Healthcare Law Blog

HHS Issues Final HIPAA/HITECH Rule

The United States Department of Health and Human Services (“HHS”) issued its Final Rule modifying the requirements of the Health Insurance Portability and Accountability Act (“HIPAA”) privacy and security regulations pursuant to the Health Information Technology for Economic and Clinical Health Act (“HITECH”) on January 17, 2013.  The Final Rule strengthens the privacy and security requirement of HIPAA governing protected health information (“PHI”) and gives HHS greater enforcement authority to police violations of the privacy and security requirements.  The Final Rule will require health care providers and their business associates to re-evaluate their HIPAA compliance policies and procedures to avoid potential liability for violations of HIPAA requirements.

The Final Rule is divided into four parts.  The first part strengthens the HIPAA privacy and security requirements by making business associates liable for HIPAA violations, provides patients with greater rights over their protected health information, and provides for greater limits on the use or disclosure of PHI for marketing purposes.

The second part of the Final Rule changes and increases the enforcement provisions of HIPAA and includes increased penalties for HIPAA violations.  The third part of the Final Rule addresses security breaches of PHI and places the burden on the covered entity or business associate to show that there is a low probability that PHI has been revealed, replacing the “harm” standard that HHS had previously promulgated in the Interim Final Rule that had been issued pursuant to HITECH.  The fourth part of the Final Rule modifies the HIPAA privacy provisions to comply with the Genetic Information Nondiscrimination Act (“GINA”) by forbidding health plans from using or disclosing genetic information for purposes of insurance underwriting.

With the increasing use of electronic health records, one of the most important provisions of the Final Rule concerns breach notification requirements.  The Final Rule requires covered entities to report a breach involving less than 500 persons to HHS no later than 60 days after the end of the calendar year in which the breach was discovered.  The Final Rule maintains the “safe harbor” for breach notification contained in the Interim Final Rule that protects covered entities from breach notification requirements for PHI that has been encrypted or secured in compliance with the Guidance Specifying the Technologies and Methodologies that Render Protected Health Information Unusable, Unreadable, or Indecipherable to Unauthorized Individuals that was published in the Federal Register on August 24, 2009.

Health care providers as well as their business associates need to review and revise their HIPAA compliance policies and procedures as well as their business associate agreements to ensure their compliance with all of the provisions of the Final Rule.

Christopher J. Shaughnessy is a member at McBrayer law.  Mr. Shaughnessy concentrates his practice area in healthcare law and is located in the firm’s Lexington office.  He can be reached at cshaughnessy@mcbrayerfirm.com or at (859) 231-8780, ext. 1251. 

Services may be performed by others.

This article does not constitute legal advice.