Overview

Congress recognized the importance of protecting people’s medical records when it passed the Health Insurance Portability and Accountability Act of 1996 (HIPAA). HIPAA requires the Secretary of the U.S. Department of Health and Human Services (HHS) to issue regulations if Congress failed to enact comprehensive privacy legislation. HHS issued a landmark federal health privacy regulation in December 2000. Health care entities have until April 2003 to implement the new rule. While this regulation is an important step toward boosting the public trust and confidence in our nation’s health care system, its application is limited. Due to constraints on the Department’s rulemaking authority, the regulation does not cover a significant portion of the health-related activities that take place online. This report was issued jointly by the Pew Internet Project and the Health Privacy Project of the Institute for Health Care Policy and Research at Georgetown University.