I work for a professional liability insurance company that specializes in medical malpractice. Often the claims we handle involve health information about patients of our policyholders (providers such as doctors or dentists). We enter some basic claim information in our database for internal use, but we do not transmit this information electronically to others outside our company. Will we need to comply with the HIPAA regulations? If so, can you recommend resources that can help us determine exactly the extent that we will be affected by HIPAA?
The definitions at 45 CFR 160.103 apply to all the HIPAA administrative simplification regulations. A professional liability insurance company does not meet the definition of a health plan, health care clearinghouse, or health care provider, and therefore is not a covered entity that is directly regulated under the HIPAA administrative simplification regulations. The malpractice claim information that is stored in the company database for internal use does not meet the definition of a health care claim as set forth in 45 CFR 162.1101. The professional liability insurance company described in this question would not be regulated by the final regulation on Standards for Electronic Transactions published in the Federal Register on August 17, 2000.
Since the professional liability insurance company does maintain health information as defined in 45 CFR 160.103, and since the source of the health information would generally be a covered entity (a health care provider or health plan), it is possible that the final HIPAA regulations on standards for privacy and security of health information, when they are adopted, will have an effect on the professional liability insurance company's protection of the health information or on its disclosure of the information to other entities, such as a malpractice law firm. The final regulations on privacy and security and accompanying Frequently Asked Questions will be posted at http://aspe.hhs.gov/admnsimp/ when the regulations are published in the Federal Register.