Independent thinking. Informed defence.

CISO Times

Intelligence for the people behind the defence.

The CISO Decision Brief

Tools · HIPAA Security Rule Readiness

Does HIPAA apply to us?

Answer up to 11 questions about what your organisation does with health information. You get the role HIPAA gives it: covered entity, business associate, subcontractor business associate, hybrid entity, neither, or not yet settled, and what that means for the Security Rule. Nothing is stored.

Question 1 of 10 0 answered

Part 1 of 3

Covered entity

A health plan, a health care clearinghouse, or a health care provider that sends standard transactions electronically.

Gather the facts first, with legal counsel: what the organisation does with health information, who its customers are (health plans, providers, clearinghouses or other business associates), whether it sends claims or other standard transactions electronically, which suppliers hold health information for it, and any written designation of health care components. Answer Not sure only when you do not know. A Not sure keeps the result Not settled until the fact is found, and a question left blank counts as Not sure. Do not guess to reach a result. An employer or union that only sponsors a group health plan for its staff, and runs no plan of its own, answers RQ-01 Plan sponsor only, not Not sure: the plan, not the sponsor, is the covered entity, and the result points to 164.314(b) for the plan documents.

Covered entity

RQ-01 Does your organisation provide, or pay the cost of, medical care for individuals under an individual or group plan: a health insurer, an HMO, a government programme such as Medicare or Medicaid, or an employee group health plan that has 50 or more participants or is administered by someone other than the employer? An employer or union that only sponsors a group health plan for its staff is the plan sponsor, not the health plan: the plan is the covered entity. If that is you, answer Plan sponsor only (164.314(b), 164.504(f)). Plans that only provide the excepted benefits listed in the Public Health Service Act, and some government-funded programmes, are excluded from the definition: answer Not sure and ask counsel.
Where it comes from in the Rules
160.103 "Covered entity" (1) and "Health plan"

You can move on with questions unanswered: the result says which it still needs. Nothing is saved, so reloading the page starts again.

How this is worked out, and what it is not

  1. Your role depends on what the organisation does with protected health information, not on whether an agreement has been signed (HR-01). A missing agreement does not remove a role, and a signed one is not what creates it. Answer from the facts.
  2. HIPAA's role test as 15 rows in 4 groups, written from the definitions in 45 CFR 160.103 and 164.103. In each group the rows are read from the top, and the first that matches the answers decides.

The result is a statement of what applies, in the workbook's words, never a score. The questions, the answers to choose from and the rule are the workbook's: the same answers give the same result in both. It is not legal advice.

  • This document helps a security team see what the HIPAA Security Rule and the breach notification rules ask of an organisation like yours, and what it could show. It is not legal advice. It does not say that you are compliant with HIPAA or that you are certified, and the Rules provide no certificate of compliance. Whether HIPAA applies to your organisation, in which role, and what a breach or a contract requires are for counsel to confirm. The notification deadlines are in P09 (RD-17 to RD-20) and P18, and are not repeated here.
  • Rule HR-01: "The role comes from what the organisation does with protected health information, not from a signed agreement. Decide it with the applicability assessment, record the answers, and have counsel confirm."
  • Being a business associate depends on what the organisation does with protected health information, not on whether an agreement has been signed. Counsel confirms the result, and confirms every answer marked Not sure, before it is used to scope work.
  • The result is about your role only. It does not say which safeguards you need, whether an event is a breach, or what a contract must say: the documents named under Next steps help with that work.
  • The Rules treat a covered entity that has not designated its health care components as one whole entity. If you are unsure whether a designation was made, find the written record before you answer RQ-11.
  • The proposed rule published at 90 FR 898 is a proposal. It is not part of the text this pack applies. Counsel confirms its status before any document is relied on.
From
HIPAA Applicability Assessment, version 1.1
Questions
11 questions · 6 possible results