 required three types of
would curve to a very bad state of distrust.security safeguards. These are Administrative,
Finally the HIPA Act was introduced. The PrivacyPhysical and Technical. For each of the type the
Rule and the Final Rule on Security StandardsSecurity Law lays different standards. The
under HIPAA saved the practice of medicaladministrative safeguards are specifically designed
record keeping from this evil.policies and procedures to show the compliance of
HIPAA or Health Insurance Portability andthe concerned entity with the act. The physical
Accountability Act regulate the issue of privacysafeguards are designed to protect the
related to medical records in US. Health Insuranceunauthorized inappropriate physical access to the
Portability and Accountability Act was introduceddata that is protected, mostly the electronic
in the year 1996 by the US Congress. Themedical records. The technical safeguards are
Privacy Rule was introduced in the year 2003designed to work along the electronic transmission
under Title II (two) of HIPAA. This act regulatesover network by the concerned entity so as to
the privacy issue related to the PHI. PHI orsafeguard the access to the computer systems
Protected Health Information is any piece ofcontaining the electronic medical records.
information regarding the health status, personalApart from these concerns, HIPAA also covers
detail, reports, x-ray reports, billing information ofthe whole medical and health related security
the respective individual. This privacy rule saysissues with its other latest acts like the HITECH
that the covered entities must give the PHI uponAct in 2009.  HITECH stands for Health
request of the concerned individual within a timeInformation Technology for Economic and Clinical
frame of one month or 30 days. The PHI of theHealth Act.
individual can be used only after his authorization.