The Rheumatologist
COVID-19 NewsACR Convergence
  • Connect with us:
  • Facebook
  • Twitter
  • LinkedIn
  • YouTube
  • Feed
  • Home
  • Conditions
    • Rheumatoid Arthritis
    • SLE (Lupus)
    • Crystal Arthritis
      • Gout Resource Center
    • Spondyloarthritis
    • Osteoarthritis
    • Soft Tissue Pain
    • Scleroderma
    • Vasculitis
    • Systemic Inflammatory Syndromes
    • Guidelines
  • Resource Centers
    • Axial Spondyloarthritis Resource Center
    • Gout Resource Center
    • Psoriatic Arthritis Resource Center
    • Rheumatoid Arthritis Resource Center
    • Systemic Lupus Erythematosus Resource Center
  • Drug Updates
    • Biologics & Biosimilars
    • DMARDs & Immunosuppressives
    • Topical Drugs
    • Analgesics
    • Safety
    • Pharma Co. News
  • Professional Topics
    • Ethics
    • Legal
    • Legislation & Advocacy
    • Career Development
      • Certification
      • Education & Training
    • Awards
    • Profiles
    • President’s Perspective
    • Rheuminations
    • Interprofessional Perspective
  • Practice Management
    • Billing/Coding
    • Quality Assurance/Improvement
    • Workforce
    • Facility
    • Patient Perspective
    • Electronic Health Records
    • Apps
    • Information Technology
    • From the College
    • Multimedia
      • Audio
      • Video
  • Resources
    • Issue Archives
    • ACR Convergence
      • Gout Resource Center
      • Axial Spondyloarthritis Resource Center
      • Psoriatic Arthritis
      • Abstracts
      • Meeting Reports
      • ACR Convergence Home
    • American College of Rheumatology
    • ACR ExamRheum
    • Research Reviews
    • ACR Journals
      • Arthritis & Rheumatology
      • Arthritis Care & Research
      • ACR Open Rheumatology
    • Rheumatology Image Library
    • Treatment Guidelines
    • Rheumatology Research Foundation
    • Events
  • About Us
    • Mission/Vision
    • Meet the Authors
    • Meet the Editors
    • Contribute to The Rheumatologist
    • Subscription
    • Contact
  • Advertise
  • Search
You are here: Home / Articles / Department of Health and Human Services’ Final Rule Expands HIPAA Obligations, Violation Penalties

Department of Health and Human Services’ Final Rule Expands HIPAA Obligations, Violation Penalties

April 1, 2013 • By Steven M. Harris, Esq.

  • Tweet
  • Email
Print-Friendly Version / Save PDF
Are You Ready for the HIPPA Changes?

On January 17, 2013, the Office for Civil Rights (OCR) of the Department of Health and Human Services (HHS) issued an omnibus final rule implementing various provisions of the Health Information Technology for Economic and Clinical Health Act (HITECH Act). The Final Rule revises the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and the interim final Breach Notification Rule. This will affect not only physician practices, but also their business associates who have access to protected health information (PHI), and even business associates’ subcontractors. Now is the time to make sure your agreements with business associates comply with these new rules.

You Might Also Like
  • HHS Enforces Stricter Rules on HIPAA
  • Omnibus Rule Compliance Deadline Imminent
  • HIPAA Security Standards: What Rheumatologists Need to Know
Explore This Issue
April 2013
Also By This Author
  • Selling a Rheumatology Practice to a Hospital or Health System

Background

On February 17, 2009, President Barack Obama signed the American Recovery and Reinvestment Act of 2009 into law, which included the HITECH Act. The HITECH Act expanded the obligations of covered entities and business associates to protect the confidentiality and security of PHI.

ad goes here:advert-1
ADVERTISEMENT
SCROLL TO CONTINUE

Under HIPAA, covered entities may disclose PHI to business associates, and permit business associates to create and receive PHI on behalf of the covered entity, subject to the terms of a business associate agreement between the parties. A “covered entity” is defined as a health plan, healthcare clearinghouse or healthcare provider (e.g., physician practice or hospital) that transmits health information electronically. In general, the HIPAA regulations have traditionally defined a “business associate” as a person (other than a member of the covered entity’s workforce) or entity who, on behalf of a covered entity, performs a function or activity involving the use or disclosure of PHI, such as the performance of financial, legal, actuarial, accounting, consulting, data aggregation, management, administrative, or accreditation services to or for a covered entity.

Prior to the HITECH Act, business associates were contractually obligated under their business associate agreements to maintain the privacy and security of PHI, but could not be sanctioned for failing to comply with HIPAA. However, the HITECH Act expanded the obligations and exposure of business associates by:

ad goes here:advert-2
ADVERTISEMENT
SCROLL TO CONTINUE
  1. Applying many of the privacy and security standards to business associates;
  2. Subjecting business associates to the breach notification requirements; and
  3. Imposing civil and criminal penalties on business associates for HIPAA violations.

In addition, the HITECH Act strengthened the penalties and enforcement mechanisms under HIPAA, and required periodic audits to ensure that covered entities and business associates are compliant.

Expansion of Breach Notification Requirements

The Final Rule expands the breach notification obligations of covered entities and business associates by revising the definition of “breach” and the risk assessment process for determining whether notification will be required. Under the Final Rule, a use or disclosure of unsecured PHI that is not permitted under the Privacy Rule is presumed to be a breach (and therefore requires notification to the individual, OCR, and possibly the media) unless the incident satisfies an exception* or the covered entity or business associate demonstrates a low probability that PHI has been compromised. This risk analysis is based on at least the following four factors:

Pages: 1 2 3 | Single Page

Filed Under: Legal, Legislation & Advocacy Tagged With: Department of Health and Human Services, HIPAA, Legal, protected health information, violationIssue: April 2013

You Might Also Like:
  • HHS Enforces Stricter Rules on HIPAA
  • Omnibus Rule Compliance Deadline Imminent
  • HIPAA Security Standards: What Rheumatologists Need to Know
  • Legal Updates: Healthcare Data Privacy and Security under HIPAA

Rheumatology Research Foundation

The Foundation is the largest private funding source for rheumatology research and training in the U.S.

Learn more »

Patient & Caregiver Resources

Find a rheumatology provider. Learn about your condition and how to live with it. English and Spanish language resources.

View Patient & Caregiver Resources »

American College of Rheumatology

Visit the official website for the American College of Rheumatology.

Visit the ACR »

The Rheumatologist newsmagazine reports on issues and trends in the management and treatment of rheumatic diseases. The Rheumatologist reaches 11,500 rheumatologists, internists, orthopedic surgeons, nurse practitioners, physician assistants, nurses, and other healthcare professionals who practice, research, or teach in the field of rheumatology.

About Us / Contact Us / Advertise / Privacy Policy / Terms of Use / Cookie Preferences

  • Connect with us:
  • Facebook
  • Twitter
  • LinkedIn
  • YouTube
  • Feed

Copyright © 2006–2023 American College of Rheumatology. All rights reserved.

ISSN 1931-3268 (print)
ISSN 1931-3209 (online)