Guest Contributor

Know the 5 main HIPAA rules and the most common HIPAA violations

Medical entities need to be aware of what they are legally allowed and not allowed to do when it comes to patient privacy and confidentiality. When a patient comes to a hospital or laboratory, they need to feel protected and confident in the medical staff. If the entity does not follow proper privacy regulations and compliance, it can be subjected to legal violations, hefty fines, or closures of its practices.

Let’s see how entities can provide proper educational courses to employees and employers who need to know more about confidentiality and patient privacy, and the most common violations in the medical field.

What is HIPAA and HIPAA training?

HIPAA is an important part of the healthcare field. Without this act, patients would lack privacy and their medical records could be easily stolen or shared. The HIPAA privacy rule within the HIPAA regulation focuses on protecting a patient’s health information to make sure corporations, entities, clearinghouses, and associates use the proper methods to store and secure private health information.

The original purpose of HIPAA, which stands for Health Insurance Portability and Accountability, was to ensure health coverage for those who were fired from their job or left their work for certain circumstances. Since its inception in the mid-1990s, HIPAA has expanded to cover much more in the healthcare world.

HIPAA regulations are enforced by the Office of Civil Rights within the HHS department of the government, with enforcement strictly followed by this organization who set forth over $2million to entities not complying with the rules.

What is HIPAA training?

Individuals and corporations can take HIPAA training online or in person, depending on their business. There are various courses offered online at the HIPAA website, ensuring everyone is aware of the various rules within the HIPAA scope. There are different course options, such as HIPAA for business associates, HIPAA and OSHA bloodborne pathogens bundle, and other specific courses.

The HIPAA training course usually relates to providing those in the healthcare sector, such as positions with medical billing, transcription, software companies, IT workers, answering services, marketing agencies, cleaning personnel, or legal service administrative staff, to benefit from learning about the HIPAA privacy rule, HIPAA security rule, HIPAA enforcement rule, HITECH Act, and the Omnibus and Final Rules.

3 main HIPAA rules that show why you need HIPAA training

Now that you know HIPAA is an important part of the medical field that relates to patient privacy and release of information, we need to know the main HIPAA rules that relate to compliance, the rules of the legal system, and the protocols in the healthcare industry.

Privacy rule The first HIPAA rule is the privacy rule, which protects the medical records of individuals. This rule states that there are only certain instances and conditions that permit professionals to disclose information, with almost all instances requiring patient approval before disclosing private medical information.

The privacy rule gives every patient who seeks medical attention the right to obtain a copy of their medical records, whether it be for surgery, medications, check-up visits, or procedures done. Patients also have the ability to request changes to their files if the information is not accurate or correct.

Along with the privacy rule, there is specific paperwork that goes together with this HIPAA rule: the Notice of Privacy Practices, Request for Accounting Disclosures Form, Authorization for Use or Disclosure Form, Privacy Complaint Form, and Requires of Access to Public Health Information.

All of this paperwork directly coincides with the privacy rule regarding the HIPAA privacy policy.

Security rule

The security rule focuses on transactions used in HIPAA procedures, with each transaction having specific codes that are needed to ensure each procedure and patient is correctly documented. The inclusion of codes in HIPAA privacy makes sure that every patient and visit contains safe, accurate, and secure filing of medical records and private information.

Further, the security rule establishes a national standard that is designed to protect a person’s health information that is used or stored by an entity. The security rule states that the organization holding the records, whether it be a hospital or laboratory, needs to take the proper security and preventative measures to safeguard the information, such as including administrative and technical safeguards to ensure confidentiality.

Identifiers rule The Identifiers rule deals with the three HIPAA identifiers that can help categorize and classify entities, such as organizations or hospitals, that use HIPAA administrative transactions. The three identifiers used by HIPAA include:

  • National Health Plan identifier – This identifier is a 10-digit code that helps organize the healthcare providers in every financial transaction, giving each facility a code to prevent confusion
  • National provider identifier – This identifier is mainly used to organize health plans and payers for medical procedures.
    • This identifier, also known as the NPI, must be used in all HIPAA transactions.
  • Standard Unique employer identifier – This final identifier uses an employer involved in HIPAA transactions to help categorize and classify each organization by using an employer identification number.
    • This employer identification number, also known as the EIN, is a number used during tax season with taxpayers who owe money to the IRS.
    • An EIN number must be used with all HIPAA transactions.

Enforcement rule

The enforcement rule is a subset of the HITECH ACT that deals with compliance and previous violations of the HIPAA rules. The HIPAA privacy and security rules have been further enhanced by the enforcement rule, a method by which entities and organizations involved in wrongdoing are punished.

The enforcement rule increased the penalties, whether legal or monetary, for any violations of HIPAA privacy laws in the healthcare field. There are a few main areas that businesses must follow when it comes to enforcement and HIPAA privacy:

  • Establishing mandatory privacy reporting requirements – employers need to make it
  • necessary for workers to report any safety attacks or security breaches that could
  • leak patient information
  • HIPAA privacy and security requirements must be met by all entities
  • Creation of new privacy requirements
  • Disclosure requirements for accounting
  • Establish new criminal and civil penalties
  • Enforcement methods for non-HIPAA protocol by entities
  • All new security measures must be used

5 most common HIPAA violations

As a patient in a healthcare setting, like a hospital or laboratory, you want to feel safe and protected. However you should be aware of the 5 most common HIPAA violations that occur with various entities in the healthcare or legal world.

Spying on healthcare records

If you know a healthcare worker or administrative assistant who looked at the records of a patient they were unauthorized to see, this is a direct HIPAA violation that can lead to immediate legal acts. Accessing the health records of patients for any reason other than those permitted by the HIPAA privacy rule is a violation.

Spying on records of people you know, family members, friends, or just out of curiosity can get you immediately fired from your job. Financial penalties for healthcare entities that have failed to prevent spying on healthcare records or safeguard patient files are possible, as various health systems have been fined for failure to prevent access to medical records.

Failure to perform risk analysis

A second common HIPAA violation in the healthcare world is the failure to carry out a wide- scale risk analysis for your company. If the risk analysis is not widespread or comprehensive to the company as a whole, the organization cannot determine vulnerabilities and weak spots to the business, seeing where a potential security breach could occur.

There have been various settlements throughout the years with big health corporations, such as Oregon Health and Science University, Caridonet, Cancer Care Group, Premera Blue Cross, Excellus Health Plan, and Lahey Hospital.

Denying patients access to records

The HIPAA privacy rule states that all patients need access to their healthcare records, get copies for their own personal use, and request changes to their records if they are inaccurate. Denying patients copies of healthcare records is a direct violation to the HIPAA privacy policies, with multiple organizations being fined in recent years due to denying patients access to their records or being exceptionally long when providing access, such as:

  • Banner Health was fined $2,000 for a delayed response
  • Beth Israel Lahey Health Behavioral Sciences was fined $70,000 for a delayed response to a patient’s request
  • Housing Works Inc was fined $38,000
  • Cignet Health was fined $43,000 for denying a patient access to their records

Failure to enter HIPAA agreement

One of the other most common HIPAA violations in terms of healthcare entities is the failure to enter an associate agreement with vendors that need access to personal health information. If a business negotiates terms and comes up with a contract that is applicable to all vendors, the agreed-upon terms may still not be HIPAA compliant according to the five HIPAA rules.

Some settlements that included a violation of this HIPAA rule included:

  • Raleigh Orthopaedic Clinic paid a $750,000 settlement for failure to exact a business agreement
  • Care New England Health system had to pay $400,000 for the failure to update a business agreement

The fifth most common HIPAA violation includes the violation of privacy by giving healthcare information to another entity or person without consent by the patient. Any disclosure of protected information that is not permissible under the privacy rule is a direct breach of HIPAA policies, including disclosing information to an employer, disclosing information without any need, and not adhering to the standard of disclosure policies.


As you can see, undergoing proper HIPAA training for all employers and employees in a healthcare setting is necessary to avoid breaching one of the three main HIPAA rules. By following and adhering to the regulations set forth in the privacy rule, enforcement rule, security rule, entities can avoid doing one of the five most common HIPAA violations.


World of Medical Saviours (WOMS) is a website formed by a group of medicos who are embarking to provide facts, tips and knowledge related to health and lifestyle. This website proves to be a great platform for the medical enthusiast and also for those medicos searching to outgrowth their knowledge about the medical field.

Related Articles

Back to top button