The Health Insurance Portability and Accountability Act of 1996 (HIPAA) established a federal set of standards for protecting sensitive health information and medical records. The Act’s initial purpose was to permit employees to keep health insurance when they switched jobs.
Additionally, the Act created a uniform set of claims codes so that health insurance companies could accurately compute risk. As the transmission of electronic information has increased over the years, HIPAA has evolved to address concerns around the protection and privacy of electronically stored and transmitted health information.
In order to implement HIPAA’s standards, the U.S. Department of Health and Human Services issued regulations in two categories known as the HIPAA Privacy Rule and HIPAA Security Rule. The Privacy Rule creates restrictions on use and implements safeguards for privacy of Protected Health Information (PHI), while the Security Rule sets forth physical, administrative, and technical safeguards for electronic PHI (ePHI).
PHI comprises individually identifiable information regarding a person’s medical past, current medical status, future medical condition (e.g., prognoses), treatment, or requests for treatment. In this context, “individually identifiable” means that the information can be traced back to an identified or identifiable individual. PHI consists of 18 separate identifiers:
As a note to (R) above, PHI also includes data that, “in conjunction with other information,” could lead to the identity of an individual. With advancements in artificial intelligence (AI), one challenge is that this technology can be used to connect the dots and may be able to “re-identify” previously “de-identified” data files.
As mentioned earlier, PHI is governed by the Privacy Rule of HIPAA, and ePHI is governed by the HIPAA Security Rule. Practically, however, all PHI should be treated as ePHI in today’s ecosystem of electronic data-keeping and digital systems of information.
HIPAA has a limited jurisdiction and applies to Covered Entities, Business Associates, and Business Associate subcontractors. Employers become subject to HIPAA through one of two circumstances:
According to 45 C.F.R. § 160.103, a Covered Entity is a health plan, healthcare clearinghouse, or healthcare provider that transmits health information. This includes HMO plans, health insurance issuers, and ERISA health and welfare plans.
An employer would be considered a Covered Entity if it underwrites (self-insures) company health insurance plans. An employer would not be considered a Covered Entity if it offers employees a fully insured plan and only handles plan enrollment, not PHI. In this case, the insurance carrier would be the Covered Entity responsible for HIPAA compliance and for providing a Notice of Privacy Practices document explaining how it protects and discloses PHI related to the fully insured plan.
A health plan is allowed to disclose to a company plan sponsor: i) enrollment or disenrollment information; and ii) summary health information for premium bids, as long as it is not accompanied by individual identifying information.
A Business Associate is an entity that basically provides a service to a plan, where they create, receive, maintain, or transmit PHI in any medium in the fulfillment of a function, activity, or service for, or on behalf of, a Covered Entity. Covered Entities must have contracts with Business Associates (a.k.a. a Business Associate Agreement).
A Business Associate Agreement should stipulate that the Business Associate agrees to follow pertinent provisions of HIPAA Rules and maintain policies and training. The Agreement should also include provisions for breach reporting and return of PHI at the termination of the Agreement. Additionally, if a Business Associate uses a subcontractor (e.g., an IT provider), they must also obtain a Subcontractor Business Associate Agreement regarding PHI safeguards.
Most service providers to a health insurance plan must have a Business Associate Agreement—this might include attorneys, outsourced IT services, information systems consultants, AI providers, accountants, or certain health mobile app developers. These Business Associates are covered by most of the Security Rule and certain provisions of the Privacy Rule, and they must have documented HIPAA policies and training.
HIPAA Security Proposed Regulations (45 CFR Parts 160 and 164) were published on January 6, 2025 (“New Security Regulations”), and were expected to be finalized last month. With the Trump administration’s policy approach of having fewer regulations, some are skeptical that the new regulations will be enacted. However, with the significant breaches occurring in healthcare and the need for enhanced security, some version of the proposed regulations will be enacted down the road.
The New Security Regulations would require new technical safeguards related to access controls, network segmentation, encryption mandates, audit trails, and system log controls. The proposed regulations are referred to as “HIPAA Security Rule 2.0” because they represent arguably the most dramatic changes to HIPAA since enacted.
Importantly for HR, the HIPAA Security Rule 2.0 indicates that it will, for the first time, extend the HIPAA Security Rule to all plan sponsors, including employers with fully insured plans. Plan sponsors would then be subject to the many requirements of administrative, technical, and physical safeguards of ePHI—such as regular maintenance tests, an inventory of IT assets and mapping to identify vulnerabilities, and revocation of system access within one hour of an employee’s termination.
HR would also need to implement sanctions for employees who violate HIPAA security rules, which may be appropriately set forth in an employee handbook. The proposed rule would also require Business Associates to verify safeguards with written analysis by a subject matter expert every 12 months and to notify Covered Entities of security incidents within 24 hours.
While the regulations surrounding PHI can seem overwhelming, the overarching goal is to take reasonable and appropriate measures to protect and control access against threats like malicious software or insiders. Even if HIPAA does not apply to your company on its face, in practice, HR should treat PHI with HIPAA-equivalent standards.
Inadvertent access is inevitable to some degree, but employers can help protect themselves by instituting written HIPAA policies aimed at satisfying the Security Rule. These policies should be revisited at least every 12 months and should anticipate the enactment of Security Rule 2.0.
Three items that employers should start implementing now are:
All ePHI should be encrypted both in transit and at rest. There are various protocols and tools for encrypting data such as Transport Layer Security (TLS), Hypertext Transfer Protocol Secure (HTTPS), and Virtual Private Networks (VPNs) based on Internet Protocol Security (IPsec). Furthermore, be mindful of old email accounts that may contain ePHI. This information should be either deleted or encrypted.
Authorized users accessing ePHI should be required to use MFA to log in. There are increasingly more incidences of bad actors accessing sensitive data in the healthcare field, and requiring MFA for logins will help prevent such breaches.
Identify systems and devices with ePHI, map the flow of ePHI, and identify vulnerabilities to address. Address these and repeat the analysis in 12 months. This is one of the most difficult, but most important, aspects of Security Rule 2.0. In practically every settlement case with Health and Human Services (HHS) regarding HIPAA security, the resounding gap noted by HHS was the absence of any risk analyses conducted by the offending entities.
Employers can create a HIPAA compliance team (including IT) to oversee the different components of HIPAA compliance. Employers can also provide company-wide basic training on the protection of PHI, while providing more detailed training for IT workforce members on the HIPAA compliance team.
If you have any further questions regarding employer obligations related to HIPAA and PHI, please contact Brigette Renaud.
Brigette Renaud