HIPAA and Preserving Patient Data Confidentiality and Privacy

This assignment delves into the Health Insurance Portability and Accountability Act (HIPAA) and its critical role in safeguarding patient data confidentiality and privacy. It explores the key components of HIPAA, including the Privacy Rule and Security Rule, which provide guidelines for protecting protected health information (PHI). The assignment highlights the importance of securing healthcare records and the significance of HIPAA in the United States. Furthermore, it examines alternative approaches to securing healthcare records in Malaysia, referencing the Malaysian Medical Association's Code of Medical Ethics and the Confidentiality Guidelines. The analysis emphasizes the need for confidentiality, security, and patient rights concerning medical records, drawing parallels between HIPAA regulations and local practices. The assignment also touches upon the General Consumer Code of Practice (GCC) as an alternative for HIPAA Transactions and Code Set (TCS) Rule, focusing on protecting personal information within the telecommunication and multimedia sector. Overall, the assignment underscores the importance of data security and compliance within the healthcare sector.

Name of University
Computer and Network Security
Student Name
Course Name
Submission Date

GUIDELINES OF HIPAA IN PRESERVING PATIENTS’ DATA CONFIDENTIALITY AND
PRIVACY
The Health Insurance Portability and Accountability Act (HIPAA) guidelines include
Privacy Rule, Security Rule, Transactions and Code Sets (TCS) Rule, Unique Identifiers Rule,
Breach Notification Rule, Omnibus Final Rule, and the HITECH Act. The main sections that
greatly deal with patient’s data privacy and security are HIPAA Privacy Rule and HIPAA
Security Rule. HIPAA Privacy Rule centres on guidelines regarding the privacy of patient data
while HIPAA Security Rule emphases on guidelines regarding the security of patient data
(Hammaker, 2018).
HIPAA Privacy Rule aims at safeguarding protected health information (PHI) by
providing patients with extra control over their health information, allocating limits on the use
and publication of health records and instituting safeguards covered entities (CEs) that must
implement to guard the privacy of health information (Beaver & Herold, 2004). One of the
guidelines of the rule is that the CEs may use or disclose PHI for living and deceased individuals
only under certain conditions. These include to the every person to whom the PHI affect, with
any single authorization or legal pact and largely without individual authorization for treatment,
payment and operations (TPO). In addition, CEs may release PHI to business associates (BA)
and permit the BA to create or receive PHI on its behalf if the CE can warrant the BA will
provide enough security over the PHI.
HIPAA Security Rule obliges a covered entity (CE) to implement appropriate
administrative, technical and physical safeguards to safeguard the privacy of protected health
information (PHI) (John, (2012). The guidelines to implementing this states that the CE needs
guarantee the confidentiality, integrity, and availability of all electronic PHI the CE creates,
receives, maintains or transmits. Secondly, the CE must safeguard against any reasonably
foreseen threats or risks to the security or integrity of such information. Finally, CE must defend
against any reasonably foreseen uses or releases of such information that are not legalised or
obligated under privacy of individually identifiable health information.

IDENTIFY AND DESCRIBE HIPAA ALTERNATIVE FOR SECURING HEALTHCARE
RECORDS OF PATIENTS IN MALAYSIA
Malaysian Medical Association adopted the Code of Medical Ethics in May 2001.
According to the guidelines adopted, doctors have an obligation to safeguard, in total privacy, all
what they know about a patient because of the confidence entrusted to them by the patients
(Edwin & Ismail, 2013). In addition, in 2006, the Malaysian Medical Council issued
comprehensive course of action on the means of handling medical records and medical reports.
According to Edwin & Ismail (2013), some of the procedures defined include; confidentiality of
the medical records that states that they must be classified "Confidential", security of medical
records which states that they must be kept in a safe and secure rooms at all times when they are
not in use and rights of medical records which require approval from the patient or next of kin
before the medical records can be released to any third person. These guidelines are similar to
HIPAA Security Rule and HIPAA Privacy Rule. Another alternative which was approved and
implemented by the Malaysian Medical Council in 2011 was the Confidentiality Guidelines. The
guideline comprehensively sets out the confidentiality obligation owed by doctors to patients and
the need to respect patients' privacy rights.
The General Consumer Code of Practice (GCC) which was established by the
Communication and Multimedia Consumer Forum of Malaysia offers an alternative to HIPAA
Transactions and Code Set (HIPAA TCS) Rule. GCC aims at protecting personal information in
the telecommunication and multimedia sector by providing policies and procedures on personal
data protection. GCC states that the service providers –similar to HIPAA Covered Entities
(CEs); may gather and preserve essential data of its consumers as long as the information is
processed for limited purposes, managed in accordance with the data subject's rights, accurate,
safe and transferred only with an earlier authorization from the consumer. This guideline is
similar to that provided by HIPAA on how CEs can share patients’ data with business associates
(BA).

REFERENCES
Beaver K., Herold R. (2004). The Practical Guide to HIPAA Privacy and Security Compliance.
London, CRC Press
Edwin L. Y. C., Ismail N. (2013). Beyond Data Protection: Strategic Case Studies and Practical
Guidance. New York, Springer Science & Business Media
Hammaker D. K. (2018). Health Records and the Law. Burlington. Jones & Bartlett Learning
John T.J. (2012). The Definitive Guide to Complying with the HIPAA/HITECH Privacy and
Security Rules. London, CRC Press
McConnell C. (2011). The Health Care Manager's Legal Guide. New York, Jones & Bartlett
Learning