Covered Entities and Business Associates Beware: New HIPAA Rules Finally Issued
The Department of Health and Human Services (HHS) released on Thursday, January 17, 2013, its omnibus final rule, making significant modifications to the Health Insurance Portability and Accountability Act (HIPAA) Privacy, Security, Enforcement, and Breach Notification Rules. In an HHS press release, Secretary Kathleen Sebelius elaborated on the need for these updates, stating, “[m]uch has changed in health care since HIPAA was enacted over fifteen years ago…. The new rule will help protect patient privacy and safeguard patients’ health information in an ever expanding digital age.” This comprehensive update to the Privacy, Security, Enforcement and Breach Notification Rules has been long expected and is very important.
Key provisions in the new rule include:
-
Modifications to the HIPAA Privacy, Security, and Enforcement Rules mandated by the Health Information Technology for Economic Clinical Health (HITECH) Act;
-
Changes to the HIPAA Enforcement Rule to incorporate the increased and tiered civil money penalty structure provided by the HITECH Act;
-
Final rule on Breach Notification for Unsecured Protected Health Information under the HITECH Act; and
-
Final rule modifying the HIPAA Privacy Rule as required by the Genetic Information Nondiscrimination Act (GINA).
These new rules will become effective on March 26, 2013, but Covered Entities and Business Associates will have until September 23, 2013 to come into compliance.
Over the next few weeks, we will be analyzing all of the changes to HIPAA that are incorporated into the 560+ page rule and issuing a series of summaries to help our clients understand how these changes will affect them and what they need to do to comply. We encourage you to read these summaries and begin undertaking the steps necessary to comply with these new rules.
© TROUTMAN SANDERS LLP. ADVERTISING MATERIAL. These materials are to inform you of developments that may affect your business and are not to be considered legal advice, nor do they create a lawyer-client relationship. Information on previous case results does not guarantee a similar future result. Follow Troutman Sanders on Twitter.