Risk Management Nur/492 April 1, 2013 Kendra Slatton, RN, MSN, CDE

In 1996, the United States Congress enacted the Health Insurance Portability and Accountability Act (HIPAA) into law. The purpose of the law was to focus on providing greater access to health care for Americans and to address administrative activities regarding claims submissions to insurance carriers (American Medical Association, 2011). Along with streamlining the administrative process, HIPAA also guarantees patient privacy and has strict guidelines regarding how organizations can disclose a patient’s protected health information (American Medical Association, 2011). The Department of Health and Human Services promises to impose steep fines to those organizations that do not follow the HIPAA guidelines. Although many of the guidelines they are referring to have more to do with billing and coding procedures, patients’ privacy is also very important. Many facilities have educated staff extensively on the issues surrounding patient privacy. Prior to 1996, a patient’s family member could call a hospital and request the medical status of his or her loved one who was hospitalized. Currently, the patient must give express consent as to whom the staff may and may not speak with regarding their care. The rule has become to not only refrain from giving any information, but they cannot even confirm or deny a patient’s admission status. The various elements in the HIPAA guidelines are daunting. Seemingly innocuous actions are now cause for concern. There have been several institutions, which have been cited for HIPAA privacy violations. The management at Richmond Surgical GPS PC (RichSurg) have taken cues from other institutions in identifying its own potential privacy