View Rule

Statement of Need: The Administrative Simplification provisions of the Health Insurance Portability and Accountability Act (HIPAA) of 1966 required the Department to adopt standards for security. Currently, no standard measures exist in the health care industry that address all aspects of the security of electronic health information while it is being stored or transmitted between entities. The use of the security standards will improve the Medicare and Medicaid programs, and other Federal health programs and private health programs, and the effectiveness and efficiency of the health care industry in general by establishing a level of protection for certain electronic health information.

Summary of the Legal Basis: This final rule implements some of the requirements of the Administrative Simplification subtitle of HIPAA.

Alternatives: Existing security standards do not encompass all the requirements set forth in the law.

Anticipated Costs and Benefits: Although we cannot determine the specific economic impact of the standards in this final rule (and individually each standard may not have a significant impact), we are unable to estimate the cost of implementing the security standards as implementation needs will vary dependent upon each entity's risk assessment and upon what is already in place. In addition, it is important to recognize that security is not a one-time project, but rather an on-going, dynamic process. However, the overall impact analysis makes clear that, collectively, all the HIPAA standards will have a significant impact of over $100 million on the economy. We believe that the overall Administrative Simplification costs will be offset by future savings. Implementation of the security standards will provide confidentiality, integrity and availability protections to certain personaly identifiable health information. The synergistic effect of the employment of the security standards will also enhance all aspects of HIPAA's Administrative Simplification requirements.

Risks: The security of electronic protected health information is, and has been for some time, a basic business requirement that health care entities ignore at their peril. Instances of "hacking" and other security violations may be widely publicized, and can seriously damage an institution's community standing. Appropriate security protections are crucial for encouraging the growth and use of electronic data interchange.