Final HIPAA Enforcement Rule Published

From the American Health Lawyer's Association (www.healthlawyers.org):

The Department of Health and Human Services (DHHS) published in the February 16 Federal Register (71 Fed. Reg. 8390) the Health Insurance Portability and Accountability Act (HIPAA) Administrative Simplification Enforcement final rule. The rule extends the enforcement provisions currently applicable to the HIPAA privacy standards to apply to all HIPAA Administrative Simplification rules.

The final rule adopts most of the provisions of the proposed rule (70 Fed. Reg. 20225) with some changes made in response to the forty-nine comments received by DHHS.

For instance, in the proposed rule, variables were listed to count the number of violations of an identical requirement or prohibition, whereas the final rule “clarifies that the method for determining the number of such violations is grounded in the substantive requirement or prohibition violated.”

In addition, the provision for joint and several liability of the members of an affiliated covered entity is retained, unless it is established that another member of the affiliated covered entity was responsible for the violation.

The final rule also extends the number of days in which a respondent may file its request for a hearing to ninety days rather than sixty days.