The Health Insurance Portability and Accountability Act (HIPAA), enacted into law 13 years ago in 1996, remains in force. Within 18 months of the regulations being enacted, the U.S. Secretary for Health & Human Services adopted a set of standards from those already approved by private standards developing organizations.

These were for certain electronic health transactions including claims, enrollment, eligibility, payment, and coordination of benefits. The most relevant administrative provisions were (and still are):

A mandate on providers and health plans, with a strict timetable. According to this mandate, providers and health plans are required to use the standards for the specified electronic transactions now that they have been adopted. Plans and providers may comply directly, or may use a health care clearinghouse. Certain health plans, in particular workers compensation, are not covered.

Privacy. The HHS Secretary recommended privacy standards for health information to Congress. These remain in effect.

Preemption of state law. The bill supersedes state laws, except where the Secretary determines that the state law is necessary to prevent fraud and abuse, to ensure appropriate state regulation of insurance or health plans, addresses controlled substances, or for other purposes. Privacy regulations do not preempt state laws that impose more stringent requirements. These provisions do not limit a state’s ability to require health plan reporting or audits.

Penalties. The bill imposes civil financial penalties and prison for certain violations.

That’s the bad news. The good news is that certain applications of electronic medical records software have evolved to the point where compliance with HIPAA regulations has been made much easier. Certain features of these relevant software modules can often identify situations where methodology relief exists. Conclusions can be drawn, privacy concerns can be met, and even encryption of scripts is available in some instances.