HIPAA History: Public Law No. 104-191 (Aug. 21, 1996)


On August 21, 1996, the United States Congress enacted the Health Insurance Portability and Accountability Act (“HIPAA”), now codified at 42 USC § 201 et seq. (42 U.S.C. 1320d-2). HIPAA Administrative Simplification is divided into three key standards: Code sets, Privacy, and Security. Each of the above standards has its own implementation date: Code sets (10-16-02), Privacy (4-16-03), & Security (4-21-05). OJA will make every reasonable effort to be compliant with these key standards by the assigned date or will request an extension when possible.


The Office of Juvenile Affairs is a covered entity required to conform with HIPAA guidelines for two reasons:

1) The agency bills under Title XIX electronically; and

2) pursuant to HIPAA standards, OJA is considered to be a health care provider.


Full HIPAA regulations can be found in the Code of Federal Regulations (CFR) Title 45 – Public Welfare Subtitle A Department of Health and Human Services, Subchapter C  Administrative data requirements, Part 160 - General Administrative requirements, & Part 162, and Part 164. (45 CFR § 160, 162 & 164 link)





All Definitions provided are according to HIPAA regulations and should not be generalized to other federal or state mandates or laws.



1.   Allows use/disclosure of protected health information (PHI) for purposes beyond treatment, payment, or health care operations (T.P.O.).

2.   A form to release information other than TPO.  It must be signed by the individual and their personal representative and must be specific to each request for information.  The form must identify the person or group who will be authorized to receive the information.


Business Associate (BA):  A person or organization that performs a function or activity on behalf of the covered entity but is not part of the covered entity’s workforce.  A business associate can also be a covered entity in its own right, (See Part II 45 CFR §160.103).


Consent:  Allows a provider to use/disclose PHI for Treatment, payment, or health care operations (T.P.O.).


Correctional Institutions:  Any penal or correctional facility, jail, reformatory, detention center, work farm, halfway house, or residential community program center operated by, or under contract to, the United States, a state, a territory, a political subdivision of a state or territory, or an Indian tribe, for the confinement or rehabilitation of a person charged with or convicted of a criminal offense or other persons held in lawful custody. Other persons held in lawful custody include juvenile offenders adjudicated delinquent, aliens detained awaiting deportation, persons committed to mental institutions through the criminal justice system, witnesses, or others awaiting charges or trial. (45 CFR §164.501)


Covered Entity (CE): A health plan, a health care clearinghouse, or a health care provider who transmits any health information in electronic form in connection with a HIPAA transaction (45 CFR §160.103).


Disclosure:  When one entity or agency provides PHI to another entity or agency.


Health Care Operations: Conducting quality assessment and improvement activities, reviewing competence or qualifications of health care professionals, business planning and development, business management activities, and resolution of internal grievances. (45 CFR §164.501)


Health Information: Any information whether oral or recorded in any form or medium that:

1.               Is created or received by a health care provider, health plan, public health authority, employer, life insurer, school or university, or health care clearinghouse; and


2.   Relates to the past, present, or future physical or mental health or condition of an individual; the provision of health care to an individual; or the past, present, or future payment for the provision of health care to an individual. (45 CFR §160.103)



Health plan: An individual or group plan that provides, or pays the cost of, medical care (as defined in section 2791(a)(2) of the PHS Act, 42 USC 300gg-91(a)2)). (45 CFR §160.103)

1.               Health plan includes the following, singly or in combination:

a.               A group health plan, health insurance issuer, or a HMO.

b.               Part A or B of the Medicare program under

     Title XVIII or the Act.

c.               The Medicaid program under Title XIX of the Act, 42 U.S.C. 1396, et seq.

d.               An issuer of a Medicare supplemental policy (as defined in section 1882(g)(1) of the Act, 42 U.S.C. 1395ss(g)(1).

e.               An employee welfare benefit plan or any other arrangement that is established or maintained for the purpose of offering or providing health benefits to the employees of two or more employers.

f.               The Indian Health Service program under Indian Health Care Improvement Act, 25 USC 1601, et seq.

g.               An approved state, child health plan under Title XIX of the Act, providing benefits for child health assistance that meet the requirements of section 2103 of the Act, 42 USC 1397, et seq.

h.               Any other individual or group plan, or combination of individual or group plans, that provides or pays for the cost of medical care (as defined in section 2791(a)(2) of the PHS Act, 42 USC 300gg-91(a)(2)).



Inmate:  A person incarcerated in or otherwise confined to a correctional institution. (45 CFR §164.501)


Individually identifiable health information: Information that is a subset of health information, including demographic information collected from an individual. It is information that is created or received by a covered entity and relates to the past, present, or future physical or mental health or condition of an individual; the provision of health care to an individual; or the past, present, or future payment for the provision of health care to an individual. This is information that identifies the individual or with respect to which there is a reasonable basis to believe the information can be used to identify the individual. (45 CFR §160.103)


Minimum Necessary: 

1.   A standard that provides the individual, entity or agency requesting information only what he or she is asking for and not any more. 

2.   The principle that, to the extent practical, individually identifiable health information should only be disclosed to the extent needed to support the purpose of the disclosure. (45 CFR §164.502)


Marketing:  To make a communication about a product or service a purpose of which is to encourage recipients of the communication to purchase or use the product or services.  It does not include communications made by a health care provider to an individual as part of the treatment of that individual. (45 CFR §164.501)


Personal Representative:  An individual who has assumed the care of a minor or an adult, or may have the authority to act on behalf of a deceased individual or his or her estate. (45 CFR §164.502 (G))


Protected Health Information (PHI): means individually identifiable health information. What makes information “Individually- identifiable”? Examples of PHI are a patient’s name, date of birth, address, telephone number, social security number, employers, names of relatives and employers, fax number, e-mail address, medical record numbers, member or account numbers, certificate numbers, fingerprints, photographic images, codes, voiceprints, and any other characteristics, such as occupation, that might be unique in certain populations. (45 CFR §164.501)


Privacy Notice: explains to the clients how their health information will be treated and protected. It explains the Patient’s Rights as set forth in HIPAA. (45 CFR §164.520)


Psychotherapy Notes:  Notes recorded (in any medium) by a health care provider who is a mental health professional documenting and analyzing the contents of conversations during a private counseling session or a group, joint, or family counseling session and that are separated from the rest of the individual’s medical record. (See also 45 CFR §164.501)


Research: A systematic investigation, including research development, testing and evaluation, designed to develop or contribute to generalized knowledge. (45 CFR §164.501)


Treatment: The provision, coordination, or management of health care and related services by one or more health care providers. This includes the coordination or management of health care by a health care provider with a third party; consultation between health care provider’s relating to a patient; or the referral of a patient for health care from one health care provider to another.


T.P.O: Treatment, Payment, and Health Care Operations.


Use:  With respect to individually identifiable health information, the sharing, employment, application, utilization, examination, or analysis of such information within an entity that maintains such information.  (45 CFR §164.501)