HIPAA costs and patient perceptions of privacy safeguards at Mayo Clinic

Background: A study was conducted to assess the costs of implementation of the Health Insurance Portability and Accountability Act (HIPAA) and to report patient awareness of Notices of Privacy Practices (NPP) content and HIPAA privacy protections. Methods: All HIPAA start-up and implementation costs were collected prospectively. A random sample of 2,000 patients receiving services at the Mayo Clinic after HIPAA implementation (April 14, 2003) was surveyed about HIPAA knowledge, HIPAA content, and privacy concerns. Results: Comprehensive measures of total HIPAA costs and costs related only to privacy practices were amortized over 7, 15, and 20 years. Patient knowledge of privacy protections and attitudes toward HIPAA were obtained from 1,309 (65.5%) respondents. The total HIPAA start-up costs were $4,663,672. Fully amortized cose (annual plus start-up costs) were $1 per patient visit or $5 per patient per year. Costs for the privacy portion were $2,734,855. These costs were about $.90 per patient visit or about $4 per patient per year. Patients indicated high levels of awareness of HIPAA (71%), reading the NPP (79%), knowledge about HIPAA (80% with 6+ correct answers on a 10-item quiz), and improved feelings of privacy (44% versus 55% the same). Discussion: Patients reported high levels of knowledge about HIPAA and confidence in privacy protections. HIPAA costs were modest per patient or per visit.