Title II includes a section, Administrative Simplification, requiring:

1. Improved efficiency in healthcare delivery by standardizing electronic data interchange, and
2. Protection of confidentiality and security of health data through setting and enforcing standards.

More specifically, HIPAA calls for:

1. by a covered entity
2. of protected health information
3. to the minimum information necessary to accomplish the purpose for which the information is used or disclosed but any disclosure to a provider for purposes of treatment is permitted.

It also defines rights of individuals with respect to information about themselves:

• right to written notice of information practices;
• rights of access, review, and correction;
• right to an accounting of disclosures not for provision of care.

HIPAA Security requires appointment of a Security officer responsible for security of health information and maintaining reasonable and appropriate safeguards to:

• ensure integrity and confidentiality of all health information which is maintained or transmitted in electronic form;
• protect against reasonably anticipated threats or hazards to security and integrity of information;
• protect against reasonably anticipated unauthorized uses or disclosures of information;
• ensure compliance to safeguards by officers and employees.

• standards for the electronic transmission of financial and administrative information
• standard codes for identifying medical diagnoses and procedures
• a 10-digit numeric ID known as a National Provider Identifier issued to every provider organization
• a nine-digit numeric ID issued to each employer to use in all HIPAA-governed administrative and financial transactions thirty-four specific security measures that providers must adopt in order to protect patient-identifiable healthcare information
• additional rules that will specify how and under what circumstances, healthcare information can be used and shared

An interim HIPAA Enforcement Rule was published on April 17, 2003 which defines procedures for HHS’s Office of Civil Rights (OCR) and Center for Medicare & Medicaid Services (CMS) to perform investigations, hold hearings and impose civil penalties for non-compliance of the HIPAA standards. OCR has been named to enforce the Final Privacy rule and CMS has been named to enforce the Final Transaction and Code Set Rule. The Interim Enforcement Rule became effective on May 19, 2003 and will cease to be in effect on September 16, 2005.

• The standardization of electronic data interchange may significantly improve information transfer between payer and provider.
• Codification of electronic data standards may position providers to efficiently move their services onto the Internet
• It provides healthcare organizations with an opportunity to streamline and simplify their operations and infrastructure thereby providing a significant potential for savings. For example, a large amount of physician practice time is currently spent on administrative processing. We expect that administrative needs may significantly decrease with implementation of HIPAA standards.

The latest published rules include:

The Final National Employer ID Rule was published on May 31, 2002
The Final Security Rule was published on February 20, 2003
The Interim Enforcement Rule was published April 17, 2003
The Final National Provider ID Rule was published on January 23, 2004.

• Name
• Geographic identifiers smaller than a state (except first three digits of a zip code)
• Telephone or fax numbers
• Birth date (except the year)
• Admission or discharge dates
• Social Security or medical records numbers