Health Insurance Portability & Accountability Act

Health Insurance Portability and Accountability Act (HIPAA), in-acted by the United States Congress in 1996, regulates healthcare practices and professionals to secure Protected Health Information (PHI) from data breaches, deletions, and other problems at administrative, physical and technical levels:

Companies that deal with PHI must have relevant security measures in place and follow them to ensure HIPAA Compliance. Covered Entities (anyone providing treatment, payment, and operations in healthcare) and Business Associates (anyone who has access to patient information and provides support in treatment, payment, or operations) must meet HIPAA Compliance. Other entities, such as subcontractors and any other related business associates must also be in compliance.

Before having access to PHI, the Business Associate must sign a Business Associate Agreement with the Covered Entity stating what PHI they can access, how it is to be used, and that it will be returned or destroyed once the task it is needed for is completed.