The HIPAA conundrum in the era of mobile health and communications

摘要

In January 2013. the US Department of Health and Human Services released the Omnibus Final Rule (Final Rule).1 The final rule significantly modified the privacy and security standards under the Health Insurance Portability and Accountability Act (HIPAA). These new regulations were driven by a perceived need to ensure the confidentiality, integrity, and security of patients' protected health information (PHI) in electronic health records (EHRs) and other formats. The final rule addresses these concerns by expanding the scope of regulations and increasing penalties for PHI violations. The final rule was mandated by the $25.9 billion Health Information Technology for Economics and Clinical Health (HITECH) Act, which aimed to encourage the development of interoperable health informa-tion technology (HIT) and health information exchanges.2 The final rule redefined which organizations would be covered under HIPAA. Originally, HIPAA only applied to "covered entities," which include "health care providers who conduct health care transactions electronically, health plans and health care industry. Although there is much interest in potential partnerships between innovative companies and health care organizations to leverage new mobile technologies (eg, smartphones, tablets, mobile monitors), the final rule may impose an unfunded mandate for organizations, which ironically may impede adoption of innovation in mobile health.