Government/Military Trends
June 2003
Feeling the Effects of HIPAA
 |
| Issue Table of Contents |
|
|
As technology is helping the Military Health System (MHS) reinvent itself, what is its impact on the privacy and security guidelines mandated by the Health Insurance Portability and Accountability Act of 1996 (HIPAA)? Developed by the Department of Health and Human Services, the federal privacy standards are meant to give patients more control over their medical information and how and when it is used or disclosed. Nearly all medical organizations were required to comply with the new regulations by April 16, 2003. Further security measures, designed to support the privacy standards, will go into effect in 2005.
With these new regulations in place, the handling of sensitive medical data becomes even more critical. On April 14, William Winkenwerder Jr., assistant secretary of defense for health affairs, announced that all military medical facilities have implemented the HIPAA privacy rule. Compliance included the mailing out of notices of privacy practices, the training of personnel on privacy rules, and the deployment of Web-based training and compliance tools.
In the press release announcing the implementation of the new rules, Winkenwerder said, "The Military Health System has always had privacy standards in place to limit unauthorized access and disclosure of personal health information; this new rule heightens awareness, raises the level of oversight and provides a standard set of guidelines to protect the privacy of all patients."
The new privacy measures put the onus on healthcare organizations to protect patient medical data, and the final security rule is designed to ensure that privacy is enforced. Effective April 21, 2003, the security rule requires the compliance of most medical organizations by April 21, 2005. It includes standards regarding administrative, physical, and technical safeguards.
While the government has always taken into consideration the security of the new systems it puts into place, the privacy and security rules are now having an impact on the development of new technology, especially related to wireless communications.
According to an article1 in Military Medical Technology: Online Edition, several pilot programs using PDAs for the transfer of patient information are being limited by the new HIPAA regulations. Currently, it is difficult to ensure the security of data being transferred between PDA and databases, so the groups using the PDAs are unable to use them outside of the pilot program level until solutions can be found that allow the wireless devices to meet the National Institute for Standards FIPS 140 standard for encryption, as mandated by the Department of Defense.
In the meantime, government agencies are working together to improve the sharing of information between medical systems, while still meeting HIPAA guidelines. In March of this year, the Department of Defense, Health and Human Services, and Veterans Affairs departments announced the release of government-wide standards for coding and sharing medical records. The project, called the Consolidated Health Informatics (CHI) initiative, will establish a portfolio of existing clinical vocabularies and messaging standards enabling federal agencies to build interoperable federal health data systems. This will allow them to collaborate and share information without translating or re-entering data. The new standards will work in conjunction with the HIPAA transaction records and code sets as well as security and privacy provisions.
“It’s important for the federal government to lead by example by selecting and adopting these standards,” HHS Secretary Tommy G. Thompson said in a statement2. “With appropriate privacy protections for personal health information, consumers and patients will benefit when their health information is available to their doctors and other healthcare providers when it is needed, such as in the emergency room. But we cannot do it alone. The private sector will be crucial to the widespread diffusion of these standards.”
1 Military Medical Technology: Online Edition http://www.mmt-kmi.com/archive_article.cfm?DocID=63
2Statement from a press release