HIPAA

Abstract

The Health Insurance Portability and Accountability Act of 1996 (HIPAA) was instituted in the US to ensure the protection of individuals’ health information, while also allowing communication between parties involved with patient care. It was not until 1999, however, when the US Department of Health and Human Services developed the Privacy Rule that made implementation of HIPAA mandatory. Effective April 2003, organizations (i.e., “covered entities”) subject to HIPAA regulations are required to comply with patient information protection policies. “Covered entities” refer to health plans, healthcare providers, and health care clearinghouses.

The de-identification of protected health information has turned presentations on bedside rounds into masterpieces of obfuscation. Not the name, nor the initials, and not even the exact age of the patient may be used. This sad state of affairs now confronts all clinical research in the USA. —Susan Galandiuk, M.D. (British Journal of Surgery 2004; 91: 259–261)