The Health Insurance Portability and Accountability Act (HIPAA) doesn't just apply to health care institutions and medical professionals. Any business storing information regarding employee's health is legally required to adhere to HIPAA regulations.
Even small businesses will usually offer their employees health care. Any information that relates to this is covered by HIPAA guidelines. There are potential fines and other punishments for breaching HIPAA guidelines for non-compliance. These can be fatal for small businesses, especially in the case of a serious breach. It is, therefore, of paramount importance that the average business owner understands their obligations under HIPAA.
Training and Awareness
As always, employers are ultimately responsible for everything that happens on their watch. Employees are the ones that will have to ensure compliance with HIPAA on a day to day business. In the smallest businesses, the owner might be able to oversee HIPAA compliance themselves, but as a business grows, this will become impractical.
Anyone within a business who will handle personal health-related information, for example, the medical insurance information we mentioned earlier, must be trained to comply with HIPAA guidelines. If a business fails to train its staff appropriately, and there is a subsequent breach of HIPAA guidelines, then the business can be held liable. If this occurs, then the ensuing legal action could have dire consequences.
Storage and Security
When it comes to storing any medical-related employee information, businesses have an obligation to protect that information with both physical and digital security. Only employees who have been authorized and trained to handle information that is covered by HIPAA should ever be able to access that information.
For businesses who hold a significant amount of personal medical information, it is worth investing in hiring someone with a deep understanding of health information management. You can either hire a candidate with the appropriate qualifications, or you can enroll a staff member in an online degree course. These online courses in health information management are offered by a number of leading universities. The University of Cincinnati, for example, has its online branch - University of Cincinnati Online.
Employee Illness and Absences
Under HIPAA, businesses have an obligation to protect any information that they have regarding their employee’s health status. Unless the business is given explicit permission by the patient to inform any other parties, then they must keep the information confidential. As a result, when employees are ill, the business can inform other staff members of the absence. However, they must not disclose any details about their specific condition unless authorized to do so.
Company Policies
The best way of ensuring compliance with HIPAA throughout your business is to institute a rigorous training routine. Devise company-wide policies that will ensure that there aren't any opportunities for lapses to occur. You want to introduce as many checks and balances as you can. Of course, you don't want to introduce policies which end up being counterproductive. It is worth consulting with someone who has a health information management degree for their input.
HIPAA is one of the most significant pieces of legislation for protecting workers' privacy. Businesses have a responsibility to ensure that they adhere fully to the guidelines HIPAA sets.