The HIPAA Privacy Rule creates national standards to protect individuals' health records and to give them control over that information. It sets limits on the use and release of health records and establishes safeguards to protect the privacy of health information. In general, a healthcare plan or provider may not use or disclose an individual’s healthcare information without permission except for treatment, payment, or healthcare operations. The average provider or plan must do the following:
| | •Notify patients or plan participants about their privacy rights. |
| | •Adopt and implement privacy procedures. |
| | •Train employees to understand privacy procedures. |
| | •Assign responsibility for seeing that privacy procedures are adopted and followed. |
| | •Secure records containing individually identifiable health information. |
The rule also provides for reduced compliance for plans that share limited information with the plan sponsor. Other related regulations provide requirements for security of health information; electronic healthcare transactions; and national identifiers for providers, plans, and employers.