Today, February 17, Business Associates Must be in Compliance with HIPAA Security Rule

Today, Wednesday, February 17, 2010, Business Associates of Covered Entities must be able to demonstrate that they are in compliance with administrative, physical, and technical safeguards of the HIPAA Security Rule, as required by the HITECH Act, enacted one year ago today as part of the American Recovery and Reinvestment Act of 2009. In addition, Business Associate Agreements must be rewritten or amended to specifically require a Business Associate’s compliance with the Security Rule as part of its “satisfactory assurances.” Financial penalties for noncompliance discovered during a compliance audit or complaint investigation could be severe, especially for willful neglect.

New HIPAA/HITECH Act Rules Require Compliance in February

Three new HITECH Act Rules go into effect in February: Business Associate compliance with, and subject to penalties for violations of the HIPAA Security Rule, on February 17, 2010; Covered Entity Health Care Provider compliance with a restriction on PHI Disclosure to a Health Plan when a patient pays in full out of pocket at time of service, on February 18; and Enforcement of the Breach Notification Rule for failure of a Covered Entity and/or Business Associate to provide the required notifications for breaches discovered on or after the enforcement commencement date, February 22, 2010.