As of April 14, 2003, all hospitals transmitting electronic transactions to health plans were required to comply with the privacy rules of the Health Insurance Portability and Accountability Act (HIPAA). Generally, the HIPAA privacy rule addresses the use and disclosure of individuals’ health information (protected health information or PHI) by hospitals and other covered entities, as well as standards for individuals’ privacy rights to understand and control how their health information is used.

The final HIPAA security rule was published in the Federal Register on February 20, 2003. It is available on CMS’s webpage at http://www.cms.gov/hipaa/hipaa2/contact.