Did you know that modifications to the HIPAA privacy and security rules on privacy of health information and security went into effect on March 26, 2013? Did you know penalties for violations can be as high as $50,000 per violation?The Department of Health and Human Services issued rules to modify the Health Insurance Portability and Accountability Act (HIPAA) Privacy, Security, and Enforcement Rules to implement statutory amendments under the Health Information Technology for Economic and Clinical Health Act (‘‘the HITECH Act’’). These modified rules are meant to strengthen the privacy and security protection for individuals’ health information and modify the rule for breach notification for unsecured protected health information, among other things.
These modifications include:
• Making business associates of covered entities directly liable for compliance with certain of the HIPAA Privacy and Security Rules’ requirements. A business associate includes a subcontractor that creates, receives, maintains or transmits protected health information on behalf of the business associate.
• Inspectors imposing stiff penalties, depending on the category of the violation, between $100 and $50,000 for each violation not to exceed $1,500,000 in any calendar year for violations of the same requirement or prohibition (starting on September 23, 2013).
• Strengthening the limitations on the use and disclosure of protected health information for marketing and fundraising purposes and prohibiting the sale of protected health information without individual authorization.
• Expanding individuals’ rights to receive electronic copies of their health information and restricting disclosures to a health plan concerning treatment for which the individual has paid out of pocket in full.
• Requiring modifications to, and redistribution of, a covered entity’s notice of privacy practices.
• Modifying the individual authorization and other requirements to facilitate research and disclosure of child immunization proof to schools and to enable access to decedent information by family members or others.
Covered entities and business associates of all sizes will have 180 days beyond the effective date of the final rule to come into compliance with most of the final rule’s provisions (September 23, 2013).
As a result of these new provisions, IT departments of Organizations should consider:
• Conducting a risk assessment of IT security and environment.
• Reconfiguring wireless access including restricting the use of individually owned devices.
• Blocking e-mail for employees using devices not owned or approved by the Organization.
• Purchase or lease of mobile devices that are encrypted with the minimum HITECH requirements.
• Updating the Organization’s security statement in which the employee signs and agrees not to remove any of the Organization’s data.
