Why You Need Data Classification For HIPAA Compliance

The Health Insurance Portability and Accountability Act (HIPAA) of 1996 introduced national standards in the United States for the handling of electronic health care data. HIPAA was designed to address systemic inefficiencies and increase the effectiveness of the US health care system through the establishment of policy, standards and requirements addressing the electronic transmission of Personal Health Information (PHI).

By doing so, fraud, waste and abuse could be identified and corrective actions undertaken. To mitigate this risk, Congress introduced Federal privacy protection standards into HIPAA. Over subsequent years, the Privacy Rule, Security Rule, Enforcement Rule and then final Omnibus rule including Breach Notification Rules were introduced. These rules mandate standards of handling and protection for individually identifiable health information; PHI.

HIPAA defines health information as any information, whether oral or recorded in any form or medium that is created or received by a health care provider, health plan, public health authority, employer, life insurer, school or university, or health care clearinghouse that relates to the past, present, or future physical or mental health or condition of an individual. This includes the provision for an individual’s past, present, or future payment for health care. Examples would include name, address, date of birth or social security number. 

Electronic Protected Health Information (ePHI) includes any individually identifiable health information, where identifiable” refers not only to data explicitly linked to a particular individual (identified information), but also includes health information with data items that could reasonably be expected to allow individual identification.