Medical Billing Terms H: HIPAA Privacy Rule, Security Rule and HITECH

The HIPAA Privacy Rule sets national limits on how health information may be used and shared. This page defines it with the other HIPAA terms, HITECH, HL7, HMO, HRSA and Humana. Each entry gives a plain definition, why it matters, an example, and an official source. MCM South Medical Billing Service, LLC works only in mental and behavioral health billing.

Last reviewed: October 10, 2026Sources linked at each term

Get a Free Quote Schedule a Consultation

Billing Terms Glossary slide, Terms H: HIPAA Privacy Rule - MCM South Medical Billing Service, LLC

Glossary pages

0-9 A B C D E F GHI J K-L M N-O P Q-R S T U-V W-Z

Pages in H

H-1H-2

On this page (18 terms)

Hierarchical Condition Category (HCC)
Highmark
HIPAA
HIPAA Authorization
HIPAA Privacy Rule
HIPAA Security Rule
HIPAA Transaction Standards
HITECH Act
HL7
HMO (Health Maintenance Organization)
Home and Community-Based Services (HCBS)
Home Plan
Horizon Blue Cross Blue Shield of New Jersey
Host Plan
HRSA
HSA (Health Savings Account)
Human in the Loop
Humana

How to use these HIPAA Privacy Rule definitions

Use this page as a quick reference for HIPAA Privacy Rule, from Hierarchical Condition Category to Humana. Each entry gives a plain definition, why it matters to a mental health practice, and an official source. When a rule changes by payer or state, the entry says so, so confirm HIPAA Privacy Rule details with the payer before you bill.

Checklist: put the hipaa privacy rule definitions to work

Check the hipaa privacy rule entries above before you send a claim that depends on them.

Share this page

Search this page

Hierarchical Condition Category (HCC)

General (all payers)

Also called HCC; CMS-HCC

Definition: A grouping of diagnosis codes used in risk adjustment models to predict costs.
Why it matters: Some mental health diagnoses map to HCCs, making accurate diagnosis coding important.
Illustrative example: A diagnosis of major depressive disorder maps to an HCC in a model version.

Reference sourceCMS (Centers for Medicare & Medicaid Services)checked 10/9/26

CategoriesQuality & Risk Adjustment Terms Medicare & Medicaid Terms

Highmark

Private payer

Also called Highmark Blue Cross Blue Shield

Definition: A Blue licensee company operating Blue plans in several states.
Why it matters: Its rules apply to its own plans.
Illustrative example: A provider reads Highmark's manual for its area.

Reference sourceHighmarkchecked 10/9/26

CategoriesBCBS, UHC & Commercial Payer Terms

HIPAA

General (all payers)

Also called Health Insurance Portability and Accountability Act

Definition: A federal law that sets national standards for protecting health information and for electronic health care transactions.
Why it matters: Governs how practices handle patient data and how claims are sent.
Illustrative example: A practice signs business associate agreements with vendors that handle patient data.

Reference sourceHHS (U.S. Department of Health and Human Services)HHS Office for Civil Rights (OCR)checked 10/9/26

CategoriesAudits & Compliance

HIPAA Authorization

General (all payers)

Also called authorization for release of information; release of information form; ROI

Definition: A HIPAA authorization is a patient's signed permission for a covered entity to use or disclose protected health information for a purpose that HIPAA does not otherwise allow.
Why it matters: It is required for most uses of psychotherapy notes and for many disclosures outside treatment, payment, and operations. It must contain specific elements and can be revoked.
Illustrative example: A patient signs an authorization so a school can receive a summary of her child's therapy.

Reference sourceHHS (U.S. Department of Health and Human Services)HHS Office for Civil Rights (OCR)checked 10/9/26

CategoriesAudits & Compliance

HIPAA Privacy Rule

General (all payers)

Also called privacy rule; PHI protection

Definition: The HIPAA rule that sets standards for use and disclosure of protected health information and gives patients rights over it.
Why it matters: Sets when information may be shared for treatment, payment, and operations.
Illustrative example: A practice shares only the minimum information a payer needs to process a claim.

Reference sourceHHS (U.S. Department of Health and Human Services)HHS Office for Civil Rights (OCR)checked 10/9/26

CategoriesAudits & Compliance

HIPAA Security Rule

General (all payers)

Also called security rule; ePHI safeguards

Definition: The HIPAA rule that requires administrative, physical, and technical safeguards for electronic protected health information.
Why it matters: Requires risk analysis and safeguards such as access controls and encryption.
Illustrative example: A practice conducts a security risk analysis annually.

Reference sourceHHS (U.S. Department of Health and Human Services)HHS Office for Civil Rights (OCR)checked 10/9/26

CategoriesAudits & Compliance

HIPAA Transaction Standards

General (all payers)

Also called 5010; HIPAA EDI standards; standard transactions

Definition: The federally adopted formats for electronic health care transactions such as claims, eligibility, and remittance, currently based on X12 version 5010.
Why it matters: Payers must accept standard transactions, and providers who transmit electronically must use them.
Illustrative example: A clearinghouse sends claims in the standard 837 format.

Reference sourceX12 HHS (U.S. Department of Health and Human Services)checked 10/9/26

CategoriesEDI & Clearinghouse Terms Audits & Compliance

HITECH Act

General (all payers)

Also called HITECH; Health Information Technology for Economic and Clinical Health Act

Definition: The HITECH Act is a 2009 federal law that promoted the use of electronic health records, strengthened HIPAA privacy and security rules, and created the breach notification requirements.
Why it matters: It is the source of the breach notification rule and higher HIPAA penalties. Practices meet its requirements through their privacy and security programs.
Illustrative example: A practice's breach response plan follows requirements that come from the HITECH Act.

Reference sourceHHS (U.S. Department of Health and Human Services)HHS Office for Civil Rights (OCR)checked 10/9/26

CategoriesAudits & Compliance EHR & Healthcare Technology Terms

HL7

General (all payers)

Also called Health Level Seven International

Definition: A standards organization that develops health information exchange standards, including FHIR.
Why it matters: HL7 standards underpin many EHR integrations.
Illustrative example: An EHR sends an HL7 message to another system.

Related termsFHIR Interoperability

Reference sourceHL7 Internationalchecked 10/9/26

CategoriesEHR & Healthcare Technology Terms EDI & Clearinghouse Terms

HMO (Health Maintenance Organization)

General (all payers)

Also called HMO plan

Definition: A managed care plan that generally covers care only from a defined network and often requires referrals from a primary care provider.
Why it matters: OON therapy is usually not covered under an HMO, making network status critical.
Illustrative example: An HMO member seeks therapy from an out-of-network therapist and the claim denies.

Reference sourceCMS (Centers for Medicare & Medicaid Services)checked 10/9/26

CategoriesEligibility & Benefits

Home and Community-Based Services (HCBS)

Medicaid (state-specific)

Also called HCBS; 1915(c) waiver

Definition: Medicaid services delivered in the home or community instead of an institution, authorized through waivers or state plan options.
Why it matters: Many in-home and community behavioral health codes fall here, with strict documentation.
Illustrative example: A state HCBS program covers community supports.

Reference sourceMedicaid.gov CMS (Centers for Medicare & Medicaid Services)checked 10/9/26

CategoriesMedicare & Medicaid Terms Behavioral Health Specific Terms

Home Plan

Private payer

Also called member's home Blue plan

Definition: Under BlueCard, the Blue plan that issued the member's coverage.
Why it matters: Determines benefits and cost sharing for out-of-area members.
Illustrative example: The home plan decides benefits for a traveling member.

Related termsHost Plan BlueCard Program

Reference sourceBlue Cross Blue Shield Associationchecked 10/9/26

CategoriesBCBS, UHC & Commercial Payer Terms

Horizon Blue Cross Blue Shield of New Jersey

Private payer

Also called Horizon BCBSNJ

Definition: A Blue licensee serving New Jersey.
Why it matters: A separate licensee with its own rules.
Illustrative example: A New Jersey provider uses Horizon's provider portal.

Reference sourceHorizon Blue Cross Blue Shield of New Jerseychecked 10/9/26

CategoriesBCBS, UHC & Commercial Payer Terms

Host Plan

Private payer

Also called local Blue plan

Definition: Under BlueCard, the Blue plan in the area where the provider is located, which processes the claim.
Why it matters: The provider deals with the host plan on claims.
Illustrative example: A provider bills the local Blue plan for an out-of-state member.

Related termsHome Plan BlueCard Program

Reference sourceBlue Cross Blue Shield Associationchecked 10/9/26

CategoriesBCBS, UHC & Commercial Payer Terms

HRSA

Medicaid (state-specific)

Also called Health Resources and Services Administration

Definition: An HHS agency that supports health care access programs, including community health centers and workforce programs.
Why it matters: Relevant to safety-net providers and workforce funding.
Illustrative example: A health center reports to HRSA.

Reference sourceHRSAchecked 10/9/26

CategoriesMedicare & Medicaid Terms Quality & Risk Adjustment Terms

HSA (Health Savings Account)

General (all payers)

Also called HSA; health savings account

Definition: A tax-advantaged account paired with a high-deductible health plan that a patient can use to pay qualified medical expenses.
Why it matters: Patients may pay copays and balances with HSA cards.
Illustrative example: A patient pays a balance with an HSA debit card.

Reference sourceHHS (U.S. Department of Health and Human Services)checked 10/9/26

CategoriesPatient Financial Responsibility Terms

Human in the Loop

General (all payers)

Also called human review; human oversight

Definition: A design where a person reviews or approves AI outputs before they are used.
Why it matters: A common safeguard in billing and clinical uses.
Illustrative example: A coder approves suggested codes.

Related termsAI Coding Assistant AI Scribe

Reference sourceHHS (U.S. Department of Health and Human Services)checked 10/9/26

CategoriesAI & Healthcare Automation Terms

Humana

Private payer

Also called Humana Military

Definition: A national health insurer, strong in Medicare Advantage, and a TRICARE contractor in some regions.
Why it matters: Has its own network and rules.
Illustrative example: A provider checks Humana's provider portal.

Related termsMedicare Advantage TRICARE

Reference sourceHumanachecked 10/9/26

CategoriesBCBS, UHC & Commercial Payer Terms

Quick answer: HIPAA Privacy Rule

What is the HIPAA Privacy Rule?

The HIPAA rule that sets standards for use and disclosure of protected health information and gives patients rights over it. Sets when information may be shared for treatment, payment, and operations.

Frequently asked questions: HIPAA Privacy Rule

What is the HIPAA Security Rule?

The HIPAA rule that requires administrative, physical, and technical safeguards for electronic protected health information. Requires risk analysis and safeguards such as access controls and encryption.

What is a HIPAA authorization?

A HIPAA authorization is a patient's signed permission for a covered entity to use or disclose protected health information for a purpose that HIPAA does not otherwise allow. It is required for most uses of psychotherapy notes and for many disclosures outside treatment, payment, and operations.

What is an HMO?

HMO (Health Maintenance Organization) is a managed care plan that generally covers care only from a defined network and often requires referrals from a primary care provider. OON therapy is usually not covered under an HMO, making network status critical.

Related resources

Where MCM South works

MCM South serves psychotherapists and psychiatrists in ten states: Georgia, Massachusetts, Connecticut, Texas, Florida, New York, Colorado, Tennessee, North Carolina and Illinois.

Get a free mental health billing quote

MCM SouthGet a Free Quote