A comprehensive list of federal agencies that must be HIPAA compliant

HIPAA compliance is often discussed in the context of covered entities like healthcare providers and insurance companies but many federal agencies must also safeguard protected health information (PHI).

Federal agencies and HIPAA compliance

The Health Insurance Portability and Accountability Act (HIPAA) mandates that federal agencies who handle PHI must protect the privacy and security of individuals' health information. 

HIPAA compliance involves using secure communication platforms, like Paubox, which offers advanced security measures, including encryption, access controls, and two-factor authentication.

Moreover, failure to comply with HIPAA regulations can result in costly fines, penalties, and reputational damage for federal agencies.

Read also: HIPAA and the Federal Civil Penalties Adjustment Act Improvements Act

Federal agencies bound by HIPAA

Centers for Medicare & Medicaid Services (CMS)

The CMS administers Medicare and Medicaid programs, processing extensive health information. Like, when a healthcare provider submits a claim for a Medicare patient, CMS must handle and protect the patient’s medical records and billing information according to HIPAA regulations. 

HIPAA compliant forms can speed up their billing and reimbursement processes while collecting the necessary information accurately and securely. 

Department of Veterans Affairs (VA)

The Department of Veterans Affairs (VA) operates many healthcare facilities for veterans and their families. When a veteran receives medical care at a VA facility, their medical records and treatment plans are protected under HIPAA regulations. 

So, the VA must use HIPAA compliant email solutions, like Paubox, to enhance patient care, improve patient and provider satisfaction, and reduce overall healthcare costs.

Department of Defense (DoD)

The DoD, through its TRICARE program, offers healthcare services to military personnel and their families. The program must be managed according to HIPAA requirements.

For example, HIPAA compliant emails can provide holistic support to veterans with PTSD. These emails can be tailored to different psychotherapy techniques and treatment plans, allowing therapists to deliver personalized and effective interventions remotely.

Indian Health Service (IHS)

The IHS provides healthcare to American Indian and Alaska Native populations, and HIPAA mandates the protection of all health information. HIPAA compliant emails allow these providers to create inclusive marketing campaigns that uphold the principles of the Navigator program, promoting healthcare access to underserved populations.

Social Security Administration (SSA)

The SSA processes disability claims and reviews medical records to determine the applicant’s eligibility. Therefore, the SSA must protect the privacy of applicants' health information when processing these claims.

If the SSA requests medical records from the applicant’s healthcare provider, they must use a HIPAA compliant email which encrypts the PHI and prevents unauthorized access to sensitive medical details.

Centers for Disease Control and Prevention (CDC)

The CDC “serves as the national focus for developing and applying disease prevention and control, environmental health, and health promotion and education activities designed to improve the health of the people of the United States.”

During an infectious disease outbreak, the CDC can collect health data from hospitals using HIPAA compliant forms, analyzing the data to track the spread of disease while preventing unauthorized access, so PHI is only used for public health purposes.

National Institutes of Health (NIH)

The NIH conducts medical and behavioral research. Their “Policy for Data Management and Sharing (DMS Policy), which went into effect January 25, 2023, requires NIH-funded researchers to submit a plan outlining how scientific data from their research will be managed and shared within their funding application.”

These researchers must adhere to HIPAA regulations when managing PHI during clinical trials. If the PHI is de-identified, it is not considered PHI and HIPAA does not apply. However, when PHI is not de-identified, researchers must use HIPAA compliant emails in clinical trials to maintain compliance and research integrity.

Furthermore, there are many other institutes that fall under the NIH and must adhere to HIPAA regulations, including:

• National Library of Medicine (NLM), which is part of the NIH.
• National Cancer Institute (NCI)
• National Heart, Lung, and Blood Institute (NHLBI)
• National Institute on Aging (NIA)
• National Institute of Allergy and Infectious Diseases (NIAID)
• National Institute of Mental Health (NIMH)
• National Institute on Drug Abuse (NIDA)
• National Institute of Dental and Craniofacial Research (NIDCR)
• National Institute of Neurological Disorders and Stroke (NINDS)
• National Institute of Child Health and Human Development (NICHD)
• National Institute of Environmental Health Sciences (NIEHS)

Office of Personnel Management (OPM)

The OPM manages the Federal Employees Health Benefits Program (FEHBP). When processing health insurance claims for federal employees, they must use encrypted emails to protect the data. 

Paubox email limits access to authorized staff only, protecting federal employees' PHI during transmission and at rest. 

Food and Drug Administration (FDA)

The FDA “[promotes] and [protects] public health by helping safe and effective products reach the market in a timely way, and monitoring products for continued safety after they are in use.”

The FDA often receives health data from clinical trial participants. Emails that contain PHI must be encrypted to protect participant information. These emails allow the FDA to communicate with stakeholders in real-time, monitoring the safety and effectiveness of products on the market.

Health Resources and Services Administration (HRSA)

The HRSA “provides equitable health care to the nation’s highest-need communities. [Their] programs support people with low incomes, people with HIV, pregnant people, children, parents, rural communities, transplant patients, and the health workforce.”

These vulnerable communities experience a disproportionate amount of privacy breaches, limited access to secure technology, and financial constraints that hinder cybersecurity measures.

HIPAA compliant emails are an affordable solution that allows the HRSA to communicate directly with underserved populations, giving them access to much-needed healthcare services.

Substance Abuse and Mental Health Services Administration (SAMHSA)

SAMHSA focuses on substance abuse and mental health services, “improving the quality and availability of prevention, treatment, and rehabilitative services [to] reduce illness, death, disability, and cost to society.”

SAMHSA also offers grants to substance abuse treatment programs. As a result, they may need to exchange PHI with grantees. HIPAA compliant emails encrypt this PHI, safeguarding the patient data while supporting treatment services.

Agency for Healthcare Research and Quality (AHRQ)

The AHRQ “sponsors and conducts research that provides evidence-based information on health care outcomes; quality; and cost, use, and access.” They must adhere to HIPAA regulations when sending patient PHI with clinicians and administrators. Using HIPAA compliant email allows them to securely exchange this data, improve patient care, and reduce healthcare costs.

Office of the Assistant Secretary for Planning and Evaluation (ASPE)

The Office of the Assistant Secretary for Planning and Evaluation (ASPE) advises the Secretary of Health and Human Services on economic policy, health, disability, and human services. When ASPE coordinates cross-department research, they often exchange health data with other federal departments. 

HIPAA compliant emails allow them to securely share PHI with collaborators for healthcare cost-benefit analyses and policy alternatives.

Office of Human Research Protections (OHRP)

The U.S. Department of Health and Human Services’ OHRP protects human subjects in research across over 4,000 institutions. Like, when the OHRP communicates with Institutional Review Boards (IRBs) regarding research protocols, they must use HIPAA compliant emails to adhere to federal regulations.

Office for Civil Rights (OCR)

The Office for Civil Rights (OCR) enforces HIPAA regulations and provides guidance on compliance across various healthcare and research entities. When OCR investigates potential data breaches, they can use HIPAA compliant emails to request PHI from covered entities. These emails protect patient privacy according to HIPAA’s Privacy Rule.

FAQs

What is HIPAA?

The Health Insurance Portability and Accountability Act (HIPAA) is a federal law that establishes national standards for safeguarding protected health information (PHI). HIPAA mandates that healthcare providers, insurers, business associates, and some federal agencies, safeguard patients' PHI during transit and at rest.

How does HIPAA impact federal health research institutes like the NIH?

The NIH and its affiliated institutes must follow HIPAA regulations when conducting research involving humans, safeguarding PHI collected during research. These institutes must obtain explicit patient authorization, before collecting, storing, and sharing their PHI for research purposes.

Learn more: A HIPAA consent form template that's easy to share

What should federal agencies do if they suspect a HIPAA breach?

If a HIPAA breach is suspected, federal agencies should follow their organization's incident response plan, which typically includes notifying the affected individuals, the HHS Office for Civil Rights, and possibly the media if the breach involves more than 500 people. All breaches must be documented and investigated to prevent future occurrences.