HIPAA Breach Notification — Compliance Action Plan

September 15, 2009 By

With the September 23, 2009 effective date for the new HIPAA breach notification requirements rapidly approaching, health care organizations must move now to address compliance obligations.

The slide deck below (from a presentation for the Washington State Hospital Association I gave on September 16th) contains a summary of the rule along with a Compliance Action Plan outlining key steps to address requirements under the rule.

HHS indicated they will exercise their “enforcement discretion” over the next several months given the tight time frame.  That said, in light of the increased civil penalties passed as part of the HITECH Act and now in effect, covered entities should work to implement a compliance action plan now rather than rely on such “enforcement discretion” later.

Filed Under: HIPAA, HITECH Tagged With:

HIPAA Breach Notification Rules Issued

August 20, 2009 By

On August 19th, HHS issued new rules requiring HIPAA covered entities to notify individuals when their health information is breached.  The breach notification rules implement provisions of the HITECH Act, passed as part of the federal stimulus legislation in February.  A full copy of the new rules is available here.

The breach notification requirements will become effective on September 23rd, 2009.

Significant changes to HIPAA include:

  • Notice must be provided to individuals within 60 days from discovery of a breach.
  • The notice must contain detailed elements specified in the rules.
  • For breaches involving more than 500 individuals, the notice must notify “prominent media outlets”, as well as HHS, within 60 days.
  • All breaches must be reported to HHS on an annual basis. 
  • Covered entities must change policies and procedures as necessary to comply with these new rules.
  • Workforce members must be trained about the impact of the new data breach requirements.

Note that the policy development and training requirements apply to all covered entities. 

In addition, the regulations contain updated guidance on what it will take to adequately secure (whether through encryption or otherwise) health information in order to minimize the impact of the notification rules. 

Health care organizations need to move quickly to ensure compliance with these complex new rules in an extremely compressed time frame.

Filed Under: HIPAA, HITECH Tagged With: , ,
«Previous Page