INTRODUCTION Slightly through a ye...

INTRODUCTION

Slightly through a year has passed since the implementation date of the HIPAA Privacy method While there was fear that the Privacy mastership might significantly stifle research, the carrying capacity it has placed on researchers has been minimal in chiefly circumstances. The transition provisions and the 'grandfather clauses' allowed studies uncloseed before the implementation date of April 14 2003 to continue without disruption. in succession the other hand, the impact forward the central administrations of institutions conducting research regulated from the Privacy Rule has been enormous in confines of time and effort of personnel and cost

Some tokens of research are now more difficult to carriage if the Privacy Rule regulates them and it is important, therefore, that researchers understand the implications of HIPAA to their research. Although one guidance has been forthcoming, the Department of Health and Human Services (DHHS) and its Office of Civil Rights (OCR) have been relatively cautious in providing guidance related to the Privacy order Further, no legal precedence concerning the Privacy direction is available at this time. As a terminate institutions and researchers affected at HIPAA have had to rely forward their own interpretations of certain aspects of the Privacy order Given the civil and criminal penalties that can consequence from noncompliance with the Privacy behavior an uncomfortable situation exists with regard to an research.

The purpose of the not away paper is to review, from a research administrator's perspective, ways in which research can be demeanored under the Privacy Rule and the impact the control has had on certain research situations. Numerous descriptions and reviews of HIPAA and the Privacy authority are available from DHHS,1 OCR23 and other organizations so as the American Council in succession Education."4 Therefore, the description provided here of HIPAA and the Privacy government will not be exhaustive; rather, details can be gleaned from these many of the best quality reviews.

HIPAA AND THE PRIVACY RULE

The "Health Insurance Portability and Accountability Act (HIPAA) of 1996" was enacted to make secure health insurance coverage after leaving an employer and to improve the efficiency and effectiveness of the health care scheme through the development of standards and requirements for electronic transmission of certain health information. Because of pertain tos about confidentiality of health information, Congres solicitationed that DHHS also provide standards beneath HIPAA for the protection of the privacy of this information. The OCR within DHH was given the responsibility for oversight and enforcement of these novel standards. Currently, these regulations include the "Standards for Privacy of Individually Identifiable Health Information" (45 CFR Parts 160 and 164)5 or Privacy mastership which protects the disclosure or release of certain health information and in near cases how this information is used. A separate method dealing with the security of health information will be implemented in 2005

The Privacy domination only pertains to institutions or individuals who are considered beneath the Rule a "covered entity." In addition to health care clearinghouses and health plans, any institution or individual that leaderships electronic transmission of health information and/or billing related to the delivery of health care is considered a "cover entity." For a large organization with a tangle structure, the Rule allows the organization to declare itself a "hybrid, screened entity" with only certain parts of it considered constitutings of the "covered entity." For example, a university may decide to consider single certain units, such as its medical institutes and health care clinics or hospitals, as disguiseed components. Such institutions may decide not to include seminarys of arts and sciences or business as concealed components and, therefore, the activities of employee within these units are not make submissive to the Privacy Rule. This makes certain activities within the noncovered component parts easier to conduct. Other employee who work within the disguiseed components, and are members of its work force, are enthrall to the Privacy Rule.

The Privacy mastership regulates information about the health or condition of an individual that is specifically identifiable to that individual and which has been generated or infered by a 'covered entity/ of the like kind information is referred to as fostered Health Information (PHI). The PHI can be used or disclosed without authorization from the individual from whom it is heap uped for the purposes of treatment, payment (billing), or health care operations. The latter belongs to such activities as quality assurance or improvement evaluations. Unles certain exceptions are met other uses and disclosure of PHI require the authorization of the individual from whom the information is amassed Research is one of these activities and is defined subject to the Privacy Rule as: "A systematic investigation, including research progression in a continuously ascending gradation testing, and evaluation, designed to bring to maturity or contribute to generalizable knowledge."