The Health Insurance Portability and Accountability Act (HIPAA) Security Rule establishes national standards to protect individuals’ electronic personal health information created, received, used, or maintained by a covered entity. The Security Rule requires the proper administrative, physical and technical safeguards to make sure the confidentiality, integrity, and security of electronic protected health information.

Prior to HIPAA, no accepted set of security standards or general requirements for protecting health information existed in the health care industry. New technologies were evolving, and the health care industry moved away from paper processes and relied more on electronic information systems to pay claims, answer eligibility questions, offer health information and conduct a host of other administrative and clinical based functions. 

Today, providers are using clinical applications such as computerized physician order entry (CPOE) systems, electronic health records (EHR), and radiology, pharmacy, and laboratory systems. Health plans are providing access to claims and care management, and member self-service applications. While this means that the medical workforce can be more mobile and efficient (i.e., physicians can check patient records and test results from wherever they are), the rise in the adoption rate of these technologies increases the potential security risks.

A major goal of the Security Rule is to protect the privacy of individuals’ health information while allowing covered entities to adopt new technologies to improve the quality and efficiency of patient care. Given that the health care marketplace is diverse, the Security Rule is flexible and scalable so a covered entity can carry out policies, procedures, and technologies appropriate for the entity’s size, organizational structure, and risks to consumers’ e-PHI.