HIPAA (Health Insurance Portability and Accountability Act) Information Sheet

The Health Insurance Portability and Accountability Act of 1996 (HIPAA) is a comprehensive law affecting institutions and departments that deal with protected health information.

Requirements
HIPAA includes requirements to protect the security, integrity, and confidentiality of this health-related information. These requirements apply to departments at Purdue that have been officially designated by the HIPAA Privacy Compliance Office as covered by HIPAA. To be HIPAA compliant, departments must develop, implement, and enforce a comprehensive security program including administrative, technical, and physical safeguards as determined appropriate for the institution and data. In addition to developing their own safeguards, departments are responsible for taking steps to ensure that their affiliates and service providers safeguard customer information in their care.

Actions Required
The following basic actions must be taken to satisfy HIPAA requirements:
- Assess risk to information systems, applications, and the HIPAA covered data it must protect.
- Manage and control these risks.
- Identify business associates in your area and communicate them to the HIPAA Privacy Compliance Office prior to sharing protected health information with them.
- Adjust new technologies and programs to satisfy HIPAA requirements.