Every medical practice regardless of its size will have to comply with the HIPAA security, privacy and transactions regulations.
The HIPAA transaction rules will require that everyone use the same format to transmit health-related information.
Instituted to provide greater protection of patient confidentiality, the regulations will require that you take a number of administrative measures to ensure that any patient-identifiable information, referred to by HIPAA as "protected health information" (PHI), in your practice is secure.
HIPAA regulations will require that medical practices obtain explicit patient consent to use PHI for the purposes of health care delivery, payment and routine practice operations. Further, it requires patient authorization for any other use of PHI (e.g., research or marketing). Organizations will eventually have to determine which of the individuals and organizations they do business with can have access to PHI and build language into each contract to ensure that business associates will handle PHI in compliance with the law.
The HIPAA regulations not only require that health care organizations carefully define who has access to PHI, but also how much of the patient record front-office staff, utilization managers and others may view in the daily course of their work. Physicians will be able to continue to share a patient's entire medical record with colleagues for purposes of treatment; all other uses and disclosures must consist of only the minimal information necessary to achieve the purpose at hand. The intent of the HIPAA standard is to discourage the current practice of open access to medical records that may contain large stores of information regarding a patient's previous medical history.
HIPAA regulations also will prohibit medical records from being sold without patients' written consent. This could make the sale of some practices very difficult and affect physicians' retirement plans and negotiations with hospitals. It could also affect other parties involved in the transfer of patients' records from one provider to another.
The actual HIPAA law is Public Law 104-191. Health Insurance Portability and Accountability Act of 1996. Federal Reg. 1999; 64:60053.
A good page about HIPAA is http://www.tech-encyclopedia.com/hipaa-compliance.htm
Enjoy!