HIPAA & the Legal Implications of Insurance Companies

by Jack Gordon
Insurance companies must control access to clients' records in order to be compliant with the physical safeguard section of HIPAA's privacy rule.


Hemera Technologies/AbleStock.com/Getty Images

The Health Insurance Portability and Accountability Act, or HIPAA, is designed to improve the portability and continuity of health insurance coverage and further aims to protect the privacy of an individual's medical information. As a small-business owner, you have to observe HIPAA privacy guidelines with regard to how you manage healthcare as well as store and share information about employee health. Further, HIPAA stipulates that one can't be denied insurance due to his medical history -- if he qualifies, any insurance company that sells individual plans must offer him health insurance.

Basis for HIPAA

HIPAA was passed by the U.S. Congress on Aug. 21, 1996, with the objective of improving the portability and continuity of healthcare coverage, in both group and individual markets. Further, the Act sought to simplify the administration of health insurance as well as combat waste, fraud and abuse in health insurance. Regarding privacy and security of health records, the Act aims to protect and enhance the rights of patients by controlling the inappropriate use or disclosure of their medical information. To stay in compliance with HIPAA, your business must keep detailed logs regarding any medical data that is transferred, released or shared.

HIPAA Privacy Rule

The HIPAA Privacy Rule establishes a set of national standards that address the use and disclosure of individuals’ health information. Given that the healthcare marketplace is diverse, the Rule aims to assure the protection of individuals’ medical information while allowing the flow of this information between your small business, healthcare providers, clearinghouses that transmit the information in electronic format and insurance companies that provide health plans. Any of these entities violating patients' privacy rights can face civil and criminal penalties, with maximum penalties of $50,000 per violation and an annual maximum of $1.5 million.

Pre-Existing Conditions

HIPAA protects any of your employees who has a pre-existing condition and ensures he can get health coverage. HIPAA stipulates that any group health plan can only look back six months for a condition that was present prior to starting one's insurance coverage. This means that a pre-existing condition exclusion should be imposed only if treatment, diagnosis, medical advice or care was received during the six months prior to one's enrollment. In addition, the Act prohibits insurance companies from applying the pre-existing condition exclusion to genetic information and pregnancy.

HIPAA Limitations

Although HIPAA makes it easier for your employees to switch employers while retaining health coverage for a pre-existing condition, it has some limitations. HIPAA does not require employers to offer health insurance coverage. The Act does not guarantee that any conditions an employee currently has or has had in the past will be covered by his new employer's health plan. HIPAA also does not prohibit employers from imposing a pre-existing condition exclusion period, especially if an employee has received treatment for a condition during the past six months.

About the Author


Photo Credits

  • Hemera Technologies/AbleStock.com/Getty Images
Suggest an Article Correction