Oracle Tips by Burleson

Chapter 1 Introduction to HIPAA

and the insurance company would not have rejected the record from his doctor.

Privacy of Information Finally, HIPAA places a great deal of emphasis on the issue that affects all of us in some form or other – privacy. Medical records are considered private and should be protected, just like any other tangible property, such as money. Prior to the law, the exact nature of the protection and the responsibility of enforcing said protection was not properly defined, and therefore there were many ways for the information to leak out. HIPAA mandates the protection by stressing that the data must be protected strictly and any violation will be severely penalized. For example, a leak of information calls for a fine of up to US $250,000 per incident and may result in the imprisonment of the executive in charge for a period up to 10 years. The severity of the penalty and the personification of responsibility is enough to make the executives of many organizations take this law and the issue of privacy and information protection very seriously.

The law mandates that organizations must establish a clear security policy that can be verifiable and, more importantly, auditable. In the normal course of business in any organization, some personnel will have to access data that is considered sensitive, so prohibiting their use is not feasible. HIPAA does not prohibit that access, but specifies that normal access be recorded as a policy, which should specify who can access what data, and any such access information should be recorded, or in other words, audited.

The above text is an excerpt from:

http://rampant-books.com/book_2003_2_audit.htm