On January 25, the Department of Health and Human Resources (HHS) will publish in the Federal Register an update to its HIPAA privacy rule that expands liability of business associates of hospitals, physicians and other HIPAA-covered entities if they release data in ways that violate patient privacy. The rule clarifies when breaches of information must be reported to the Office for Civil Rights, sets new rules on the use of patient-identifiable information for marketing and fundraising, and expands direct liability under the law to the so-called “business associates” of hospitals and physicians and other “HIPAA-covered entities.” Those associates might include a provider's healthcare data-miners and health information technology service providers.
It also restores a limited right of consent to patients to control the release to their insurance company of records about their treatment if the pay for that treatment is out of pocket. And it spells out how the greatly increased penalties for privacy and security violations under the ARRA are to be applied.
These changes not only greatly enhance a patient's privacy rights and protections, but also strengthen the ability of my office to vigorously enforce the HIPAA privacy and security protections, regardless of whether the information is being held by a health plan, a healthcare provider or one of their business associates. The rule becomes effective March 26, 2013.
https://s3.amazonaws.com/public-inspection.federalregister.gov/2013-01073.pdf
Have questions? I’m here to help.
