Feds Issue New HIPAA Data Breach Rules

For health care providers, health plans and other entities -- including business associates of covered entities -- that do not encrypt their health IT data, new regulations require prompt notifications to consumers in the event of a data breach.

The U.S. Department of Health and Human Services has issued new regulations requiring health care providers, health plans and other entities covered by HIPAA (Health Insurance Portability and Accountability Act) to notify individuals when their health information is breached. The breach notifications were part of the American Recovery and Reinvestment Act of 2009 passed earlier this year by Congress.

The regulations require health care providers and other HIPAA-covered entities to promptly notify affected individuals of a breach. In cases involving more than 500 individuals, covered entities are required to also notify the HHS and the media. Breaches affecting fewer than 500 individuals will be reported to the HHS Secretary on an annual basis.

Resource Library:

The new regulations also require business associates of covered entities to notify the covered entity of breaches at or by the business associate.

"This new federal law ensures that covered entities and business associates are accountable to the Department and to individuals for proper safeguarding of the private information entrusted to their care," Robinsue Frohboese, acting director and principal deputy director of the HHS Office of Civil Rights, said in a statement. "These protections will be a cornerstone of maintaining consumer trust as we move forward with meaningful use of electronic health records and electronic exchange of health information."

Entities subject to the HHS and FTC (Federal Trade Commission) regulations that secure health information through encryption or destruction are not subject to the HHS breach notifications.

In conjunction with the HHS regulations, the FTC also has issued companion breach notification regulations that apply to vendors of personal health records and certain others not covered by HIPAA.

 

Reader Comments: Feds Issue New HIPPA Data Breach Rules >>> Post your comment now! How much is to much? Is there a CISSP out there who will let me know? Posted At: 09-03-09 By: Ralph Compliance considerations In our field, so often, companies are first inspired by compliance. Although compliance is certainly an important concern and risk to any... Posted At: 09-03-09 By: Joe Gater come-on Everyone is too security conscious. Where I work security is a determent more than insurance. Is the risk of doing business that is inundated with... Posted At: 09-02-09 By: Anonymous Where's the reference link Hey author - where's the embedded article link to the referenced Federal regulations issued? Posted At: 09-02-09 By: Anonymous What are you afraid of? This sort of deliberate paranoia gets no one anywhere. I work in health care IT and I can tell you there is no government connections to any of our... Posted At: 09-02-09 By: Health care IT for 25 years A user comment on this article Who cares about HIPAA privacy with socialized "health"care coming? The government clerics will have ALL your information at their fingertips (ask... Posted At: 09-02-09 By: ex-Democrat healthcare data security New breach notification rules are not the only new health data security law in the American Recovery and Reinvestment Act. When you read all of... Posted At: 09-02-09 By: Benjamin >>> Post your comment now!

>>> More Health Care IT Articles          >>> More By Roy Mark