HHS Modifies HIPAA Privacy, Security, Enforcement and Breach Notification Rules
The U.S. Department of Health and Human Services (HHS) Office of Civil Rights has issued final regulations modifying the HIPAA privacy, security, enforcement and breach notification rules (collectively “the Omnibus Rule”). In a release from HHS, the Office of Civil Rights Director, Leon Rodriguez, indicated that “the final Omnibus Rule makes the most sweeping changes to the HIPAA privacy and security rules since they were first implemented.” He added, “these changes not only greatly enhance a patient’s privacy rights and protections, but also strengthen the ability of my office to vigorously enforce the HIPAA privacy and security protections, regardless of whether the information is being held by a health plan, health care provider, or one of their business associates.”
The final Omnibus Rule will be effective March 26, 2013; however, covered entities and business associates will have until September 23, 2013, to comply with it. The 563-page rule was posted on the Federal Register Public Inspection Desk on January 17, 2013. Hinshaw & Culbertson LLP will provide more information regarding the rule in the coming days.
The final Omnibus Rule contains an executive summary which indicates that the final rule strengthens the privacy and security protections established under HIPAA. The executive summary indicates that provisions of the Omnibus Rule do the following:
- Make business associates of covered entities directly liable for compliance with certain requirements of the HIPAA privacy and security rules.
- Strengthen the limitations on the use and disclosure of protected health information for marketing and fundraising purposes, and prohibit the sale of the protected heath information without individual authorization.
- Expand the individual’s rights to receive electronic copies of his or her health information and restrict disclosures to a health plan concerning treatment for which the individual has paid in full out-of-pocket.
- Require modifications to, and redistribution of, the covered entity’s notice of privacy practices.
- Modify an individual authorization and other requirements to facilitate research and disclosure of child immunization proof to schools, and to enable access to decedent information by family members or others.
- Adopt the additional Health Information Technology for Economic and Clinical Health (HITECH) Act enhancements to the enforcement rule not previously adopted, such as provisions addressing enforcement of noncompliance with the HIPAA rules due to willful neglect.
The final rule also adopts changes to the HIPAA enforcement rule to incorporate the increased and tiered civil money penalty structure provided by HITECH. Significantly, the breach notification requires that a potential breaching party perform a risk-factor analysis, the effect of which may reduce discretion regarding whether a breach must be disclosed to the affected individuals, the government and potentially the media.
For more information, please contact Roy M. Bossen, Michael A. Dowell or your regular Hinshaw attorney.
This alert has been prepared by Hinshaw & Culbertson LLP to provide information on recent legal developments of interest to our readers. It is not intended to provide legal advice for a specific situation or to create an attorney-client relationship.