The HIPAA Privacy ACT

The HIPAA Privacy ACT
Name:
Institution:
Course Title:
Instructor:
Date:
The HIPAA Privacy Act
1.0 Introduction
There are specific privacy standards outlined in the final December 28, 2000 HHS final rule (65 FR 82462) also referred to as the "Privacy Rule." These are specific standards for Privacy of Individual Identifiable Health Information that consumers are increasingly concerned about (Nass, Levit & Gostin, 2009). These provisions have created a platform that ensures nationwide protection for the privacy of citizen’s most sensitive health information. These regulations are to assure consumers that all their sensitive information including genetic information will be properly protected (Field, 2005). The Privacy Rule ensures ensure that health plans and healthcare providers fully guard and prevent misuse of individual identifiable health information and limit sharing of such information. In this particular case, there is a need to apply the HIPAA Breach Notification Rule, 45 CFR 164.400-414. This requires the Privacy Section of the Health Insurance Portability and Accountability Act (HIPAA) covered entities and related business associates to provide notification following a breach of unsecured protected health information (Anatayakul, n.d; Erickson, 2005; Wiener, Gilliland, 2011). This paper seeks to discuss the role of the HIPAA, based on a case study provided that will help analyze the requirements of investigating breach of privacy according to the HIPAA and the necessary steps that should be taken to address the issue.
1.1 Background
The Privacy Section of the Health Insurance Portability and Accountability Act (HIPAA) is a national legislation created to assure every patient across the nation protection of their health insurance information. This limits individuals and institutions that have access to patient’s information on how they can use it (McGowan, 2012). In the HIPAA Breach Notification Rule, following a breach of unsecured protected health information, covered entities must first provide notification of the breach to affected individuals, the secretary and if necessary to the media. The notice must be provided to the affected individual or their representatives or guardians in written form by first class mail or by email as agreed to receive such notices electronically (Nass, Levit & Gostin, 2009; Gunn et al., 2004; Flaherty, 2014; Fleming, 2014).
The individuals must be provided, without delay, with the information on the extent of the breach, the steps the affected individual should take to protect themselves from potential harm and description of what the covered entity is doing to investigate and prevent further breaches. This will also require the secretary of breaches of unsecured protected health information. This is done through online platforms provided at the HHS web site where an electronic form is filled. This will then be followed by adopting the hospitals policy recommendation on the specific sanctions that should be given to the member who failed to comply with the policy and procedure in this case the nurse (HHS.gov, 2015; Field, 2005; Fleming, 2014; McGraw, 2013).
2.0 Analysis of Specifics Required to Perform the Investigation
In accordance to the modifications of the HIPAA provisions for modifications to the standards, the provisions to the Privacy Rule (67 FR 14776), a member of the health care providers breached unsecured health information to unauthorized third party (Anatayakul, n.d; Flaherty, 2014). In accordance to the HIPAA regulations, a breach in this case is imminent and it is the mandate of the hospital to carry out the necessary steps as per the provisions in the HIPAA Privacy Rule. Despite being an unintentional acquisition of patient information by the nurse daughter, the information was not transferred from the nurse daughter to the general public at school in good faith hence ended up harming the patient’s image. This kind of breach is between an authorized covered entity member and a non authorized entity hence making it an actual breach. It fails to meet the exceptions provided in the HIPAA Privacy Rule (Gunn et al., 2004). Covered entities in which the hospital and the nurse in this case were the only ones that were supposed to have access to this patient’s information. The information, according to the HIPAA rules, could only be shared among covered entities which include business associates to the hospital, request by public health purposes, and public agencies for health oversight activities such as audits, civil, criminal or administrative purposes, and the law enforcement officials, for judicial and administrative proceedings and for research purposes. These are the only incidences that could be used to allow the patients information out of the hospital without their consent. Otherwise, a clearly written individual permission that met specific consent requirements was required in this case (Nass, Levit & Gostin, 2009; Rezaeibagha, Win & Susilo, 2015).
3.0 Differences and Similarities Between Hospitals Stance and HIPAA On the Disciplinary Decision On the Nurse
The stances between the hospital decision and the HIPAA for the nurse to be fired based on disclosure of information to a non-cleared third party entity are similar. It is clear that the nurse disclosed unprotected information for a patient that belong to the hospital and that she is not supposed to discuss with unauthorized parties in this case a non...