Medical Management Associates, Inc. has worked closely with our clients to keep them aware of changes in the federal and state regulations that will affect the day-to-day operation of their organizations. We have been especially involved with assisting our clients to create and maintain compliance with regulations involving claims submission and reimbursement.
HIPAA compliance will be a constantly evolving process. Therefore, this site will also evolve to add updates, links and MMA created forms, assessment tools and manuals.
Please contact us if you would like MMA to help you with your staff training, a HIPAA awareness program for your practice or to perform an onsite assessment of your current level of compliance.
HIPAA Privacy & Security
The Privacy and Security Rules apply only to covered entities. Individuals, organizations, and agencies that meet the definition of a covered entity under HIPAA must comply with the Rules' requirements to protect the privacy and security of health information and must provide individuals with certain rights with respect to their health information. If an entity is not a covered entity, it does not have to comply with the Privacy Rule or the Security Rule.
A Covered Entity is one of the following
|A Health Care Provider*
||A Health Plan
||A Health Care Clearinghouse
This includes providers such as:
- Nursing Homes
*But only if they transmit information in an electronic form in connection with a transaction for which HHS has adopted a standard.
- Health insurance Companies
- Company health plans
- Government programs that pay for health care, such as Medicare, Medicaid, and the military and veterans health care programs
This includes entities that process nonstandard health information they receive from another entity into a standard (i.e., standard electronic format or data content), or vice versa.
Are you a Covered Entity?
View and easy-to-use question and answer decision tool from HHS.
Guidance Materials for Small Providers, Small Health Plans, and other Small Businesses
View materials about the Privacy Rule for small providers, small health plans and other small businesses.
Guidance Materials for Covered Entities
- Summary of the Privacy Rule-This is a summary of the key elements of the Privacy Rule, including who is covered, what information is protected, and how covered entities can use and disclose protected health information.
- Guidance on Significant Aspects of the Privacy Rule-A collection of documents explaining many provisions of the Privacy Rule including business associates, special topics such as disclosures for public health and research, and incidental uses and disclosures.
- Summary of the Security Rule-This is a summary of the key elements of the Security Rule, including what administrative, physical, and technical safeguards covered entities must have in place to protect the security of electronic protected health information.
- Guidance on How to Comply with the Security Rule-A collection of documents explaining how the Department expects covered entities to achieve substantial compliance with the Security Rule.
- Security Risks to Electronic Health Information from Peer-to-Peer File Sharing Applications-The Federal Trade Commission (FTC) has developed a guide to Peer-to-Peer (P2P) security issues for businesses that collect and store sensitive information.
- Safeguarding Electronic Protected Health Information on Digital Copiers-The Federal Trade Commission (FTC) has tips on how to safeguard sensitive data stored on the hard drives of digital copiers.
- Fast Facts for Covered Entities-Answers to many common questions and misconceptions about patient consent, incidental disclosures, child abuse reporting, electronic media, and other disclosures.
- Provider Guide: Communicating With a Patient's Family, Friends, or Other Persons Identified by the Patient-This is a guide for health care providers to help them determine when they can disclose a patient's health information to the patient's family, friends, or other identified by the patient.
- Guidance on the Application of FERPA and HIPAA to Student Health Records-This guide addresses school administrators, health care professionals, and others interested in how these two laws apply to student health records.
- Frequently Asked Questions About Family Medical History Information-These frequently asked questions and answers address how the Privacy Rule permits the use and disclosure of family medical history information.
- Frequently Asked Questions About the Disposal of Protected Health Information-These frequently asked questions and answers address how covered entities should dispose of protected health information pursuant to the Privacy and Security Rules.
- Sign Up for the OCR Privacy Listserv-OCR has established a listserv to inform the public about Privacy and Security Rule FAQs, guidance, and technical assistance materials as they are released.
Overview: The American Recovery and Reinvestment Act of 2009, in Section 13411 of the HITECH Act, requires HHS to provide for periodic audits to ensure covered entities and business associates are complying with the HIPAA Privacy and Security Rules and Breach Notification standards. To implement this mandate, OCR is piloting a program to perform up to 150 audits of covered entities to assess privacy and security compliance. Audits conducted during the pilot phase will begin November 2011 and conclude by December 2012.
Links to HIPAA Regulations, Guidances & Updates
For additional information, please contact:
Copyright 2014 Medical Management Associates, Inc. All Rights Reserved.