We use cookies to give you the best online experience. By using our website you agree to our use of cookies in accordance with our cookie policy. Learn more here.Close Me
The final regulations1 from Department of Health and Human Services
Office of Civil Rights (OCR) containing modifications to the HIPAA
Privacy, Security, Enforcement, and Breach Notification Rules
(Omnibus Rule) have finally been released, but the hard work of
interpreting them has just begun for covered entities, business
associates, and downstream entities of business associates, all of
whom are significantly affected by the rule.
OCR Director Leon Rodriguez declared that the new provisions in
the Omnibus Rule "not only greatly enhance a patient's
privacy rights and protections, but also strengthen the ability of
[OCR] to vigorously enforce the HIPAA privacy and security
protections2 The official press release announcing the Omnibus
Rule confirms agency enforcement positions previously hinted at by
HIPAA-related agency leaders, such as extending liability under
HIPAA to business associates and subcontractors. But additionally,
the press release gives the following preview to the other
"sweeping changes" under the rule, including:
streamlined authorization requirements for the use of
individuals' health Finally! HHS Office Of Civil Rights
Releases HIPAA Omnibus Rule With Sweeping Changes To Compliance
Requirements And Enforcement
information for research purposes;
new limits on permissible uses of information for marketing and
fundraising purposes; and
prohibitions on the sale of individuals' health information
without their permission.
Mintz Levin's initial impressions of the Omnibus Rule
include the following:
No Mercy for Business
Associates:
As expected, business associates now have direct liability
under HIPAA and must comply with all of its security and certain
privacy standards. OCR did not provide business associates
additional time to comply, despite requests for time submitted
during the public comment period.
Business associate subcontractors (vendors of business
associates) have identical compliance obligations, no matter how
removed or how "downstream" their services are from a
covered entity.
Existing business associate agreements must be updated for
compliance with the revisions in the Omnibus Rule, but they can
continue to operate under certain existing contracts until
September 23, 2014 (one year after the date required for compliance
with the Omnibus Rule).
Dramatic Changes to Marketing Activity
Requirements: The Omnibus Rule now requires that
prior to sending any marketing materials to an individual relating
to a product or service paid for by a third party, the covered
entity sending the communication must obtain individual
authorization to receive such communications. OCR removed the
distinctions between authorization requirements for communications
relating to treatment versus those for health care operations
included in its proposed rule.
Breach Analysis Changes: The Omnibus
Rule requires a potential breaching party to perform a four-factor
risk assessment to determine whether the breach must be reported,
with the effect of significantly reducing a covered entity's
discretion regarding whether or not a breach must be disclosed to
affected individuals, the government, and potentially the
media.
Family Access to Decedents' Personal Health
Information (PHI): Family members of a decedent who
were involved in the person's care prior to his or her death
may now access the decedent's PHI.
Mintz Levin's Health Law Practice is actively preparing a
variety of educational materials and resources for covered
entities, business associates, and downstream entities affected by
the Omnibus Rule. The first of these materials will be a chart
comparing the differences between the proposed and final rules to
be published early next week.
Footnotes
1. HHS Office of Civil Rights, "Modifications to the
HIPAA Privacy, Security, Enforcement, and Breach Notification Rules
under the Health Information Technology for Economic and Clinical
health Act and the Genetic Information Nondiscrimination Act;
Other Modifications to the HIPAA Rules" (to be published Jan.
25, 2013), available at: http://www.ofr.gov/OFRUpload/OFRData/2013-01073_PI.pdf.
The content of this article is intended to provide a general
guide to the subject matter. Specialist advice should be sought
about your specific circumstances.
To print this article, all you need is to be registered on Mondaq.com.
Click to Login as an existing user or Register so you can print this article.
The 2010 theft of an unencrypted laptop containing confidential health care information made front-page news in 2013, not because a huge number of patients were affected, but for the exact opposite reason.
Identity theft is a serious threat. In 2012, more than 12.6 million adults became victims of identity theft in the U.S.1 And the costs have been astronomical.
On April 22 Verizon released its 2013 Data Breach Investigations Report (DBIR), which has since 2008 become a leading annual survey of data breaches, with participants across the globe.
Increasingly, privacy is a big concern in app development. California and other jurisdictions are ramping up enforcement efforts around existing privacy laws.
Understanding the complexities of the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy and Security Rules is often a challenge for health care providers and consumers.
Any company that collects personal data from consumers should take proactive steps to have appropriate legal counsel review its data security practices, as well as its terms of service or privacy practices, to identify any potential problem areas.
The U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR) published on its website a series of factsheets designed to educate consumers unfamiliar with their rights under the Health Insurance Portability and Accountability Act’s (HIPAA) Privacy and Security Rules.
Steven Tyler: Paparazzi Problem In Hawaii Shouldn’t Be Ignored (Video Content)
