HIPAA

What is HIPAA?

HIPAA is the Health Insurance Portability and Accountability Act of 1996. For labs, its most important parts are the rules that protect health information, enforced by the Office for Civil Rights at the US Department of Health and Human Services (HHS).

The main rules

• Privacy Rule: when protected health information (PHI) can be used or shared, and patients' rights to access their records.
• Security Rule: administrative, physical and technical safeguards for electronic PHI, such as access controls, audit logs and encryption.
• Breach Notification Rule: telling affected patients, HHS and sometimes the media after a breach of unsecured PHI.

Who it covers

HIPAA applies to covered entities, which include health plans, health care clearinghouses and most health care providers, including clinical labs that bill electronically. It also applies to business associates, the vendors that handle PHI for them, such as software and hosting providers.

There is no official HIPAA certification. Compliance is shown through safeguards, policies, training and signed agreements.

This is a plain-language summary for general information, not legal advice. Check the current rules with a qualified adviser for your lab.

How Lab Desk handles it

Lab Desk is HIPAA compliant and signs a Business Associate Agreement with every US lab. Data is encrypted in transit and at rest, access is role-based, and key actions are logged. See HIPAA at Lab Desk.

Related terms

• PHI (protected health information): Health information that can identify a person and is held or shared by a HIPAA covered entity or its business associate.
• BAA (business associate agreement): A contract HIPAA requires between a covered entity and a vendor that handles its protected health information.
• UK GDPR: The UK's main data protection law, which sets rules for handling personal data, including health data.