Health Insurance Portability and Accountability Act

The Health Insurance Portability and Accountability Act of 1996 (HIPAA or the Kennedy–Kassebaum Act) is a United States Act of Congress enacted by the 104th United States Congress and signed into law by President Bill Clinton on August 21, 1996. It aimed to alter the transfer of healthcare information and stipulated guidelines by which personally identifiable information maintained by the healthcare and healthcare insurance industries should be protected from fraud and theft, and addressed some limitations on healthcare insurance coverage. It generally prohibits healthcare providers and businesses called covered entities from disclosing protected information to anyone other than a patient and the patient's authorized representatives without their consent. The law does not restrict patients from accessing their own information, except in limited cases. Furthermore, it does not prohibit patients from voluntarily sharing their health information however they choose, nor does it require confidentiality where a patient discloses medical information to family members, friends, or other individuals not employees of a covered entity.

The act consists of five titles:

There are five sections to the act, known as titles.

Title I of HIPAA regulates the availability and breadth of group health plans and certain individual health insurance policies. It amended the Employee Retirement Income Security Act, the Public Health Service Act, and the Internal Revenue Code. Title I also addresses the issue of "job lock," where employees remain in a job to avoid losing health coverage. To combat the job lock issue, the Title protects health insurance coverage for workers and their families if they lose or change their jobs.

Title I requires the coverage of and limits restrictions that a group health plan can place on benefits for preexisting conditions. Group health plans may refuse to provide benefits in relation to preexisting conditions for either 12 months following enrollment in the plan or 18 months in the case of late enrollment. Title I allows individuals to reduce the exclusion period by the amount of time they have had "creditable coverage" before enrolling in the plan and after any "significant breaks" in coverage. "Creditable coverage" includes nearly all group and individual health plans, Medicare, and Medicaid. A "significant break" in coverage is defined as any 63-day period without any creditable coverage. Along with an exception, it allows employers to tie premiums or co-payments to tobacco use or body mass index (BMI).

Title I mandates that insurance providers issue policies without exclusions to individuals leaving group health plans, provided they have maintained continuous, creditable coverage (see above) exceeding 18 months, and renew individual policies for as long as they are offered or provide alternatives to discontinued plans for as long as the insurer stays in the market without exclusion regardless of health condition.

Some health care plans are exempted from Title I requirements, such as long-term health plans and limited-scope plans like dental or vision plans offered separately from the general health plan. However, if such benefits are part of the general health plan, then HIPAA still applies to such benefits. For example, if the new plan offers dental benefits, then creditable continuous coverage under the old health plan must be counted towards any of its exclusion periods for dental benefits.

An alternate method of calculating creditable continuous coverage is available to the health plan under Title I. 5 categories of health coverage can be considered separately, including dental and vision coverage. Anything not under those 5 categories must use the general calculation (e.g., the beneficiary may be counted with 18 months of general coverage but only 6 months of dental coverage because the beneficiary did not have a general health plan that covered dental until 6 months prior to the application date). Since limited-coverage plans are exempt from HIPAA requirements, the odd case exists in which the applicant to a general group health plan cannot obtain certificates of creditable continuous coverage for independent limited-scope plans, such as dental, to apply towards exclusion periods of the new plan that does include those coverages.