HIPAA Final Rule: More on Business Associate Uses & Disclosures in the Business Associate Contract

March 11, 2013. Today, we continue going through the HIPAA Privacy Rule, section by section, as modified in the Final Rule: Modifications to the HIPAA Privacy, Security, Enforcement, and Breach Notification Rules Under the Health Information Technology for Economic and Clinical Health Act [HITECH Act] and the Genetic Information Nondiscrimination Act; Other Modifications of the HIPAA Rules, which was published in the Federal Register on January 25, 2013. The effective date of the Final Rule is March 26, 2013, and covered entities and business associates must comply by September 23, 2013. Tomorrow, we close the presentation of 45 CFR 174.502 with 164.502(f): Standard: Deceased individuals.

HIPAA Final Rule: Modified Rule for Business Associates and Subcontractors

February 6, 2013. Today, we cover the business associate Administrative Safeguard (b) of the Security Rule, as modified by the Final Rule: Modifications to the HIPAA Privacy, Security, Enforcement, and Breach Notification Rules Under the Health Information Technology for Economic and Clinical Health Act [HITECH Act] and the Genetic Information Nondiscrimination Act; Other Modifications of the HIPAA Rules, which was published in the Federal Register on January 25, 2013. The effective date of the Final Rule is March 26, 2013, and covered entities and business associates must comply by September 23, 2013. Tomorrow, we present the Final Rule modified definition of Business Associate.

HIPAA Final Rule: Security Standards, General Rules & Administrative Safeguard Modifications

February 5, 2013. Today, we cover the modifications to Security Standards: General Rules, and Administrative Safeguards in the HIPAA Security Rule, as modified by the Final Rule: Modifications to the HIPAA Privacy, Security, Enforcement, and Breach Notification Rules under the Health Information Technology for Economic and Clinical Health Act [HITECH Act] and the Genetic Information Nondiscrimination Act; Other Modifications of the HIPAA Rules, which was published in the Federal Register on January 25, 2013. The effective date of the Final Rule is March 26, 2013, and covered entities and business associates must comply by September 23, 2013. Tomorrow, we examine modifications relating to Administrative Safeguards (b): Business associate contracts and other arrangements.

HIPAA Final Rule: Business Associate Notification Timing, Policy and Procedure Updates, Retraining, and Documentation

February 1, 2013. Today, we wrap up discussion of breach notification in the Final Rule: Modifications to the HIPAA Privacy, Security, Enforcement, and Breach Notification Rules Under the Health Information Technology for Economic and Clinical Health Act [HITECH Act] and the Genetic Information Nondiscrimination Act; Other Modifications to the HIPAA Rules. The Final Rule is effective on March 26, 2013, and requires compliance by covered entities and business associates on September 23, 2013. The focus is on timing of reporting a breach by a business associate to a covered entity, and, because the definition of breach was modified in the Final Rule, on the requirements to update policies and procedures, retrain the workforce on those updated policies and procedures, and document all breach characteristics and notifications.

HAPPY 16th Birthday HIPAA: Five HIPAA Compliance Activities Your Organization Must Undertake NOW!

HIPAA Administrative Simplification was enacted on August 21, 1996 as Subtitle F of Title II of Public Law 104-191. The so-called HITECH Act “Omnibus” regulation that modifies HIPAA privacy and security provisions will be published in the Federal Register by the end of this summer, according to the head of HHS’ National Coordinator for Health Information Technology, Farzad Mostashari, M.D. Based on the timeline in the Notice of Proposed Rule Making, compliance by all covered entities and their business associates would be required 240 days after publication, most likely sometime in May 2013, assuming the end-of-summer deadline is met. All covered entities and their business associates will be required to comply with provisions of the Omnibus regulation. Achieving compliance is a time-consuming process. We outline five activities your organization should be doing NOW in advance of release of the Omnibus regulations and that it needs to complete before compliance kicks in.

ONC Issues Meaningful Use Guide for Privacy & Security Attestation Compliance

May 9, 2012. The Office of the National Coordinator for Health Information Technology (ONC) has issued a Guide to Privacy and Security of Health Information (Version 1.1 022312). This Guide is targeted to medical practitioners who participate in the Medicare and Medicaid Program for Adoption and Meaningful Use of Certified Electronic Health Record Technology. This Guide should not be relied on as an instruction manual for achieving HIPAA Privacy and Security and HITECH Act Breach Notification compliance, but does have useful guidance to public resources for so doing.

OCR Announces November 2011 Start of Privacy and Security Compliance Audits

The U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR) is responsible for privacy and security enforcement under Health Insurance Portability and Accountability Act (HIPAA) and Health Information Technology for Economic and Clinical Health (HITECH) Act provisions. OCR has announced that it is initiating compliance audits beginning this month, as authorized by the HITECH Act. This action precedes the imminent release of the Final HIPAA/HITECH Act Privacy, Security, Breach Notification, and Enforcement Rules, expected before the end of 2011, and will strengthen enforcement and accountability for compliance with existing and forthcoming Rule modifications. To avoid the consequences of potential penalties for non-compliance, covered entities and business associates must now pay immediate attention to conducting a new or reviewing an existing risk assessment of threat and vulnerability to protected health information (PHI), mitigating identified risks through privacy and security safeguard policies and procedures, training their workforce members to safeguard privacy and security of PHI, and documenting those actions in writing.

Information Access Management: Access Establishment and Modification-What to Do and How to Do It

In our series on the HIPAA Administrative Simplification Security Rule, this is the third implementation specification for the Administrative Safeguard Standard (Information Access Management). This implementation specification is addressable. Remember, addressable does not mean “optional.” Rather, an addressable implementation specification means that a covered entity must use reasonable and appropriate measures to meet the standard. Further, as we have noted in a posting last week, with enactment of the American Recovery and Reinvestment Act of 2009 on February 17, 2009, business associates also will be required to comply with the Security Rule standards, effective February 17, 2010.