In August 1996, President Clinton signed the Health Insurance Portability and Accountability Act (HIPAA), making it law. For many Americans, HIPAA is just an episode—some documents are signed when they visit a new doctor, or another box to check when working with a supplier. In fact, few people know what HIPAA stands for, and even fewer people know why it is important. In the 25 years since the promulgation of HIPAA, this statue has grown into one of the pillars of the country to protect personal privacy. Although HIPAA is a complex and wide-ranging piece of legislation, its enduring legacy is to require the healthcare industry to protect personally identifiable information (PII) from theft and exploitation.
At the time of signing, the drafters of HIPAA could not predict the extent to which personal data will become an important part of the U.S. healthcare system. Now, data is no longer simply storing patient information, but a driving force for innovation; large data sets promote research, thereby improving the health outcomes of patients around the world.
However, while growing healthcare data can be used as a resource for the entire industry, it also represents the main target of hackers and ransomware.according to Safety magazineIn 2020, more than 92 U.S. healthcare organizations faced ransomware attacks, and bad actors paid more than $15.5 million in ransoms. These violations not only have economic consequences: they also violate HIPAA and may result in civil and criminal penalties.
Although HIPAA has done a great job keeping up with the pace of technological innovation, the increasing threats of ransomware and data breaches are the most serious challenges facing organizations and service providers.
As technology develops, so does HIPAA
In the past 25 years, HIPAA has not always been a static and rigid legislation. In order to maintain relevance in the face of new technologies and applications, legislators have added two important rules to the HIPAA regulations:
- HITECH 2009/ Violation Notification Rules: In the ten years after the issuance of HIPAA, it may be found that doctors and nurses carry paper documents to make appointments and store patient data in physical cabinets on site. Recognizing the potential of electronic health records, Congress enacted the Economic and Clinical Health Information Technology Health Act in 2009. The most notable is cybersecurity. The HITECH Act requires entities covered by HIPAA to report any data breaches affecting more than 500 people to the Department of Health and Human Services. This critical step is the recognition of the growing importance of customer data and the increasing threat of hackers.
- The 2013 final consolidated rules: Four years after its promulgation, Congress updated the HITECH Act to include not only the content covered by HIPAA, but also business partners. In addition, the 2013 final comprehensive rules changed the burden of proof for whether damage occurred due to violations.Previously, the organization needed to prove that it caused significant harm to an individual; according to the new legislation, the organization must prove that it has caused significant harm no Happened, a higher standard of consumer protection.
The evolution of HIPAA includes not only proactive legislation, but also the ability to respond to violations. In 2017, the first HIPAA violation settlement involving a wireless service provider occurred at CardioNet. The company provides remote mobile monitoring and rapid response services for patients at risk of arrhythmia, and settled at a price of 2.5 million US dollars, involving suspected illegal disclosure of unsafe electronic protected health information.
Serve the increasingly digital healthcare system
Although the U.S. healthcare system has become more digital, the Covid-19 pandemic has promoted an unprecedented acceleration in the adoption of telemedicine services. According to a study published by JAMA Network Open, telemedicine accounted for 0.3% of visits to medical service providers in 2019; by 2020, this number has grown to an astonishing 23.6%. The dramatic increase in the use of telemedicine inevitably requires a simultaneous increase in electronic data transmission: for each online touchpoint, patients need to submit PII or arrange for their information to be sent from one service provider to another. Each new telemedicine patient places an additional burden on healthcare providers and companies to maintain HIPAA compliance.
In this increasingly digital world, organizations need to maintain strong security and privacy practices to avoid the potential civil and criminal consequences of violating HIPAA. Recognizing the need for HIPAA-compliant tools to promote new digital services, many leading technology companies have been committed to creating new solutions for the healthcare industry.
After 25 years of HIPAA, it is clear that these regulations are important and necessary tools to protect consumer privacy. In order for HIPAA to remain relevant for the next 25 years, policy makers and healthcare providers need to remain agile and vigilant; as long as they keep pace with the latest technology and security challenges, this groundbreaking legislation will be effective.
