{"id":968,"date":"2020-05-14T10:55:39","date_gmt":"2020-05-14T15:55:39","guid":{"rendered":"https:\/\/it.rutgers.edu\/it-risk-policy-and-compliance\/?page_id=968"},"modified":"2025-12-04T13:29:12","modified_gmt":"2025-12-04T18:29:12","slug":"health-insurance-portability-and-accountability-act-hipaa","status":"publish","type":"page","link":"https:\/\/it.rutgers.edu\/information-security\/information-security-compliance-program\/health-insurance-portability-and-accountability-act-hipaa\/","title":{"rendered":"Health Insurance Portability and Accountability Act (HIPAA)"},"content":{"rendered":"
\n\n
\n
\n
\n\t\t\t\t
\"Stethoscope\n\t\t\t<\/div>\n <\/div>\n <\/div>\n\t\n
\n
\n
\n
\n\t\t\t\t

Health Insurance Portability and Accountability Act (HIPAA)<\/h1>\n\n<\/div>\n\t\t\t\t
<\/div>\n <\/div>\n <\/div>\n <\/div>\n<\/div>\n\n\n<\/div>\n\n <\/section>\n\n\n
\n\n
\n \n

Overview<\/strong><\/h2>\n

The Health Insurance Portability & Accountability Act of 1996 requires the institution to secure a patient\u2019s electronic protected health information (ePHI). This protection is provided by administrative, physical, and technical processes and controls. The OIT-Information Security Office is charged with assisting the University in achieving compliance with the HIPAA Security Rule.<\/p>\n

Departments involved in the electronic transmission of patient records, as well as any subcontractors, are required to be compliant with HIPAA standards which necessitates prudent security practices.<\/p>\n

The HIPAA Security Rule is intended to be scalable and does not require specific technologies to be used. Covered entities may elect solutions that are appropriate to their operations, provided the selected solutions are supported by a thorough security assessment and risk analysis.<\/p>\n

The standards for the Security Rule are grouped into five categories:<\/p>\n