HIPAA
HIPAA (the Health Insurance Portability and Accountability Act of 1996) is the US law that protects the privacy and security of patients' health information. It also created standard identifiers for healthcare transactions, including the National Provider Identifier.
Is provider directory data covered by HIPAA?
Information about clinicians and practices, such as names, addresses and specialties, is generally not protected health information (PHI). Data about patients is. Claims data used to verify provider records contains PHI and must be handled under HIPAA.
What does HIPAA require of vendors?
Vendors that handle PHI on behalf of a plan or provider are business associates and must sign a business associate agreement (BAA) and protect the data under the HIPAA Security Rule.
HIPAA and the NPI
The NPI comes from HIPAA's administrative simplification rules, which standardized identifiers used in electronic healthcare transactions.