On August 21, 1996, the Health Insurance Portability and Accountability Act of 1996 (HIPAA) was signed into law. One part of the law requires the adoption of uniform national standards for health information, establishing how information should be formatted, shared, and protected. This will affect every aspect of pediatric practice, and you should begin now to understand HIPAA. Over the next 2 years, the American Academy of Pediatrics (AAP) will develop summaries and sample materials to help you incorporate these requirements into your practice.Standardization of electronic transactions in health care will greatly facilitate the sharing of data, raising concerns about how the data will be protected. HIPAA required the first-ever national standards for privacy protections of health information. The privacy rule establishes significant restrictions on the use and release of medical records, describes privacy safeguard standards that must be met, gives patients several important rights, and provides for significant penalties for misuse of health information. In addition to concerns about privacy of health information, increased exchange and compilation of electronic health information raises concerns about physical and technical security. HIPAA requires the adoption of a national standard for security of electronic health information. The 1998 proposed rule describes minimum security requirements and requires each health care organization covered by the rule to designate a security official.The core element of administrative simplification is to require the use of a single standardized format for 10 common health care transactions including health care claims, eligibility inquiries, referral certification and authorization, and payment. In these transactions the use of specific clinical code sets, including Current Procedural Terminology and International Classification of Diseases, Ninth Revision, Clinical Modification is required. The use of national standard identifiers for providers, health plans, and employers will also be required.The requirement for a national identifier for individuals has been extremely controversial, and in the fall of 1998, Congress prohibited the promulgation of a national patient identifier.The AAP expects that most pediatricians will be covered by HIPAA because they submit electronic claims themselves and/or use a billing service or clearinghouse to convert paper claims to electronic format. The HIPAA administrative simplification provisions apply to the following covered entities:Final rules have been published on standards for electronic transactions and privacy of health information. Covered providers must comply with the transactions rule by October 16, 2002, and with the privacy rule by April 14, 2003. Proposed rules on security, national provider identifiers, and national employer identifiers were published in 1998. No other proposed or final rules have been published yet, and the US Department of Health and Human Services has no expected date for publication.The AAP will continue its efforts to educate pediatricians about HIPAA and to advocate for HIPAA implementation that works for children’s health care. More information on HIPAA is available on the AAP Members Only Channel (http://www.aap.org/moc). In the future, this Web site will contain pediatric-specific compliance guidance and model policies and procedures. In addition, future issues of this newsletter will contain articles focusing on specific aspects of HIPAA implementation.For more information about HIPAA and its effect on pediatricians, e-mail HIPAA@aap.org, or call the AAP Division of Health Care Finance and Practice at 800/433-9016, ext 4089.