HIPAA.com cofounder Ed Jones is a consultant and author of books on healthcare privacy, security, and electronic health records. He was an SVP at an NYSE-traded health plan insurer and held senior roles at the US Department of Justice and the CIA.
February 13, 2013. Today, we finish examining (3)—the third paragraph of four—of the business associate definition, as modified by the Final Rule: Modifications to the HIPAA Privacy, Security,
February 12, 2013. Today, we examine the role of the personal health record vendor in paragraph (3)—the third paragraph of four—of the business associate definition, as modified by
February 11, 2013. Today, we start to examine (3)—the third paragraph of four—of the business associate definition, as modified by the Final Rule: Modifications to the HIPAA Privacy,
February 8, 2013. Today, we examine (1) and (2)—the first two parts of four—of the business associate definition, as modified by the Final Rule: Modifications to the HIPAA
February 7, 2013. Today, we provide the business associate definition, as modified by the Final Rule: Modifications to the HIPAA Privacy, Security, Enforcement, and Breach Notification Rules Under the Health
February 6, 2013. Today, we cover the business associate Administrative Safeguard (b) of the Security Rule, as modified by the Final Rule: Modifications to the HIPAA Privacy, Security, Enforcement, and
The 2013 Final Rule extended the Security Rule’s general requirements and administrative safeguards to business associates. What changed in 45 CFR 164.306 and 164.308(a), from risk analysis to workforce termination procedures.
Before 2013, business associates only promised contractual safeguards. The HITECH Act and the Final Rule made them directly subject to the Security Rule’s administrative, physical, and technical safeguards, along with its penalties.
February 1, 2013. Today, we wrap up discussion of breach notification in the Final Rule: Modifications to the HIPAA Privacy, Security, Enforcement, and Breach Notification Rules Under the Health Information
Key breach notification changes in the 2013 Final Rule: risk assessments now required for limited data sets, who notifies when a business associate has the breach, why a website press release doesn’t count as media notice, and the deadlines for reporting to HHS.
PHI that’s encrypted or destroyed according to HHS guidance isn’t “unsecured,” so an impermissible disclosure doesn’t trigger breach notification. How the Final Rule defines unsecured PHI and why encryption is your best safe harbor.
Under the Final Rule, an impermissible use or disclosure of PHI is presumed to be a breach unless a risk assessment shows a low probability of compromise. The four factors you must weigh, with examples from the rule.
