In 1996 Congress gave itself three years to pass legislation, stipulating that if it failed the Department of Health and Human Services could write the regulations. After the Congressional deadline passed, HHS developed its own regulations. The final rule protects all the records of any doctor or hospital that files insurance claims electronically. Patients also gained the right to inspect and request corrections to their records. In addition, employers will be barred from perusing medical information about their workers unless it's directly related to providing health care.
Violators face civil and criminal fines and, in severe cases, prison.
In a change won by industry, the administration deleted a provision that could have opened the door for patients to sue if their records were improperly released. Law enforcement agencies could obtain access to records with an administrative subpoena or summons, but they would not have to go to court, as advocates would have liked. All health care organizations must comply with these regulations. In addressing health information security, the Health Care Financing Administration established security requirements in four categories with a heavy emphasis on administrative procedure safeguards. The flexible nature of the regulations enables organizations to balance enhanced security, availability and costs.