HIPAA: update on rule revisions and compliance requirements

Due to the highly technical requirements for HIPAA compliance and the numerous administrative and clinical functions and processes involved, guidance from experts who are knowledgeable about systems design and use to secure private data is necessary. In health care organizations, this will require individuals who are knowledgeable about clinical processes and those who understand health information technology, security, and privacy to work together to establish an entity's compliance plans and revise operations and practices accordingly. As a precondition of designing such systems, it is essential that covered entities understand the HIPAA's statutory requirements and timeline for compliance. An organization's success in preparing for HIPAA will depend upon an active program of assessment, planning, and implementation. Compliance with security and privacy standards can be expected to increase costs initially. However, greater use of EDI is expected to reduce costs and enhance revenues in the long run if processes and systems are improved. NOTE: Special protection for psychotherapy notes holds them to a higher standard of protection. Notes used only by a psychotherapist are not intended to be shared with anyone and are not considered part of the medical record.