HIPAA.com cofounder Ed Jones is a consultant and author of books on healthcare privacy, security, and electronic health records. He was an SVP at an NYSE-traded health plan insurer and held senior roles at the US Department of Justice and the CIA.
June 7, 2013. Today, HHS published in the Federal Register "Technical Corrections to the HIPAA Privacy, Security, and Enforcement Rules" that were published on January 25, 2013, as
The Final Rule took effect March 26, 2013, with 180 days to comply. How the 180-day rule works for future HIPAA changes, which deadlines didn’t move, and the longer transition for existing business associate agreements.
How the 2013 Final Rule changed delivery of the Notice of Privacy Practices: when health plans must post or mail a revised notice after a material change, what stays the same for providers, and how to keep notices accessible.
March 22, 2013. Today, we continue going through the HIPAA Privacy Rule, section by section, as modified in the Final Rule: Modifications to the HIPAA Privacy, Security, Enforcement, and Breach
Providers may share a deceased patient’s PHI with family members or others who were involved in their care or payment, limited to what’s relevant and never against the patient’s known wishes. The Final Rule’s change, with examples.
The Final Rule limits Privacy Rule protection of a deceased person’s PHI to 50 years after death. Why HHS chose 50 years, how stricter state laws still apply, and why it isn’t a record-retention requirement.
What every business associate contract must include under the Final Rule: permitted uses, required safeguards, breach reporting, subcontractor terms, and return or destruction of PHI at termination, plus the alternatives for government entities.
A covered entity may share PHI with a business associate once it has written assurance the PHI will be protected. The Final Rule extends that chain to subcontractors: each business associate must get the same assurances from its own.
A covered entity or business associate can’t sell PHI without patient authorization. What counts as a “sale” under the Final Rule (including licenses and nonfinancial perks), what doesn’t, and the exceptions for research, public health, and mergers.
March 6, 2013. Today, we continue going through the HIPAA Privacy Rule, section by section, as modified in the Final Rule: Modifications to the HIPAA Privacy, Security, Enforcement, and Breach
March 5, 2013. Today, we continue going through the HIPAA Privacy Rule, section by section, as modified in the Final Rule: Modifications to the HIPAA Privacy, Security, Enforcement, and Breach
March 4, 2013. Today, we start going through the HIPAA Privacy Rule, section by section, as modified in the Final Rule: Modifications to the HIPAA Privacy, Security, Enforcement, and Breach
