Speaker 1: In this video, we will discuss the HIPAA rules, the privacy rule, the security rule, the breach notification rule, and the omnibus rule. HIPAA guidelines are identified and defined in a series of interlocking regulations known as the HIPAA rules. One of these rules is known as the HIPAA privacy rule. HIPAA privacy guidelines are defined in the HIPAA privacy rule. These HIPAA guidelines include national standards that all covered entities must address within their business. These standards are meant to safeguard the privacy of patient data called protected health information also known as PHI under HIPAA. What information does the HIPAA privacy rule protect? The privacy rule protects protected health information from unauthorized use or disclosure. What is use? Use means with respect to individually identifiable health information. The sharing, employment, application, utilization, examination, or analysis. What is disclosure? Disclosure means the release, transfer, or provision of access to any manner of information outside the covered entity holding that information. Next, we will discuss the HIPAA security rule. The HIPAA security rule is meant to protect electronic PHI also known as ePHI. The security rule requires appropriate safeguards to be in place to maintain the integrity, availability, and confidentiality of ePHI. Healthcare organizations must implement physical, technical, and administrative safeguards to secure patient information. Physical safeguards protect the physical security of your offices where PHI or ePHI may be stored or maintained. Common examples of physical safeguards include alarm systems, security systems, and locking areas where PHI or ePHI is stored. Technical safeguards protect the cybersecurity of your business. Technical cybersecurity safeguards must be implemented in order to protect ePHI that is maintained by your business. Examples of technical safeguards include firewalls, encryption, and data backup. Administrative safeguards ensure that staff members are properly trained in order to execute the security measures you have in place. Administrative safeguards should include policies and procedures that document the security safeguards you have in place, as well as employee training on those policies and procedures to ensure that they are properly executed. Now let's discuss the breach notification and omnibus rule. The breach notification rule outlines the processes that HIPAA-beholden entities must follow in the event of a data breach. This requires covered entities following the discovery of a breach of unsecured PHI to notify each person affected. If a breach affects 500 or more individuals, covered entities must notify the Department of Health and Human Services without unreasonable delay and no later than 60 days following the breach. If a breach affects less than 500 individuals, the covered entity may notify on an annual basis. The HIPAA omnibus rule mandates that business associates must be HIPAA compliant and also outlines the rules surrounding business associate agreements, also known as BAAs. Business associate agreements are contracts that must be executed between a covered entity and a business associate or between two business associates before any PHI or ePHI can be transferred or shared. By complying with HIPAA regulation, you not only protect the privacy and security of your patient's PHI, you also protect your business. We have now reviewed the HIPAA rules. Please continue to the next section.