Guidelines of HIPAA in Preserving Patients' Data Confidentiality and Privacy

Name of University
Computer and Network Security
Student Name
Course Name
Submission Date

GUIDELINES OF HIPAA IN PRESERVING PATIENTS’ DATA CONFIDENTIALITY AND
PRIVACY
The Health Insurance Portability and Accountability Act (HIPAA) guidelines include
Privacy Rule, Security Rule, Transactions and Code Sets (TCS) Rule, Unique Identifiers Rule,
Breach Notification Rule, Omnibus Final Rule, and the HITECH Act. The main sections that
greatly deal with patient’s data privacy and security are HIPAA Privacy Rule and HIPAA
Security Rule. HIPAA Privacy Rule centres on guidelines regarding the privacy of patient data
while HIPAA Security Rule emphases on guidelines regarding the security of patient data
(Hammaker, 2018).
HIPAA Privacy Rule aims at safeguarding protected health information (PHI) by
providing patients with extra control over their health information, allocating limits on the use
and publication of health records and instituting safeguards covered entities (CEs) that must
implement to guard the privacy of health information (Beaver & Herold, 2004). One of the
guidelines of the rule is that the CEs may use or disclose PHI for living and deceased individuals
only under certain conditions. These include to the every person to whom the PHI affect, with
any single authorization or legal pact and largely without individual authorization for treatment,
payment and operations (TPO). In addition, CEs may release PHI to business associates (BA)
and permit the BA to create or receive PHI on its behalf if the CE can warrant the BA will
provide enough security over the PHI.
HIPAA Security Rule obliges a covered entity (CE) to implement appropriate
administrative, technical and physical safeguards to safeguard the privacy of protected health
information (PHI) (John, (2012). The guidelines to implementing this states that the CE needs
guarantee the confidentiality, integrity, and availability of all electronic PHI the CE creates,
receives, maintains or transmits. Secondly, the CE must safeguard against any reasonably
foreseen threats or risks to the security or integrity of such information. Finally, CE must defend
against any reasonably foreseen uses or releases of such information that are not legalised or
obligated under privacy of individually identifiable health information.