# HIPAA.com > Expert resources to assist with HIPAA law, HITECH Act requirements, and security and privacy compliance. Public Ghost content for AI and LLM tooling. This file includes a bounded export of public pages first, then recent public posts. Append `.md` to any post or page URL to get the content in Markdown (for example, `/example-post.md`). ## Pages ### Our Contributors URL: https://hipaa.com/writers/ Last updated: 2026-10-25T20:52:00.000Z **Interested in contributing to HIPAA.com? Let's talk.** ### Privacy URL: https://hipaa.com/privacy/ Last updated: 2009-01-13T01:54:45.000Z HIPAA, LLC (“Company”) is committed to protecting the privacy of its customer's personal information. This statement applies with respect to the information that the Company collects from the Company Web site, located at HIPAA.com. Amendments to this privacy policy will by posted to this URL and will be effective when posted. Your continued use of this site following the posting of any amendment, modification, or change shall constitute your acceptance thereof. I. The materials in this site are provided "as is" and without warranties of any kind, either express or implied. To the fullest extent permissible pursuant to applicable law, we disclaim all warranties, express or implied, including, but not limited to, implied warranties of merchantability, fitness for a particular purpose and noninfringement. We do not warrant that the functions contained in the materials on any linked site will be uninterrupted or error-free, that defects will be corrected, or that any site or the servers that make such materials available are free of viruses or other harmful components. We do not warrant or make any representations regarding the use or the results of the use of the materials on any site in terms of their correctness, accuracy, reliability, or otherwise. You assume the entire cost of all necessary servicing, repair, or correction. Applicable law may not allow the exclusion of implied warranties, so the above exclusion may not apply to you. II. INFORMATION COLLECTED The Company collects non-personally identifiable information about you in a number of ways, including tracking your activities through your email (IP) address, computer settings, or most-recently visited URL. The Company may also ask you to provide certain non-personally identifiable information about yourself, such as your age, household income, buying preferences, etc. The Company does not collect any personally identifiable information about you unless you voluntarily submit such information to the Company, by, for example, filling out a survey or registration form on HIPAA.com. The types of information that may be requested include your name, address, email address, and telephone number. III. USE OF INFORMATION In general, the Company will only use the information you provide to it for the purpose for which such information was provided. The Company may also use this information to deliver to you information about the Company and promotional material from some of its partners, trend analysis, pattern detection, and site administration. Your information may also be used to contact you when necessary and may be shared with other entities that may want to contact you with offers consistent with your stated preferences. Users may opt out of receiving future mailings from the Company and other entities by following the instructions set forth in the opt-out section below. Non-personal demographic and profile data are used to tailor your experience at HIPAA.com, showing you content the Company believes may be of interest to you. This information may also be shared with advertisers on an aggregate non-personal basis. IV. USE OF EMAIL (IP) ADDRESSES The Company may use your email (IP) Address to help diagnose problems with the Company’s server, and to administer its Web site. V. USE OF COOKIES When you view the Company’s Web site, the Company may store some information on your computer. This information will be in the form of a “cookie” or similar file. Cookies are small pieces of information stored on your hard drive, not on the Company’s Web site. Cookies do not spy on you or otherwise invade your privacy, and they cannot invade your hard drive and steal information. Rather, they help you navigate a Web site as easily as possible. The Company uses cookies to deliver content specific to your interests and to prevent you from reentering all of your registration data at each connection. The Company uses an outside advertisement server company to display ads on its site. These advertisements may contain cookies. The advertisement server company may collect cookies received with outside banner ads. The Company does not have access to information that would confirm the use of cookies by the advertisement server company. VI. SECURITY The Company’s Web site has industry standard security measures in place to protect the loss, misuse, and alteration of the information under its control. While there is no such thing as “perfect security” on the Internet, the Company takes reasonable steps to insure the safety of your personal information. VII. OTHER WEB SITES; LINKS The Company’s Web site contains links to other Web sites. The Company is not responsible for the privacy practices or the content of linked Web sites. VIII. CHOICE; OPT OUT You may opt out of receiving communications from the Company and its partners by sending an email to webmaster@stg-hipaacom-staging.kinsta.cloud. Contacting the Company If you have any questions about this Company privacy statement, the practices of this Web site, or your dealings with this Web site, you may contact the Company at webmaster@stg-hipaacom-staging.kinsta.cloud. ### Contact HIPAA.com URL: https://hipaa.com/contact/ Last updated: 2026-10-26T04:54:35.000Z We’d like to hear from you, whether it’s a question, a story tip, a correction, or an idea for improving the site. [Email the HIPAA.com Team](mailto:hello@hipaa.com) Interested in advertising or sponsorship? See our [Advertise](https://hipaa.com/advertise/) page. ### About HIPAA.com URL: https://hipaa.com/about/ Last updated: 2026-10-24T21:57:31.000Z The Health Insurance Portability and Accountability Act (HIPAA) establishes national standards for electronic health care transactions. HIPAA reflects a move away from cumbersome paper records and an increased emphasis on the security and privacy of health data. But HIPAA’s magnitude and complexity can sometimes be overwhelming for healthcare providers, compliance officers and other affected professionals. And because the Department of Health and Human Service’s Office of Civil Rights conducts periodic enforcement audits, it’s vital that your healthcare business and its workforce meet all HIPAA standards for ensuring patient data security and privacy. Complying with HIPAA requirements is the sure way to sidestep passive violations that can result in civil fines and avoid active disclosures—such as by selling, transferring, or using individually identifiable health information for commercial advantage, personal gain or malicious harm—that can trigger criminal penalties. HIPAA.com is here to help you meet HIPAA’s challenges by keeping you current with practical documentation, high-quality resources, and expert commentary. Better still, we pledge to offer *actionable plain-English guidance* that cuts through HIPAA jargon and makes confusing provisions easy to grasp and fulfill. ### Advertise with HIPAA.com URL: https://hipaa.com/advertise/ Last updated: 2026-10-26T03:15:17.000Z Since 2009, HIPAA.com has published practical guidance on HIPAA privacy, security, breach notification, and business associates for healthcare organizations and the companies that serve them. **Who reads HIPAA.com** Our readers are healthcare providers and their staff, business associates and the vendors who work with them, and the attorneys, consultants, and compliance professionals who advise them. **Opportunities** - **Sponsored content:** Educational articles, clearly labeled as sponsored, published alongside our editorial content. - **Display placements:** Placements across the site or within specific topics. - **Newsletter sponsorship:** Reach readers directly in their inbox. Sponsored content has to be useful to our readers, and HIPAA.com's editorial content stays independent of advertisers. **Get in touch** To discuss options and current rates, email [team@hipaa.com](mailto:team@hipaa.com). ### Disclaimers URL: https://hipaa.com/disclaimer/ Last updated: 2026-10-25T21:33:56.000Z This website is made available by the publisher for educational purposes only as well as to give you general information and a general understanding of the law. It is not intended to provide specific legal advice to your individual circumstances or legal questions. You acknowledge that neither your reading of, nor posting on, this blog site establishes an attorney-client relationship between you and the website publisher or any law firm, or any of the attorneys with whom, the host is affiliated. This website should not be used as a substitute for seeking competent legal advice from a licensed professional attorney in your state. Readers of this information should not act upon any information contained on this website without seeking professional counsel. ### Featured Topics URL: https://hipaa.com/topics/ Last updated: 2026-10-26T02:38:41.000Z HIPAA covers a lot of ground, but most questions land in a few places: What counts as a breach, and who has to be notified? Which vendors need a business associate agreement? What do the Privacy and Security Rules actually require? Start with the featured topics below, or [browse all topics →](https://hipaa.com/all-topics/) ### All Topics URL: https://hipaa.com/all-topics/ Last updated: 2026-10-26T02:45:14.000Z HIPAA.com’s articles are organized into topics, each covering one part of the law: the Privacy and Security Rules, breach notification, business associates, enforcement, the standards for electronic transactions and code sets, the rulemaking behind it all, and workforce training. Pick a topic below to see every article in it, or go back to the [featured topics →](https://hipaa.com/topics/) for the places most readers start. ### Sidebar URL: https://hipaa.com/banner-sidebar/ Last updated: 2026-10-26T03:39:54.000Z ### Get HIPAA.com in your inbox Practical guidance on HIPAA privacy, security, breach notification, and enforcement. No spam, unsubscribe anytime. Subscribe Check your inbox to confirm your subscription. Something went wrong. Please try again. ## Posts ### Contracting with Vendors that are Not HIPAA Business Associates: Best Practices URL: https://hipaa.com/contracting-with-vendors-that-are-not-hipaa-business-associates-best-practices/ Last updated: 2026-10-25T19:56:49.000Z Health care providers and health insurance companies are generally aware that when protected health information (“PHI”) is disclosed to a vendor, such as an attorney, consultant or cloud data storage firm, a business associate agreement is necessary to comply with HIPAA and to safeguard the information disclosed. However, not all vendors will be business associates, even when such vendors may have potential access to PHI, and health care providers and insurers often struggle with how to manage risks to PHI in these relationships. The following FAQs address these issues and my solutions for managing and mitigating risk in an efficient and cost-effective manner. **Who are non-business associate vendors?** Generally, a vendor is not a business associate if it does not receive, use, disclose or maintain PHI. The key risk though is that these vendors may still have potential access to an organization’s PHI. Examples include the following: - An IT vendor that will have access to hospital information systems to install, update or maintain malware protection. - A cleaning service which has access to staff offices, medical record rooms or other areas in which PHI may exist. - A software company that licenses a locally hosted program that utilizes or processes PHI, and that may need access to local information systems for installation or troubleshooting. - A consultant who is granted limited access to quality, compliance or other internal reports that include only aggregate information but who may be working in a medical records storage area or be logged into the local network. **What harm can these vendors cause?** Failure to manage data privacy risks with non-business associate vendors may lead to both violations of HIPAA and state privacy laws. Let us consider a recent example to illustrate the importance of addressing data privacy and HIPAA concerns with vendors who are not business associates: Health care provider engages a local IT security firm to install patches. Parties agree that vendor is not a business associate. While in the provider’s information system, a newly hired vendor employee stumbles upon locally maintained patient and employee records. Bored, he starts reviewing the records and finds a former classmate of his. He copies the records to a USB drive and emails the records to the former classmate. Several weeks later, the former classmate contacts the state attorney general and says “look what the provider gave \[the employee\] access to.” Vendor employee failed to appreciate the seriousness of the access (no privacy training provided), was under no obligation to report the access to employer, and vendor had no obligation to notify, indemnify, reimburse or cooperate with the provider. Provider was found to be in violation of both HIPAA and state privacy law and regulators required an extensive corrective action plan. **What strategies should a health care provider or insurer pursue to manage the risk caused by non-business associate vendors?** I generally advise clients to pursue a 3-part strategy addressing organizational policies, due diligence and confidentiality agreements: 1. Organizational Policies: Avoid limiting privacy and security policies to only HIPAA compliance - while very important, HIPAA is not the only privacy and security concern a health care provider or insurer should have. Policies should also consider proprietary information, trade secrets and state privacy laws. Further, ensure that privacy and security polices apply to all vendors, not merely those subject to HIPAA. 2. Due Diligence: Consider implementing a vendor-screening tool as part of your contracting process and make data privacy and security a factor when choosing vendors. The purpose of the screening tool is to obtain vendor assurances regarding privacy, receive comfort that the vendor is cognizant of and is addressing privacy concerns and to periodically monitor vendor privacy efforts (such as through annual certifications). 3. Confidentiality Agreements: Develop a specific template confidentiality agreement for non-business associate vendors, the terms of which should reflect the risk profile of the organization (Note: a standard non-disclosure agreement is generally insufficient for this purpose). Ensure a focus on confidentiality obligations, compliance with laws and policies, incident reporting and reimbursement. ### HIPAA Breach: Who You Gonna Call? URL: https://hipaa.com/who-do-i-call-for-a-hipaa-data-breach/ Last updated: 2026-10-25T20:00:54.000Z Everyone knows that you call a plumber for a leaking pipe, a mason for a cracked stonewall, and an electrician to fix faulty wiring. However, when faced with an actual or suspected HIPAA data breach, many folks struggle with determining whom to call. Failure to have contacts lined up ahead of time may pose more than an inconvenience–any delay in bringing in experienced advisors to assist with breach investigation, response and mitigation may result in significant financial and legal consequences. HIPAA covered entities and business associates should have a written breach response policy and protocol. The policy and protocol should provide clear guidance to the covered entity’s or business associate’s staff regarding how to respond to an actual or suspected breach. Among other things, the policy and protocol should include a roster of resources staff persons may rely upon, including legal counsel, forensic and IT consultants, public relations/marketing professionals, and human resources advisors. Given the necessity of responding to a breach promptly, covered entities and business associates should not wait for a breach to occur in order to start assembling a team. In light of the risk of lawsuits or government enforcement, the first call to make should be to an attorney experienced in data privacy matters. The value in contacting an experienced attorney, aside from expertise in the legal requirements imposed by HIPAA and other state and federal laws that may apply, is that bringing in an attorney at the start may allow the covered entity or business associate to protect the subsequent breach investigation and response under attorney-client privilege. By doing so, the covered entity or business associate may be able to protect the confidentiality of damaging facts (such as investigatory reports citing failures in the covered entity’s or business associate’s privacy safeguards) from plaintiff’s counsel seeking to sue for damages. While there is no guarantee that asserting attorney-client privilege will be successful in all instances, having an attorney involved and directing the investigation from the start is often the only chance a covered entity or business associate has at protecting damaging information from litigants and the public. Aside from legal counsel, covered entities and business associates should have a list of trusted forensic and IT consultants. When electronic protected health information (ePHI) is involved, consultants experienced in HIPAA matters are necessary. They may be needed to investigate a hack or ransom-ware attack; audit the online activities of a rogue employee; report on what information may have been on a lost or stolen mobile device; or recover data from a damaged hard drive. Data breaches often result in considerable media attention, particularly when notice to the media is required. Protection of an entity’s reputation is crucial to retain customer and public trust and the service of a media relations professional is often invaluable. If employees are involved in the breach, seek advice from an HR professional prior to conducting employee interviews, sanctions or termination - particularly if a unionized workforce is involved. A HIPAA breach is like a fire drill - you need to respond quickly and cannot ignore the warnings. Having the right team in place ahead of time will ensure a timely, appropriate and cost-effective response to the breach. ### Can I Be Sued for a HIPAA Violation? URL: https://hipaa.com/can-i-be-sued-for-a-hipaa-violation/ Last updated: 2026-10-24T21:32:51.000Z I am asked that question almost weekly. While the answer has traditionally been “no,” the legal landscape is shifting and the risk of being sued continues to increase. Let’s first start with some background. As some of you may know, HIPAA does not include a “private right of action.” This means that an individual may not file a claim against a covered entity or a business associate in order to enforce HIPAA or seek damages in response to a HIPAA violation. For example, a patient is not able to sue a dentist if the dentist fails to distribute a Notice of Privacy Practices or enter into a business associate agreement. The sole remedy of an aggrieved individual is to file a complaint with the United States Department of Health and Human Services Office for Civil Rights (“OCR”) or, more recently, with a state Attorney General. In addition, in some states, individuals have been able to file complaints regarding generalized privacy concerns with various state regulatory agencies, such as a state health or consumer protection department. With respect to OCR, notification of the right to file a complaint and the process for doing so is generally set forth in a covered entity’s Notice of Privacy Practices. Since HIPAA was enacted, the lack of a private right of action has provided solace to covered entities and business associates, particularly since complaints tend to be few in number. Moreover, OCR investigations of complaints have often resulted in compliance agreements and consent orders, rather than court actions or civil damages, both of which would require the covered entity or business associate to expend considerable sums on attorney fees, court costs and payment of damages. While there is no hint at this time that Congress is contemplating including a private right of action in HIPAA (i.e. allowing individuals to sue to enforce HIPAA), aggrieved patients and their counsel have been finding other ways to file claims for HIPAA violations and use HIPAA violations as the basis for seeking monetary damages. For example, in some states, patients have filed suit against health care providers on the grounds of negligence - claiming that the provider was negligent when violating HIPAA and thus must be held liable for damages. A recent example from Connecticut illustrates the way these lawsuits operate: A physician received a subpoena for medical records. The physician supplied the medical records as requested by the subpoena; however, the subpoena did not comply with HIPAA. The subject of the medical records sued, alleging that HIPAA creates a “standard of care” for all health care providers and that the failure of the physician to adhere to that standard of care was “negligent.” The physician sought to block the suit but the Connecticut Supreme Court allowed it to continue. As of this date, the lawsuit is making its way through the Connecticut state courts. In addition, lawsuits are currently being prepared and filed in response to the recent Anthem breach and many will be claiming negligence or violation of various state privacy or insurance regulations. These types of lawsuits would have been unheard of even just a few years ago. However, while still not widespread or common, the emergence of these suits poses significant risk management and liability concerns for any health care provider, health insurance company or vendor subject to HIPAA. The risk of a lawsuit is most pertinent to HIPAA violations which may cause financial, reputational or other harm to a party. Hypothetical examples, based upon real life incidents, include: - Inappropriate disclosure of medical records in response to a subpoena, which causes a former patient to lose custody of her children. - Inappropriate disclosure of a child’s medical record to an estranged parent after the health care provider failed to verify the estranged parent’s authority to access records, which leads to the estranged parent to discover where the child now resides. - Inappropriate use of medical records by hospital staff as part of a “hot or not” game which causes severe embarrassment and distress to certain patients. A negligent attorney and an angry patient could potentially make a claim based upon any of the above and may seek a significant financial settlement or payout. In light of the potential for such lawsuits and the significant damages that may be awarded, covered entities and business associates should consider reviewing their HIPAA compliance programs to identify weaknesses and institute safeguards and protocols to reduce the likelihood of inappropriate disclosures that may lead to a patient filing suit. Such safeguards may include, based upon the above examples, a subpoena review checklist, verification procedures, a reliable reporting protocol or other procedures to allow the entity or its staff to verify that information is being used and disclosed appropriately. \[showhide type="contact\_form" more\_text="Click here to contact William privately" less\_text="Hide contact form"\]\[/showhide\] ### Business Associate Agreements: a First Look at Indemnification URL: https://hipaa.com/business-associate-agreements-a-first-look-at-indemnification/ Last updated: 2026-10-25T21:31:24.000Z A party’s responsibilities under HIPAA generally come from two sources - the law itself and the business associate agreement entered into between the covered entity (the health care provider or health plan) and the business associate (its vendor). While all parts of a business associate agreement are important, there are certain terms that are most likely to affect the parties’ liability and obligations. One of these key terms is \[glossary\]*indemnification*\[/glossary\], and it is often the section of the business associate agreement that lawyers most often fight over. Folks often wonder why lawyers tend to focus so much on this section, and the short answer is that when things go wrong--such as a data breach or HIPAA violation--indemnification is the clause which that determines who pays, when they must pay, and how much they owe. In other words, it’s the money clause. Indemnification is the concept through which the party at fault makes the other party whole; in other words, the party at fault will pay the costs, expenses, fines, and losses that the other party incurs. While many underlying agreements will address indemnification (such as a service agreement or consulting agreement), it is often best to address indemnification in the business associate agreement and how it specifically applies to the use and disclosure of protected health information (PHI). Your goal is to not incur costs or damages due to the act or omission of the other party, or to at least limit your exposure to such costs. The costs and damages a party is typically most worried about are those incurred due to a data breach or HIPAA violation by the other party, such as attorney fees, notification costs, credit monitoring, or fines. Let’s take an example of a typical data breach to demonstrate the importance of indemnification: City Hospital hires a consulting firm to provide it guidance with improving patient outcomes. As part of the engagement, a consultant downloads a list of patient records to a laptop. Unbeknownst to the consultant, IT mistakenly failed to encrypt the laptop. While in an airport, the laptop is stolen. The consultant reports the breach to her employer and the hospital is notified. When notice of the stolen laptop reaches a hospital executive or executive director of the consulting firm, one of the first questions asked will be: "what is this going to cost us?" When faced with a data breach that can easily cost a health care facility six figures, the first place the facility and its attorneys will look is to the indemnification clause. This paragraph will tell them who is responsible to pay the costs of the data breach (does the hospital pay or the consultant?), how much the obligated party must pay (if the consultant must pay, is there a cap?), and which costs the obligated must pay (if the consultant must pay, does the consultant need to pay the hospital’s attorney fees?) Moreover, what if the business associate lacks an indemnification clause? In that case, someone will need to inform the hospital’s CEO that the hospital may be unable to recover its costs, or may attempt to do so only at considerable expense. No one wants to be in the position of breaking such news to the CEO. In a future post, we will look at the most important issues to keep in mind when drafting indemnification clauses in order to appropriately protect your organization. \[showhide type="contact\_form" more\_text="Click here to contact William privately" less\_text="Hide contact form"\]\[/showhide\] ### Gmail, Google Apps for Business HIPAA Business Associate Agreements URL: https://hipaa.com/gmail-google-apps-for-business-hipaa-business-associate-agreements/ Last updated: 2026-10-25T21:26:49.000Z The Health Insurance Portability and Accountability of Act demands that all HIPAA covered businesses prevent unauthorized access to “Protected Health Information” or PHI. PHI includes patients’ names, addresses, and all information pertaining to the patients’ health and payment records. According to the Department of Health and Human Services, "[HIPAA Rules apply to covered entities and business associates](http://www.hhs.gov/ocr/privacy/hipaa/understanding/coveredentities/index.html?ref=hipaa.com)." Complete compliance with HIPAA guidelines requires implementation of basic and advanced security measures. Basic security includes benchmark-based password creation and use, personnel education and training, limited access to PHI, data encryption, use of firewalls, antivirus software, and digital signatures. With increasing adoption of electronic medical records and cloud-based software-as-service (SaaS), advanced security measures are necessary. Google's Business Associate Agreement, introduced in September 2013, offers HIPAA compliant online services for covered entities. ## Online Security: Google’s Business Associate Agreement Many healthcare businesses use Google Business Apps. Google Business Apps are cloud-based software-as-service (SaaS) where small businesses have access to a suite of Google services such as Gmail, Google Calendar, Docs, Drive (storage), Apps etc. Google uses Ernst and Young [third party evaluated and ISO 27001 certified](http://www.google.com/enterprise/apps/business/benefits.html?ref=hipaa.com) encryption and authentication. But despite these foundational precautions, not all components of GBA have a level of security necessary for HIPAA compliance. Enter Google's Business Associate Agreement (BAA). Google's Business Associate Agreement provides an additional layer of online safety by offering [HIPAA compliant security for users of Google Apps Vault, Gmail, Google Calendar, and Google Drive](https://support.google.com/a/answer/3407054?hl=en&ctx=go&ref=hipaa.com). Businesses that opt for this agreement are precluded from using any of the other services in the Google Business Apps package (such as Google Docs, Hangouts, Marketplace, websites, etc), under the domain registered with and covered by Google's Business Associate Agreement. Google's BAA guidelines state "[Customers who have not entered into a BAA with Google must not use Google services in connection with PHI](https://support.google.com/a/answer/3407054?hl=en&ctx=go&ref=hipaa.com)." The agreement requires that HIPAA covered businesses [sign up for a Google Apps for Business Administrator account.](https://support.google.com/a/answer/3407074?rd=2&ref=hipaa.com) ## Training Reduces Human Errors In addition to having the best online security, complete compliance requires implementation of solid procedures and policies, which includes training for staff members to prevent human errors. The Privacy and Security Rules require that healthcare businesses educate and train workers regarding policies and procedures for HIPAA compliance. Training requires experience and specialized knowledge that even the most advanced healthcare executive may not have. When evaluating HIPAA training services, make sure the company you choose provides a complete HIPAA training package and is knowledgeable about online security strategies. Training should be affordable, but also useful in other ways. For example, HIPAA training that offers CME and CEU credits is a good way to maintain compliance with HIPAA law while helping your employees maintain valuable credentials. ### The Reality of HIPAA Violations and Enforcement URL: https://hipaa.com/the-reality-of-hipaa-violations-and-enforcement/ Last updated: 2026-10-24T21:32:53.000Z Who is ultimately responsible for enforcement of HIPAA and what types of penalties are levied when a covered entity or business associate is found to be non-compliant with the regulations? Many healthcare offices and their staff don’t know the answer to this question; they have only a vague notion about the enforcement and the consequences of not adhering to the law. The real HIPAA enforcement agency is the U.S. Department of Health and Human Services (HHS), Office for Civil Rights (OCR). Complaints are filed with the OCR, and they are responsible for administering, investigating and enforcing the HIPAA privacy standards. The Centers for Medicare & Medicaid (CMS) enforce the code set and security standards. The American Recovery and Reinvestment Act of 2009 created a tiered penalty configuration for HIPAA violations. But it is the OCR that determines the amount of each penalty, and it is dependent upon the nature and extent of harm that results from the breach. For example: - The fine for a first time infringement by someone who did not know they violated HIPAA could be as low as $100 or as high as $50,000. - The fine for a violation due to willful neglect, but corrected within the required time period, is a minimum of $10,000 per violation with a maximum of $50,000. - The fine when the willful neglect violation is not corrected increases from $10,000 to $50,000. However, whenever there is a violation that is not considered willful neglect and it is corrected within 30 days of notice, the OCR [cannot impose the civil penalty](http://www.ama-assn.org/ama/pub/physician-resources/solutions-managing-your-practice/coding-billing-insurance/hipaahealth-insurance-portability-accountability-%20act/hipaa-violations-enforcement.page?ref=hipaa.com). A Privacy Rule infraction can be considered criminal and may lead to prosecution by the Department of Justice if someone deliberately acquires or discloses a person’s health information; the fine is $50,000 and up to one year in jail. Whenever an offense is committed through deception, the fine is $100,000 and the jail time is 5 years. And, if person’s health information was sold, transferred or used for profit-making, or any type of personal gain or intent to harm, [the fines can go as high as $250,000 with imprisonment for up to 10 years](http://www.hhs.gov/ocr/privacy/hipaa/understanding/summary/?ref=hipaa.com). Knowing that enforcement of HIPAA is real and that the penalties can be financially and professionally devastating, healthcare offices need to prioritize their training efforts for all of their staff. There truly is no excuse for any healthcare office not to be thoroughly trained in HIPAA law, because if they are found to be out of compliance HHS will not accept ignorance of the law as a defense. ### Five Steps to HIPAA Security Compliance URL: https://hipaa.com/five-steps-to-hipaa-security-compliance/ Last updated: 2026-10-25T21:05:22.000Z The health insurance portability and accountability act has set various guidelines, which should be adhered to by anyone who handles any electronic medical data. These guidelines stipulate that all medical practices must ensure that all necessary measures are in place while saving, accessing and sharing any electronic medical data to keep patient data secure . Lack of compliance to the HIPAA security standards could lead to large fines and in extreme cases even loss of medical licenses. Several steps can be followed by medical practices to ensure compliance to HIPAA standards. These steps include: Run a complete risk assessment of the medical practice Some medical practices adopted electronic health recording systems before there were clear guidelines on what these systems should contain. This means that a medical practice could be using electronic systems which are not compliant with HIPAA standards. To ensure HIPAA compliance a risk assessment should be done on the current systems using HIPAA standards and guidelines to highlight areas in which compliance is not enforced. A risk assessment against HIPAA guidelines exposes areas in which changes are needed. Prepare for disaster before it occurs All the data handled by a medical practice should be safe both from loss and corruption. One of the main ways of ensuring that data is not lost in case of any mishaps is backing up of medical data regularly. Data should be backed up in an offsite location such that in case of incidents such as fires in the medical premises the data backup is not destroyed, as well. Antivirus programs should also be installed in all computers to ensure that data is not corrupted or destroyed by computer viruses. Have an ongoing employee training program Any system is only as strong as its weakest link and in most cases untrained employees are the weakest links in medical practices. A medical practice could have a very secure encryption system, but if the employees don’t use their passwords to securely access records and files the encryption system is rendered useless, and anyone can gain access to these records. Medical practices should continually train their staff on how to follow the right security protocols to ensure data integrity and security. Buy medical products with security compliance and compatibility in mind New equipment bought for a medical institution should be compatible with existing systems and should offer enough security features. Some medical equipment may offer enough security features but may be incompatible with existing systems or vice versa. Thus before making any major purchases enough review of the product should be done to ensure both security and compatibility. Collaborate with affected parties Changes which need to be made to bring about HIPAA compliance affect many people in the medical practice. Affected departments should be consulted when making changes to ensure all parties affected by the changes are happy with the changes. The Health Insurance Portability and Accountability Act has set various guidelines, which should be adhered to by anyone who handles any electronic medical data. These guidelines stipulate that all medical practices must ensure that all necessary measures are in place while saving, accessing and sharing any electronic medical data to keep patient data secure . Lack of compliance to the HIPAA security standards could lead to large fines and in extreme cases even loss of medical licenses. Several steps can be followed by medical practices to ensure compliance to HIPAA standards. These steps include: **Run a complete risk assessment of the medical practice** Some medical practices adopted electronic health recording systems before there were clear guidelines on what these systems should contain. This means that a medical practice could be using electronic systems which are not compliant with HIPAA standards. To ensure HIPAA compliance a risk assessment should be done on the current systems using HIPAA standards and guidelines to highlight areas in which compliance is not enforced. A risk assessment against HIPAA guidelines exposes areas in which changes are needed. **Prepare for disaster before it occurs** All the data handled by a medical practice should be safe both from loss and corruption. One of the main ways of ensuring that data is not lost in case of any mishaps is backing up of medical data regularly. Data should be backed up in an offsite location such that in case of incidents such as fires in the medical premises the data backup is not destroyed, as well. Antivirus programs should also be installed in all computers to ensure that data is not corrupted or destroyed by computer viruses. **Have an ongoing employee training program** Any system is only as strong as its weakest link and in most cases untrained employees are the weakest links in medical practices. A medical practice could have a very secure encryption system, but if the employees don’t use their passwords to securely access records and files the encryption system is rendered useless, and anyone can gain access to these records. Medical practices should continually train their staff on how to follow the right security protocols to ensure data integrity and security. **Buy medical products with security compliance and compatibility in mind** New equipment bought for a medical institution should be compatible with existing systems and should offer enough security features. Some medical equipment may offer enough security features but may be incompatible with existing systems or vice-versa. Thus before making any major purchases enough review of the product should be done to ensure both security and compatibility. **Collaborate with affected parties** Changes which need to be made to bring about HIPAA compliance affect many people in the medical practice. Affected departments should be consulted when making changes to ensure all parties affected by the changes are happy with the changes. ### Dentists: Don't Forget HIPAA Compliance URL: https://hipaa.com/hipaa-compliance-lets-not-forget-the-dental-office/ Last updated: 2026-10-25T21:04:45.000Z Since the inception of HIPAA in 1996, its broad implications have affected all areas of health care including dentistry. And, if asked, most dentists and their staff would say they know what the HIPAA regulations are, and yes, they have been trained, but are they really up to date with HIPAA’s ever expanding changes and compliance requirements? Are they trained in the areas of HIPAA Security, Privacy, Enforcement and Breach Notification Rules and do they know that they must be in compliance with the 2013 HIPAA Omnibus Final Rule by September 23, 2013? Compared to the ever-growing size of medical practices today, most dental offices are still rather small with just one to five dentists practicing together, and maintaining compliance is not easy for a small office. It requires a continual effort on the part of the dentist and the office staff. This commitment of time, people and resources is sometimes where the process hits a wall. Many dental offices did their initial training when the Privacy Rules were enacted but have not kept current with training, and often the HIPAA protocols that they put in place have fallen by the wayside. This is especially true in offices with a limited number of employees and frequent staff turnover. Almost all dental practices submit their claims electronically to insurance companies, which subjects them to the HIPAA regulations in regards to electronic claims submission. But, are these offices following through with the certification requirements to safeguard and protect electronic patient information, and is there a written risk assessment? Most offices are much more familiar with the HIPAA Privacy Rule. But, without the benefit of refresher training and instruction for new staff, these offices may not be fully adhering to the HIPAA privacy conditions. The American Dental Association does offer resources and online webinars for dental offices to help them educate their staff and remain compliant with HIPAA laws. But, there are also many other online HIPAA training programs that are ideal for the small dental office…and besides providing a good solid base of instruction, they help offices stay on track with their HIPAA programs. Dentists who realize the importance of training their staff regularly and making sure new hires are immediately well-informed and proficient in HIPAA law are much less likely to have any reported complaints or fail an audit. HIPAA training is crucial, not just because the office could be substantially fined if not in compliance, but because it is essential to protecting their patient’s private health information. ### HHS Publishes Technical Corrections to January 25, 2013, HIPAA Privacy, Security, and Enforcement Rules URL: https://hipaa.com/hhs-publishes-technical-corrections-to-january-25-2013-hipaa-privacy-security-and-enforcement-rules/ Last updated: 2026-10-24T21:32:54.000Z **June 7, 2013**. Today, HHS published in the *Federal Register* "[Technical Corrections to the HIPAA Privacy, Security, and Enforcement Rules](http://www.gpo.gov/fdsys/pkg/FR-2013-06-07/pdf/2013-13472.pdf?ref=hipaa.com)" that were published on January 25, 2013, as the Final Rule: *"*[*Modifications to the HIPAA Privacy, Security, Enforcement, and Breach Notification Rules Under the Health Information Technology for Economic and Clinical Health Act \[HITECH Act\] and the Genetic Information Nondiscrimination Act; Other Modifications of the HIPAA Rules*](http://www.gpo.gov/fdsys/pkg/FR-2013-01-25/pdf/2013-01073.pdf?ref=hipaa.com)*."* According to the *"Summary"* in today's Corrections Final Rule: "These technical corrections address certain inadvertent errors and omissions in the HIPAA Privacy, Security, and Enforcement Rules that are located at 45 CFR parts 160 and 164. The effective date of the Corrections Final Rule is June 7, 2013. ### HIPAA Final Rule: Today is Effective Date—Covered Entities and Business Associates Have 180 Days to Comply URL: https://hipaa.com/hipaa-final-rule-today-is-effective-date-covered-entities-and-business-associates-have-180-days-to-comply/ Last updated: 2026-10-25T21:28:02.000Z **March 26, 2013**. Today is the first big milestone since the January 25, 2013, publication in the *Federal Register* of the Final Rule: [*Modifications to the HIPAA Privacy, Security, Enforcement, and Breach Notification Rules Under the Health Information Technology for Economic and Clinical Health Act \[HITECH Act\] and the Genetic Information Nondiscrimination Act; Other Modifications of the HIPAA Rules*](http://www.gpo.gov/fdsys/pkg/FR-2013-01-25/pdf/2013-01073.pdf?ref=hipaa.com)*.* Today is the effective date of the Final Rule, and covered entities and business associates must comply by September 23, 2013. "[Significant rules (defined by Executive Order 12866) and major rules (defined by the Small Business Regulatory Enforcement Fairness Act) are required to have a 60 day delayed effective date](https://www.federalregister.gov/uploads/2011/01/the%5Frulemaking%5Fprocess.pdf?ref=hipaa.com)," which was the case with the Final Rule discussed herein. Here are comments from the preamble of the Final Rule pertaining to the effective and compliance dates: "The final rule is effective on March 26, 2013\. Covered entities and business associates of all sizes will have 180 days beyond the effective date of the final rule to come into compliance with most of the final rule's provisions, including the modifications to the Breach Notification Rule and the changes to the HIPAA Privacy Rule under GINA. We understand that some covered entities, business associates, and subcontractors remain concerned that a 180-day period does not provide sufficient time to come into compliance with the modifications. However, we believe not only that providing a 180-day compliance period best comports with section 1175(b)(2) of the Social Security Act, 42 U.S.C. 1320d–4, and our implementing provision at 45 CFR 160.104(c)(1), which require the Secretary to provide at least a 180-day period for covered entities to comply with modifications to standards and implementation specifications in the HIPAA Rules, but also that providing a 180-day compliance period best protects the privacy and security of patient information, in accordance with the goals of the HITECH Act. “In addition, to make clear to the industry our expectation that going forward we will provide a 180-day compliance date for future modifications to the HIPAA Rules, we adopt the provision we proposed at 45 CFR 160.105, which provides that with respect to new or modified standards or implementation specifications in the HIPAA Rules, except as otherwise provided, covered entities and business associates must comply with the applicable new or modified standards or implementation specifications no later than 180 days from the effective date of any such change. In cases where a future modification necessitates a longer compliance period, the Department will expressly provide for one, as it has done in this rulemaking with respect to the time permitted for business associate agreements to be modified. “For the reasons proposed, the final rule also retains the compliance date provisions at 45 CFR 164.534 and 164.318, which provide the compliance dates of April 14, 2003, and April 20, 2005, for initial implementation of the HIPAA Privacy and Security Rules, respectively. We note that 160.105 regarding the compliance date of new or modified standards or implementation specifications does not apply to modifications to the provisions of the HIPAA Enforcement Rule, because such provisions are not standards or implementation specifications (as the terms are defined at 160.103). Such provisions are in effect and apply at the time the final rule becomes effective or as otherwise specifically provided. In addition, as explained above, our general rule for a 180-day compliance period for new or modified standards would not apply where we expressly provide a different compliance period in the regulation for one or more provisions. For purposes of this rule, the 180-day compliance period would not govern the time period required to modify those business associate agreements that qualify for the longer transition period in 164.532…. “Finally, the provisions of section 13402(j) of the HITECH Act apply to breaches of unsecured protected health information discovered on or after September 23, 2009, the date of the publication of the interim final rule. Thus, during the 180 day period before compliance with this final rule is required, covered entities and business associates are still required to comply with the breach notification requirements under the HITECH Act and must continue to comply with the requirements of the interim final rule. We believe that this transition period provides covered entities and business associates with adequate time to come into compliance with the revisions in this final rule and at the same time to continue to fulfill their breach notification obligations under the HITECH Act.” 78 *Federal Register* 5569-5570 For provisions of the modifications of the Final Rule, you may access them through electronic *Code of Federal Regulation* links available at [www.ecfr.gov](http://www.ecfr.gov/?ref=hipaa.com). On the opening screen, scroll down to "Title 45: Public Welfare" and click "Go." Then, click on "1-199: Subtitle A--Department of Health and Human Services." Scroll down to "Subchapter C: Administrative Date Standards and Related Requirements" for the "Parts" and "Subparts" of interest, click, and you can then access desired sections. For example, Part 164 is "Security and Privacy," and Subpart C is "Security Standards for the Protection of Electronic Protected Health Information," Subpart D is "Notification in the Case of Breach of Unsecured Protected Health Information," and Subpart E is" Privacy of Individually Identifiable Health Information." ### HIPAA Final Rule: Notice of Privacy Practices for Protected Health Information: Provision of Notice (2) URL: https://hipaa.com/hipaa-final-rule-notice-of-privacy-practices-for-protected-health-information-provision-of-notice-2/ Last updated: 2026-10-25T21:20:04.000Z **March 25, 2013**. Today, we continue going through the HIPAA Privacy Rule, section by section, as modified in the Final Rule: [*Modifications to the HIPAA Privacy, Security, Enforcement, and Breach Notification Rules Under the Health Information Technology for Economic and Clinical Health Act \[HITECH Act\] and the Genetic Information Nondiscrimination Act; Other Modifications of the HIPAA Rules*](http://www.gpo.gov/fdsys/pkg/FR-2013-01-25/pdf/2013-01073.pdf?ref=hipaa.com), which was published in the Federal Register on January 25, 2013\. The effective date of the Final Rule is March 26, 2013, and covered entities and business associates must comply by September 23, 2013. We began a two-day examination of the modifications pertaining to 45 CFR 164.520: *Notice of Privacy Practices for Protected Health Information* on Friday, March 22, looking at *Content of Notice* in subsection (b). Today, we focus on modifications to 164.520(c): *Implementation specifications: Provision of Notice*, with modification in **bold**: “(c) *Implementation specifications: Provision of Notice*. A covered entity must make the notice required by this section available on request to any person and to individuals as specified in paragraphs (c)(1) through (c)(3) of this section, as applicable. (1) *Specific requirements for health plans*. (i) a health plan must provide notice: ... (B) Thereafter, at the time of enrollment, to individuals who are new enrollees. … **(v) If there is a material change to the notice:** **(A) A health plan that posts its notice on its web site in accordance with paragraph (c)(3)(i) of this section \[*Specific requirements for electronic notice*\] must prominently post the change or its revised notice on its web site by the effective date of the material change to the notice, and provide the revised notice, or information about the material change and how to obtain the revised notice, in its next annual mailing to individuals then covered by the plan.** **(B) A health plan that does not post its notice on a web site pursuant to paragraph (c)(3)(i) of this section must provide the revised notice, or information about the material change and how to obtain the revised notice, to individuals then covered by the plan within 60 days of the material revision to the notice.** We provide here the content of the Final Rule preamble that underpins the *Notice of privacy practices for protected health information: Provision of Notice*: “Section 45 CFR 164.520(c)(1) of the final rule requires a health plan that currently posts its NPP on its Web site in accordance with164.520(c)(3)(i) to: (1) Prominently post the material change or its revised notice on its web site by the effective date of the material change to the notice (e.g., the compliance date of this final rule) and (2) provide the revised notice, or information about the material change and how to obtain the revised notice, in its next annual mailing to individuals then covered by the plan, such as at the beginning of the plan year or during the open enrollment period. Health plans that do not have customer service web sites are required to provide the revised NPP, or information about the material change and how to obtain the revised notice, to individuals covered by the plan within 60 days of the material revision to the notice. These requirements apply to all material changes including, where applicable, the rule change adopted pursuant to GINA to prohibit most health plans from using or disclosing genetic information for underwriting purposes. “We believe these distribution requirements best balance the right of individuals to be informed of their privacy rights with the burden on health plans to provide the revised NPP. We also note that health plans should provide both paper- and web-based notices in a way accessible to all beneficiaries, including those individuals with disabilities. These modifications provide an avenue for an individual to be informed of material changes upon their effective date while better aligning the NPP distribution with health plans’ normal mailings to individuals. “For health care providers, the final rule does not modify the current requirements to distribute revisions to the NPP. As such, 45 CFR 164.520(c)(2)(iv) requires that when a health care provider with a direct treatment relationship with an individual revises the NPP, the health care provider must make the NPP available upon request on or after the effective date of the revision and must comply with the requirements of 164.520(c)(2)(iii) to have the NPP available at the delivery site and to post the notice in a clear and prominent location. In response to several comments expressing concern about printing costs for new NPPs, we clarify that providers are not required to print and hand out a revised NPP to all individuals seeking treatment; providers must post the revised NPP in a clear and prominent location and have copies of the NPP at the delivery site for individuals to request to take with them. Providers are only required to give a copy of the NPP to, and obtain a good faith acknowledgment of receipt from, new patients. As a result, we do not believe that the current requirement is overly burdensome to providers, nor is it overly costly. We also clarify that while health care providers are required to post the NPP in a clear and prominent location at the delivery site, providers may post a summary of the notice in such a location as long as the full notice is immediately available (such as on a table directly under the posted summary) for individuals to pick up without any additional burden on their part. It would not be appropriate, however, to require the individual to have to ask the receptionist for a copy of the full NPP. “To the extent that some covered entities have already revised their NPPs in response to the enactment of the HITECH Act or State law requirements, we clarify that as long as a covered entity’s current NPP is consistent with this final rule and individuals have been informed of all material revisions made to the NPP, the covered entity is not required to revise and distribute another NPP upon publication of this final rule. Finally, we note that to the extent a covered entity is required to comply with Section 504 of the Rehabilitation Act of 1973 or the Americans with Disabilities Act of 1990, the covered entity has an obligation to take steps that may be necessary to ensure effective communication with individuals with disabilities, which could include making the revised NPP or notice of material changes to the NPP available in alternate formats, such as Braille, large print, or audio.” 78 *Federal Register* 5625 Tomorrow is the effective date of the Final Rule discussed herein. ### HIPAA Final Rule: Notice of Privacy Practices for Protected Health Information: Content of Notice (1) URL: https://hipaa.com/hipaa-final-rule-notice-of-privacy-practices-for-protected-health-information-1/ Last updated: 2013-03-22T19:44:04.000Z **March 22, 2013**. Today, we continue going through the HIPAA Privacy Rule, section by section, as modified in the Final Rule: [*Modifications to the HIPAA Privacy, Security, Enforcement, and Breach Notification Rules Under the Health Information Technology for Economic and Clinical Health Act \[HITECH Act\] and the Genetic Information Nondiscrimination Act; Other Modifications of the HIPAA Rules*](http://www.gpo.gov/fdsys/pkg/FR-2013-01-25/pdf/2013-01073.pdf?ref=hipaa.com), which was published in the Federal Register on January 25, 2013\. The effective date of the Final Rule is March 26, 2013, and covered entities and business associates must comply by September 23, 2013. We begin a two-day examination of the modifications pertaining to 45 CFR 164.520: *Notice of Privacy Practices for Protected Health Information*. Today, we focus on modifications to 164.520(b): *Implementation specifications: Content of Notice*, and Monday, March 25, on modifications to 164.520(c): *Implementation specifications: Provision of notice*. *Modifications to 164.520(b): Implementation specifications: Content of notice* “(1) *Required elements.* “(ii) *Uses and disclosures* . The notice must contain: “(E) A description of the types of uses and disclosures that require an authorization under 45 CFR 164.508(a)(2)–(a)(4), a statement that other uses and disclosures not described in the notice will be made only with the individual’s written authorization, and a statement that the individual may revoke an authorization as provided by 164.508(b)(5).” 78 *Federal Register* 5701 Here are the provisions for 45 CFR 164.508 referenced in 164.520(b)(1)(ii)(E), with modifications shown in **bold**: “(a)(2) *Authorization required: Psychotherapy notes*. “(a)(3) *Authorization required: Marketing*. (ii) If the marketing involves **financial remuneration, as defined in paragraph (3) of the definition of marketing at 164.501,** to the covered entity from a third party, the authorization must state that such remuneration is involved. **“(a)(4) *Authorization required: Sale of protected health information*. (i) Notwithstanding any provision of \[the HIPAA Privacy Rule\], other than the transition provisions in 164.532, a covered entity must obtain an authorization for any disclosure of protected health information which is a sale of protected health information, as defined in 164.501 of \[the HIPAA Privacy Rule\]. (ii) Such authorization must state that the disclosure will result in remuneration to the covered entity.** “(b)(5) *Revocation of authorizations*.” 78 *Federal Register* 5699 Continuing with the modifications to 45 CFR 164.520(b)(1): *Content of Notice: Required elements:* “(iii) Separate statements for certain uses or disclosures . If the covered entity intends to engage in any of the following activities, the description required by paragraph (b)(1)(ii)(A) of this section must include a separate statement informing the individual of such activities, as applicable: “(A) In accordance with 164.514(f)(1) \[*Fundraising communications: Standard: Uses and disclosures for fundraising*, as modified at 78 *Federal Register* 5700\], the covered entity may contact the individual to raise funds for the covered entity and the individual has a right to opt out of receiving such communications; “(B) In accordance with 164.504(f) \[*Standard: Requirements for group health plans*, as modified at 78 *Federal Register* 5698\], the group health plan, or a health insurance issuer or HMO with respect to a group health plan, may disclose protected health information to the sponsor of the plan; or “(C) If a covered entity that is a health plan, excluding an issuer of a long-term care policy falling within paragraph (1)(viii) of the definition of *health plan,* intends to use or disclose protected health information for underwriting purposes, a statement that the covered entity is prohibited from using or disclosing protected health information that is genetic information of an individual for such purposes.” 78 *Federal Register* 5701 Here are two references mentioned in the provisions immediately above: In (iii), “(b)(1)(ii)(A)” is: “ A description, including at least one example, of the types of uses and disclosures that the covered entity is permitted by \[the HIPAA Privacy Rule\] to make for each of the following purposes: treatment, payment, and health care operations.” In (C), “(1)(viii) of the definition of *health plan*” is: “An issuer of a long-term care policy, excluding a nursing home fixed indemnity policy.” 78 *Federal Register* 5689 “(iv) Individual rights . “(A) The right to request restrictions on certain uses and disclosures or protected health information as provided by 45 CFR 164.522(a), including a statement that the covered entity is not required to agree to a requested restriction, except in case of a disclosure restricted under 164.522(a)(1)(vi); “ 78 *Federal Register* 5701 Here is the content, as modified (in **bold**), for 164.522(a)(1)(vi), as referenced immediately above: **“A covered entity must agree to the request of an individual to restrict disclosure of protected health information about the individual to a health plan if:** **(A) The disclosure is for the purpose of carrying out payment or health care operations and is not otherwise required by law; and** **(B) The protected health information pertains solely to a health care item or service for which the individual, or person other than the health plan on behalf of the individual, has paid the covered entity in full.”** 78 *Federal Register* 5701 “(v) Covered entity’s duties . “(A) A statement that the covered entity is required by law to maintain the privacy of protected health information, to provide individuals with notice of its legal duties and privacy practices with respect to protected health information, and to notify affected individuals following a breach of unsecured protected health information;” 78 *Federal Register* 5701 We provide here the content of the Final Rule preamble that underpins the *Notice of privacy practices for protected health information: Implementation specifications—Content of Notice*, with reference to the modified provisions above: “First, the final rule adopts the modification to 45 CFR 164.520(b)(1)(ii)(E), which requires certain statements in the NPP regarding uses and disclosures that require authorization. We note that, contrary to some commenter concerns, the final rule does not require the NPP to include a list of all situations requiring authorization. Instead, the NPP must contain a statement indicating that most uses and disclosures of psychotherapy notes (where appropriate), uses and disclosures of protected health information for marketing purposes, and disclosures that constitute a sale of protected health information require authorization, as well as a statement that other uses and disclosures not described in the NPP will be made only with authorization from the individual. “The final rule does not require the NPP to include a description of a covered entity’s recordkeeping practices with respect to psychotherapy notes; however, covered entities are free to include such additional information in their NPP if they choose. Additionally, in response to requests by some commenters, we clarify that covered entities that do not record or maintain psychotherapy notes are not required to include a statement in their NPPs about the authorization requirement for uses and disclosures of psychotherapy notes. “Second, because the final rule treats all subsidized treatment communications as marketing communications, we have not adopted the proposal to require a statement in the NPP about such communications and the ability of an individual to opt out…. “The final rule, however, adopts the proposed requirement for a statement in the NPP regarding fundraising communications and an individual’s right to opt out of receiving such communications, if a covered entity intends to contact an individual to raise funds for the covered entity. Because individuals will be provided the opportunity to opt out of fundraising communications with each solicitation, the final rule does not require the NPP to include the mechanism for individuals to opt out of receiving fundraising communications, although covered entities are free to include such information if they choose to do so. “The final rule also adopts the proposal that the NPP inform individuals of their new right to restrict certain disclosures of protected health information to a health plan where the individual pays out of pocket in full for the health care item or service. Only health care providers are required to include such a statement in the NPP; other covered entities may retain the existing language indicating that a covered entity is not required to agree to a requested restriction.” 78 *Federal Register* 5624 On Monday, March 25, we present 45 CFR 164.520(c): *Implementation specifications: Provision of Notice*. ### HIPAA Final Rule: More on Uses and Disclosures of Protected Health Information of Decedents URL: https://hipaa.com/hipaa-final-rule-more-on-uses-and-disclosures-of-protected-health-information-of-decedents/ Last updated: 2026-10-25T21:21:04.000Z Today, we continue going through the HIPAA Privacy Rule, section by section, as modified in the Final Rule: [*Modifications to the HIPAA Privacy, Security, Enforcement, and Breach Notification Rules Under the Health Information Technology for Economic and Clinical Health Act \[HITECH Act\] and the Genetic Information Nondiscrimination Act; Other Modifications of the HIPAA Rules*](http://www.gpo.gov/fdsys/pkg/FR-2013-01-25/pdf/2013-01073.pdf?ref=hipaa.com), which was published in the Federal Register on January 25, 2013\. The effective date of the Final Rule is March 26, 2013, and covered entities and business associates must comply by September 23, 2013. Our focus yesterday was on the modified rule: 45 CFR 164.502(f): *Standard*: *Deceased individuals*. Today, we finish up with a related modified rule: 164.510(b): *Disclosures about a decedent to family members and others involved in care*, which is in **164.510(b)(5)**: “*Uses and disclosures when the individual is deceased.* If the individual is deceased, a covered entity may disclose to a family member, or other persons identified in paragraph (b)(1) of this section who were involved in the individual’s care or payment for health care prior to the individual’s death, protected health information of the individual that is relevant to such person’s involvement, unless doing so is inconsistent with any prior expressed preference of the individual that is known to the covered entity.” For reference, we provide modified 164.510(b)(1) here: “(b) *Standard: Uses and disclosures for involvement in the individual’s care and notification purposes—*(1) *Permitted uses and disclosures*. "(i) A covered entity may, in accordance with paragraphs (b)(2), (b)(3), or **(b)(5)** of this section, disclose to a family member, other relative, or a close personal friend of the individual, or any other person identified by the individual, the protected health information directly relevant to such person’s involvement with the individual’s health care or payment related to the individual’s health care. "(ii) A covered entity may use or disclose protected health information to notify, or assist in the notification of (including identifying or locating), a family member, a personal representative of the individual, or another person responsible for the care of the individual of the individual’s location, general condition, or death. Any such use or disclosure of protected health information for such notification purposes must be in accordance with paragraphs (b)(2), (b)(3), (b)(4), or **(b)(5)** of this section, as applicable.” 78 *Federal Register* 5699 We provide here the content of the Final Rule preamble that underpins the *Disclosure about a decedent to family members and others involved in care*: “The final rule adopts the proposal to amend 45 CFR 164.510(b) to permit covered entities to disclose a decedent’s protected health information to family members and others who were involved in the care or payment for care of the decedent prior to death, unless doing so is inconsistent with any prior expressed preference of the individual that is known to the covered entity. “In response to commenters who opposed this provision, we believe the provision strikes the appropriate balance in allowing communications with family members and other persons who were involved in the individual’s care or payment for care prior to death, unless doing so is inconsistent with the prior expressed wishes of the individual. This will ensure family members and others can find out about the circumstances surrounding the death of their loved ones, unless the individual prior to his or her death objected to the covered entity making such communications. Further, the Privacy Rule limits such disclosures, similar to the other disclosures permitted under 164.510(b), to the protected health information relevant to the family member or other person’s involvement in the individual’s health care or payment for health care. For example, a covered health care provider could describe the circumstances that led to an individual’s passing with the decedent’s sister who is asking about her sibling’s death. In addition, a covered health care provider could disclose billing information to a family member of a decedent who is assisting with wrapping up the decedent’s estate. However, in both of these cases, the provider generally should not share information about past, unrelated medical problems. Finally, these disclosures are permitted and not required, and thus, a covered entity that questions the relationship of the person to the decedent or otherwise believes, based on the circumstances, that disclosure of the decedent’s protected health information would not be appropriate, is not required to make the disclosure.” 78 *Federal Register* 5615 Tomorrow, we begin two days presentation of modifications to the Notice of Privacy Practices for Protected Health Information. ### HIPAA Final Rule: Protected Health Information of Deceased Individuals URL: https://hipaa.com/hipaa-final-rule-protected-health-information-of-deceased-individuals/ Last updated: 2026-10-25T21:23:10.000Z **March 12, 2013**. Today, we continue going through the HIPAA Privacy Rule, section by section, as modified in the Final Rule: [*Modifications to the HIPAA Privacy, Security, Enforcement, and Breach Notification Rules Under the Health Information Technology for Economic and Clinical Health Act \[HITECH Act\] and the Genetic Information Nondiscrimination Act; Other Modifications of the HIPAA Rules*](http://www.gpo.gov/fdsys/pkg/FR-2013-01-25/pdf/2013-01073.pdf?ref=hipaa.com), which was published in the Federal Register on January 25, 2013\. The effective date of the Final Rule is March 26, 2013, and covered entities and business associates must comply by September 23, 2013. Our focus last week and early this week has been on 45 CFR 164.502: *Uses and disclosures of protected health information: General Rules*. Today, we finish up with this modified rule with: 164.502(f): *Standard*: *Deceased individuals*. **“164.502(f): *Standard*: *Deceased individuals***. A covered entity must comply with the requirements of \[the HIPAA Privacy Rule\] with respect to the protected health information of a deceased individual for a period of 50 years following the death of the individual.” We provide here the content of the Final Rule preamble that underpins the *Uses and disclosures of protected health information: General Rules* pertaining to deceased individuals: “We believe 50 years is an appropriate period of protection for decedent health information, taking into account the remaining privacy interests of living individuals after the span of approximately two generations have passed, and the difficulty of obtaining authorizations from a personal representative of a decedent as the same amount of time passes. For the same reason, we decline to shorten the period of protection as suggested by some commenters or to adopt a 100-year period of protection for decedent information. We also believe the 50-year period of protection to be long enough so as not to provide an incentive for covered entities to change their record retention policies in order to profit from the data about a decedent once 50 years has elapsed. “With respect to commenters’ concerns regarding protected health information about decedents that is sensitive, such as HIV/AIDS, substance abuse, or mental health information, or that involves psychotherapy notes, we emphasize that the 50-year period of protection for decedent health information under the Privacy Rule does not override or interfere with State or other laws that provide greater protection for such information, or the professional responsibilities of mental health or other providers. Covered entities may continue to provide privacy protections to decedent information beyond the 50-year period, and may be required to do so under other applicable laws or as part of their professional responsibility. Alternatively, covered entities may choose to destroy decedent information although other applicable law may prescribe or limit such destruction. “We also decline to limit protections under the Privacy Rule to a certain period beyond the last date in the medical record. While we appreciate the challenges that may be present in determining the date of death of an individual in cases in which it is not sufficiently clear from the age of the record whether the individual is deceased, we believe that this determination is necessary in closer cases to protect the individual, as well as living relatives and others, who may be affected by disclosure of the information. Further, as we stated in the \[July 14, 2010, Notice of Proposed Rule Making\], this modification has no impact on a covered entity’s disclosures permitted under other provisions of the Privacy Rule. For example, a covered entity is permitted to disclose protected health information of decedents for research that is solely on the information of decedents in accordance with 45 CFR 164.512(i)(1)(iii) \[*Uses and disclosures for which an authorization or opportunity to agree or object is not required*\], without regard to how long the individual has been deceased. “Finally, we clarify that the 50-year period of protection is not a record retention requirement. The HIPAA Privacy Rule does not include medical record retention requirements and covered entities may destroy such records at the time permitted by State or other applicable law. (We note that covered entities are subject to the accounting requirements at 45 CFR 164.528 \[*Accounting of disclosures of protected health information*\] and, thus, would need to retain or record certain information regarding their disclosures of protected health information.) However, if a covered entity does maintain decedent health information for longer than 50 years following the date of death of the individual, this information will no longer be subject to the Privacy Rule.” 78 *Federal Register* 5614 Tomorrow, we look at a related modified HIPAA Privacy Rule pertaining to decedents: 45 CFR 164.510(b): *Disclosures about a decedent to family members and others involved in care*. ### HIPAA Final Rule: More on Business Associate Uses & Disclosures in the Business Associate Contract URL: https://hipaa.com/hipaa-final-rule-more-on-business-associate-uses-disclosures-in-the-business-associate-contract/ Last updated: 2026-10-25T21:29:00.000Z **March 11, 2013**. Today, we continue going through the HIPAA Privacy Rule, section by section, as modified in the Final Rule: [*Modifications to the HIPAA Privacy, Security, Enforcement, and Breach Notification Rules Under the Health Information Technology for Economic and Clinical Health Act \[HITECH Act\] and the Genetic Information Nondiscrimination Act; Other Modifications of the HIPAA Rules*](http://www.gpo.gov/fdsys/pkg/FR-2013-01-25/pdf/2013-01073.pdf?ref=hipaa.com), which was published in the Federal Register on January 25, 2013\. The effective date of the Final Rule is March 26, 2013, and covered entities and business associates must comply by September 23, 2013. Our focus last week was on 45 CFR 164.502: *Uses and disclosures of protected health information: General Rules,* and, on Friday, March 8, on 45 CFR 164.502(e): “(1) *Standard: Disclosures to business associates*, and (2) *Implementation specification: Documentation."* Today, we focus on the modified provisions at 164.504(e)(1): *Uses and disclosures: Organizational requirements--Standard: Business associate contracts*, that were referenced in 45 CFR 164.502(e): 164.504(e)(1), (e)(2), (e)(3), and (e)(5). **"164.504(e)(1)** *Standard: Business associate contracts.* "(i) The contract or other arrangement required by 45 CFR 164.502(e)(2) must meet the requirements of paragraph (e)(2), (e)(3), or (e)(5) of this section, as applicable. "(ii) A covered entity is not in compliance with the standards in 164.502(e) and this paragraph, if the covered entity knew of a pattern of activity or practice of the business associate that constituted a material breach or violation of the business associate’s obligation under the contract or other arrangement, unless the covered entity took reasonable steps to cure the breach or end the violation, as applicable, and, if such steps were unsuccessful, terminated the contract or arrangement, if feasible. "(iii) A business associate is not in compliance with the standards in 164.502(e) and this paragraph, if the business associate knew of a pattern of activity or practice of a subcontractor that constituted a material breach or violation of the subcontractor’s obligation under the contract or other arrangement, unless the business associate took reasonable steps to cure the breach or end the violation, as applicable, and, if such steps were unsuccessful, terminated the contract or arrangement, if feasible. **"164.504(e)(2)** *Implementation specifications: Business associate contracts.* A contract between the covered entity and a business associate must: "(i) Establish the permitted and required uses and disclosures of protected health information by the business associate. The contract may not authorize the business associate to use or further disclose the information in a manner that would violate the requirements of \[the HIPAA Privacy Rule\], if done by the covered entity, except that: "(A) The contract may permit the business associate to use and disclose protected health information for the proper management and administration of the business associate, as provided in paragraph (e)(4) \[*Implementation specifications: Other requirements for contracts and other arrangements, at 78 Federal Register 5698*\]of this section; and "(B) The contract may permit the business associate to provide data aggregation services relating to the health care operations of the covered entity. "(ii) Provide that the business associate will: "(A) Not use or further disclose the information other than as permitted or required by the contract or as required by law; "(B) Use appropriate safeguards and comply, where applicable, with \[the HIPAA Security Rule\] with respect to electronic protected health information, to prevent use or disclosure of the information other than as provided for by its contract; "(C) Report to the covered entity any use or disclosure of the information not provided for by its contract of which it becomes aware, including breaches of unsecured protected health information as required by 45 CFR 164.410 \[*Breach Notification Rule: Notification by a business associate, as modified at 78 Federal Register 5695*\]; "(D) In accordance with 164.502(e)(1)(ii), ensure that any subcontractors that create, receive, maintain, or transmit protected health information on behalf of the business associate agree to the same restrictions and conditions that apply to the business associate with respect to such information; "(E) Make available protected health information in accordance with 164.524 \[*Access of individuals to protected health information, as modified at 78 Federal Register 5701-5702*\]; "(F) Make available protected health information for amendment and incorporate any amendments to protected health information in accordance with 164.526 \[*Amendment of protected health information*\]; "(G) Make available the information required to provide an accounting of disclosures in accordance with § 164.528 \[*Accounting of disclosures of protected health information*\]; "(H) To the extent the business associate is to carry out a covered entity’s obligation under \[the HIPAA Privacy Rule\], comply with the requirements of \[the HIPAA Privacy Rule\] that apply to the covered entity in the performance of such obligation. "(I) Make its internal practices, books, and records relating to the use and disclosure of protected health information received from, or created or received by the business associate on behalf of, the covered entity available to the Secretary for purposes of determining the covered entity’s compliance with this subpart; and "(J) At termination of the contract, if feasible, return or destroy all protected health information received from, or created or received by the business associate on behalf of, the covered entity that the business associate still maintains in any form and retain no copies of such information or, if such return or destruction is not feasible, extend the protections of the contract to the information and limit further uses and disclosures to those purposes that make the return or destruction of the information infeasible. "(iii) Authorize termination of the contract by the covered entity, if the covered entity determines that the business associate has violated a material term of the contract. **"(e)(3)** *Implementation specifications: Other arrangements.* (i) If a covered entity and its business associate are both governmental entities: "(A) The covered entity may comply with this paragraph and 164.314(a)(1) \[*HIPAA Security Rule:* *Standard: Business associate contracts or other arrangements, as modified at 78 Federal Register 5694*\], if applicable, by entering into a memorandum of understanding with the business associate that contains terms that accomplish the objectives of paragraph (e)(2) of this section and 164.314(a)(2) \[*Implementation specifications*\], if applicable. "(B) The covered entity may comply with this paragraph and 164.314(a)(1), if applicable, if other law (including regulations adopted by the covered entity or its business associate) contains requirements applicable to the business associate that accomplish the objectives of paragraph (e)(2) of this section and 164.314(a)(2), if applicable. "(ii) If a business associate is required by law to perform a function or activity on behalf of a covered entity or to provide a service described in the definition of business associate in 45 CFR 160.103 \[as modified at 78 *Federal Register* 5688\] to a covered entity, such covered entity may disclose protected health information to the business associate to the extent necessary to comply with the legal mandate without meeting the requirements of this paragraph and 164.314(a)(1), if applicable, provided that the covered entity attempts in good faith to obtain satisfactory assurances as required by paragraph (e)(2) of this section and 164.314(a)(1), if applicable, and, if such attempt fails, documents the attempt and the reasons that such assurances cannot be obtained. "(iii) The covered entity may omit from its other arrangements the termination authorization required by paragraph (e)(2)(iii) of this section, if such authorization is inconsistent with the statutory obligations of the covered entity or its business associate. "(iv) A covered entity may comply with this paragraph and 164.314(a)(1) if the covered entity discloses only a limited data set to a business associate for the business associate to carry out a health care operations function and the covered entity has a data use agreement with the business associate that complies with 164.514(e)(4) \[*Implementation specifications: \[Limited data set\] Data use agreement, as modified at 78 Federal Register 5700*\]and 164.314(a)(1), if applicable. **"(e)(5)** *Implementation specifications: Business associate contracts with subcontractors.* The requirements of 45 CFR 164.504(e)(2) through (e)(4) apply to the contract or other arrangement required by 164.502(e)(1)(ii) between a business associate and a business associate that is a subcontractor in the same manner as such requirements apply to contracts or other arrangements between a covered entity and business associate." 78 *Federal Register* 5697 On January 25, 2013, the Office for Civil Rights (OCR) of the Department of Health and Human Services (HHS) launched a Business Associate Contract Web site with [*Sample Business Associate Agreement Provisions*](http://www.hhs.gov/ocr/privacy/hipaa/understanding/coveredentities/contractprov.html?ref=hipaa.com)that provides guidance to covered entities on preparing appropriate business associate agreements with required provisions, including those discussed in this posting. Tomorrow, we close the presentation of 45 CFR 164.502 with 164.502(f): *Standard: Deceased individuals*. ### HIPAA Final Rule: Disclosures to Business Associates URL: https://hipaa.com/hipaa-final-rule-disclosures-to-business-associates/ Last updated: 2026-10-25T21:30:30.000Z **March 8, 2013**. Today, we continue going through the HIPAA Privacy Rule, section by section, as modified in the Final Rule: [*Modifications to the HIPAA Privacy, Security, Enforcement, and Breach Notification Rules Under the Health Information Technology for Economic and Clinical Health Act \[HITECH Act\] and the Genetic Information Nondiscrimination Act; Other Modifications of the HIPAA Rules*](http://www.gpo.gov/fdsys/pkg/FR-2013-01-25/pdf/2013-01073.pdf?ref=hipaa.com), which was published in the Federal Register on January 25, 2013\. The effective date of the Final Rule is March 26, 2013, and covered entities and business associates must comply by September 23, 2013. Our focus this week has been on 45 CFR 164.502: *Uses and disclosures of protected health information: General Rules*. Today, we focus on the modified provisions at 164.502(e): *Standard*: *Disclosures to business associate*s: 45 CFR 164.502(e): “**(1)** *Standard: Disclosures to business associates.* (i) A covered entity may disclose protected health information to a business associate and may allow a business associate to create, receive, maintain, or transmit protected health information on its behalf, if the covered entity obtains satisfactory assurance that the business associate will appropriately safeguard the information. A covered entity is not required to obtain such satisfactory assurances from a business associate that is a subcontractor. (ii) A business associate may disclose protected health information to a business associate that is a subcontractor and may allow the subcontractor to create, receive, maintain, or transmit protected health information on its behalf, if the business associate obtains satisfactory assurances, in accordance with 45 CFR 164.504(e)(1)(i) \[*Uses and disclosures: Organizational requirements—Standard: Business associate contracts* (see below)\], that the subcontractor will appropriately safeguard the information. **(2)** *Implementation specification: Documentation.* The satisfactory assurances required by paragraph (e)(1) of this section must be documented through a written contract or other written agreement or arrangement with the business associate that meets the applicable requirements of 45 CFR164.504(e).” Here is the language for 45 CFR 164.504(e)(1)(i) referenced in (1)(ii) above, as modified in the January 25, 2013, Final Rule: “(e)(1) *Standard: Business associate contracts*. (i) The contract or other arrangement required by 45 CFR 164.502(e)(2) must meet the requirements of paragraph (e)(2) \[*Implementation specifications: Business associate contracts*\], (e)(3) \[*Implementation specifications: Other arrangements*\], or (e)(5) \[*Implementation specifications: Business associate contracts with subcontractors*\] of 45 CFR 164.504, as applicable.” 78 *Federal Register* 5697 On Monday, March 11, we shall present the content of 45 CFR 164.504(e), referenced in the preceding paragraph. On Tuesday, we close the presentation of 45 CFR 164.502 with 164.502(f): *Standard: Deceased individuals*. ### HIPAA Final Rule: Prohibited Uses and Disclosures—Sale of Protected Health Information URL: https://hipaa.com/hipaa-final-rule-prohibited-uses-and-disclosures-sale-of-protected-health-information/ Last updated: 2026-10-25T21:24:36.000Z **March 7, 2013**. Today, we continue going through the HIPAA Privacy Rule, section by section, as modified in the Final Rule: [*Modifications to the HIPAA Privacy, Security, Enforcement, and Breach Notification Rules Under the Health Information Technology for Economic and Clinical Health Act \[HITECH Act\] and the Genetic Information Nondiscrimination Act; Other Modifications of the HIPAA Rules*](http://www.gpo.gov/fdsys/pkg/FR-2013-01-25/pdf/2013-01073.pdf?ref=hipaa.com), which was published in the Federal Register on January 25, 2013\. The effective date of the Final Rule is March 26, 2013, and covered entities and business associates must comply by September 23, 2013. Our focus today is on the second of two *prohibited uses and disclosures* of protected health information in the *General rules* regulatory provisions of 45 CFR 164.502(a)(5):(ii) *Sale of protected health information* at 78 *Federal Register* 5696-5697: **(A)** Except pursuant to and in compliance with 45 CFR 164.508(a)(4) \[*Standard—Authorization Required: Sale of protected health information*\], a covered entity or business associate may not sell protected health information. **(B)** For purposes of this paragraph, sale of protected health information means: (*1*) Except as provided in paragraph (a)(5)(ii)(B)(*2*) of this section, a disclosure of protected health information by a covered entity or business associate, if applicable, where the covered entity or business associate directly or indirectly receives remuneration from or on behalf of the recipient of the protected health information in exchange for the protected health information. (*2*) Sale of protected health information does not include a disclosure of protected health information: (*i*) For public health purposes pursuant to 45 CFR 164.512(b) \[*Standard: Uses and disclosures for public health activities*\]or 164.514(e) \[*Standard: Limited data set*\]; (*ii*) For research purposes pursuant to 45 CFR 164.512(i) \[*Standard: Uses and disclosures for research purposes*\]or 164.514(e) \[*Standard: Limited data set*\], where the only remuneration received by the covered entity or business associate is a reasonable cost-based fee to cover the cost to prepare and transmit the protected health information for such purposes; (*iii*) For treatment and payment purposes pursuant to 45 CFR164.506(a) \[*Standard: Permitted uses and disclosures*\]; (*iv*) For the sale, transfer, merger, or consolidation of all or part of the covered entity and for related due diligence as described in paragraph 45 CFR 164.501(6)(iv) of the definition of health care operations \[(iv): The sale, transfer, merger, or consolidation of all or part of the covered entity with another covered entity, or an entity that following such activity will become a covered entity and due diligence related to such activity\], and pursuant to 45 CFR 164.506(a) \[*Standard: Permitted uses and disclosures*\]; (*v*) To or by a business associate for activities that the business associate undertakes on behalf of a covered entity, or on behalf of a business associate in the case of a subcontractor, pursuant to 45 CFR 164.502(e) \[*Standard: Disclosures to business associates*\]and 164.504(e) \[*Standard: Business associate contracts*\], and the only remuneration provided is by the covered entity to the business associate, or by the business associate to the subcontractor, if applicable, for the performance of such activities; (*vi*) To an individual, when requested under 45 CFR 164.524 \[*Access of individuals to protected health information*\]or 164.528 \[*Accounting of disclosures of protected health information*\]; (*vii*) Required by law as permitted under 45 CFR 164.512(a) \[*Standard: Uses and disclosures required by law*\]; and (*viii*) For any other purpose permitted by and in accordance with the applicable requirements of this subpart, where the only remuneration received by the covered entity or business associate is a reasonable, cost-based fee to cover the cost to prepare and transmit the protected health information for such purpose or a fee otherwise expressly permitted by other law. We provide here the content of the Final Rule preamble that underpins the prohibited use and disclosure regulatory provision above: “The final rule adopts the HITECH Act’s prohibition on the sale of protected health information but makes certain changes to the provisions in the proposed rule to clarify the scope of the provisions and otherwise address certain of commenters’ concerns. First, we have moved the general prohibition on the sale of protected health information by a covered entity or business associate to 45 CFR 164.502(a)(5)(ii) and created a definition of ‘sale of protected health information.’ Numerous commenters requested that the Privacy Rule include a definition of sale to better clarify what types of transactions fall within the scope of the provisions. Accordingly, 164.502(a)(5)(ii)(B)(*1*) defines ‘sale of protected health information’ to generally mean ‘a disclosure of protected health information by a covered entity or business associate, if applicable, where the covered entity or business associate directly or indirectly receives remuneration from or on behalf of the recipient of the protected health information in exchange for the protected health information.’ Section 164.502(a)(5)(ii)(B)(*2*) then excludes from the definition the various exceptions that were in the proposed rule (discussed further below). “We do not limit a ‘sale’ to those transactions where there is a transfer of ownership of protected health information as some commenters suggested. The HITECH Act does not include such a limitation and the Privacy Rule rights and protections apply to protected health information without regard to ownership interests over the data. Thus, the sale provisions apply to disclosures in exchange for remuneration including those that are the result of access, license, or lease agreements. “In addition, we do not consider sale of protected health information in this provision to encompass payments a covered entity may receive in the form of grants, or contracts or other arrangements to perform programs or activities, such as a research study, because any provision of protected health information to the payer is a byproduct of the service being provided. Thus, the payment by a research sponsor to a covered entity to conduct a research study is not considered a sale of protected health information even if research results that may include protected health information are disclosed to the sponsor in the course of the study. Further, the receipt of a grant or funding from a government agency to conduct a program is not a sale of protected health information, even if, as a condition of receiving the funding, the covered entity is required to report protected health information to the agency for program oversight or other purposes. (Certain of these disclosures would also be exempt from the sale requirements, depending on whether the requirement to report data was included in regulation or other law.) Similarly, we clarify that the exchange of protected health information through a health information exchange (HIE) that is paid for through fees assessed on HIE participants is not a sale of protected health information; rather the remuneration is for the services provided by the HIE and not for the data itself. (Such disclosures may also be exempt from these provisions under the exception for disclosures to or by a business associate that is being compensated by a covered entity for its services.) In contrast, a sale of protected health information occurs when the covered entity primarily is being compensated to supply data it maintains in its role as a covered entity (or business associate). Thus, such disclosures require the individual’s authorization unless they otherwise fall within an exception at 45 CFR 164.502(a)(5)(ii)(B)(*2*). For example, a disclosure of protected health information by a covered entity to a third party researcher that is conducting the research in exchange for remuneration would fall within these provisions, unless the only remuneration received is a reasonable, cost-based fee to cover the cost to prepare and transmit the data for such purposes (see below). “In response to questions by commenters, we also clarify the scope of the term ‘remuneration.’ The statute uses the term ‘remuneration,’ and not ‘payment,’ as it does in the marketing provisions at section 13406(a) \[of the HITECH Act\]. Because the statute uses different terms, we do not believe that remuneration as applied to the sale provisions is limited to financial payment in the same way it is so limited in the marketing provisions. Thus, the prohibition on sale of protected health information applies to the receipt of nonfinancial as well as financial benefits. In response to commenters who indicated that the statute’s terms ‘direct and indirect’ apply to how the remuneration is received rather than the remuneration itself, we agree and have moved the terms in the definition to further make clear that the provisions prohibit the receipt of remuneration not only from the third party that receives the protected health information but also from another party on behalf of the recipient of the protected health information. However, this does not change the scope of the term ‘remuneration.’ As discussed above, we interpret the statute to mean that nonfinancial benefits are included in the prohibition. Thus, a covered entity or business associate may not disclose protected health information in exchange for in kind benefits, unless the disclosure falls within one of the exceptions discussed below. Consider, for example, a covered entity that is offered computers in exchange for disclosing protected health information. The provision of protected health information in exchange for the computers would not be considered a sale of protected health information if the computers were solely used for the purpose of preparing and transmitting protected health information to the person collecting it and were returned when such disclosure was completed. However, if the covered entity is permitted to use the computers for other purposes or to keep the computers even after the disclosures have been made, then the covered entity has received in kind remuneration in exchange for the protected health information above what is needed to make the actual disclosures. “We retain in the final rule the broad exception for disclosures for public health purposes made pursuant to 45 CFR 164.512(b) and 164.514(e). Based on the concerns from the public comment that narrowing the exception could discourage voluntary public health reporting, we do not limit the exception to only those disclosures where all the covered entity receives as remuneration is a cost-based fee to cover the cost to prepare and transmit the data. “With respect to the exception for research disclosures, the final rule adopts the language as proposed, including the cost-based fee limitation provided for in the HITECH Act. Thus, disclosures for research purposes are excepted from the remuneration prohibition to the extent that the only remuneration received by the covered entity or business associate is a reasonable cost-based fee to cover the cost to prepare and transmit the protected health information for such purposes. We do not remove the fee limitation as requested by some commenters; the statutory language included in Section 13405(d)(2)(B) of the HITECH Act clearly states that any remuneration received in exchange for research disclosures must reflect only the cost of preparation and transmittal of the data for such purpose. “In response to comments about the types of costs that are permitted in the reasonable cost-based fee to prepare and transmit the data, we clarify that this may include both direct and indirect costs, including labor, materials, and supplies for generating, storing, retrieving, and transmitting the protected health information; labor and supplies to ensure the protected health information is disclosed in a permissible manner; as well as related capital and overhead costs. However, fees charged to incur a profit from the disclosure of protected health information are not allowed. We believe allowing a profit margin would not be consistent with the language contained in Section 13405 of the HITECH Act. We intend to work with the research community to provide guidance and help the research community reach a common understanding of appropriate cost-based limitations on remuneration. “We retain the exceptions proposed for treatment and payment disclosures without modification and agree with commenters that these exceptions are necessary to make clear that these core health care functions may continue. Similarly, we retain the exception to the remuneration prohibition for disclosures for the transfer, merger, or consolidation of all or part of a covered entity with another covered entity, or an entity that following such activity will become a covered entity, and related due diligence, to ensure that such disclosures may continue to occur in accordance with the Privacy Rule. We retain the proposed exception for disclosures that are otherwise required by law to ensure a covered entity can continue to meet its legal obligations without imposing an authorization requirement. We also retain the exception for disclosures to the individual to provide the individual with access to protected health information or an accounting of disclosures, where the fees charged for doing so are in accord with the Privacy Rule. “We adopt the exceptions for remuneration paid by a covered entity to a business associate for activities performed on behalf of a covered entity, as well as the general exception permitting a covered entity to receive remuneration in the form of a reasonable, cost-based fee to cover the cost to prepare and transmit the protected health information for any disclosure otherwise permitted by the Privacy Rule. However, we make a number of clarifications to address commenters questions and concerns regarding the ability of a business associate rather than a covered entity to receive the permitted remuneration. First, we add the term ‘business associate’ in the general exception permitting reasonable, cost-based fees to prepare and transmit data (or fees permitted by State laws) to make clear that business associates may continue to recoup fees from third party record requestors for preparing and transmitting records on behalf of a covered entity, to the extent such fees are reasonable, cost-based fees to cover the cost to prepare and transmit the protected health information or otherwise expressly permitted by other law. Second, we clarify in the business associate exception that the exception would also cover remuneration by a business associate to its subcontractor for activities performed by the subcontractor on behalf of the business associate. Finally, we add the term ‘business associate’ to the general prohibition on sale of protected health information for consistency, even though, without the addition, a business associate still would not be permitted to sell protected health information as a business associate may generally only make uses and disclosures of protected health information in manners in which a covered entity would be permitted under the Privacy Rule. “With respect to the types of costs that would be permitted as part of a reasonable, cost-based fee under this provision, we clarify that the final rule permits the same types of costs under this exception as the research exception, as well as costs that are in compliance with a fee schedule provided by State law or otherwise expressly permitted by other applicable law. Thus, costs may include the direct and indirect costs to prepare and transmit the data, including labor, materials, and supplies, but not a profit margin. We intend to continue to work with interested stakeholders to develop more guidance on direct and indirect costs and on remuneration.” 78 *Federal Register* 5606-5608 Tomorrow, we look at modifications to 45 CFR 164.502(e): *Standard: Disclosures to business associates*. ### HIPAA Final Rule: Prohibited Uses and Disclosures of Genetic Information for Underwriting Purposes URL: https://hipaa.com/hipaa-final-rule-prohibited-uses-and-disclosures-of-genetic-information-for-underwriting-purposes/ Last updated: 2013-03-06T12:50:51.000Z **March 6, 2013**. Today, we continue going through the HIPAA Privacy Rule, section by section, as modified in the Final Rule: [*Modifications to the HIPAA Privacy, Security, Enforcement, and Breach Notification Rules Under the Health Information Technology for Economic and Clinical Health Act \[HITECH Act\] and the Genetic Information Nondiscrimination Act; Other Modifications of the HIPAA Rules*](http://www.gpo.gov/fdsys/pkg/FR-2013-01-25/pdf/2013-01073.pdf?ref=hipaa.com), which was published in the Federal Register on January 25, 2013\. The effective date of the Final Rule is March 26, 2013, and covered entities and business associates must comply by September 23, 2013. Our focus today is on the first of two *prohibited uses and disclosures* of protected health information in the *General rules* regulatory provisions of 45 CFR 164.502(a)(5):(i) *Use and disclosure of genetic information for underwriting purposes* at 78 *Federal Register* 5696: Notwithstanding any other provision of \[the HIPAA Privacy Rule\], a health plan, excluding an issuer of a long-term care policy falling within paragraph (1)(viii) of the definition of *health plan,* shall not use or disclose protected health information that is genetic information for underwriting purposes. For purposes of paragraph (a)(5)(i) of this section, underwriting purposes means, with respect to a health plan: **(A)** Except as provided in paragraph (a)(5)(i)(B) of this section: (*1*) Rules for, or determination of, eligibility (including enrollment and continued eligibility) for, or determination of, benefits under the plan, coverage, or policy (including changes in deductibles or other cost-sharing mechanisms in return for activities such as completing a health risk assessment or participating in a wellness program); (*2*) The computation of premium or contribution amounts under the plan, coverage, or policy (including discounts, rebates, payments in kind, or other premium differential mechanisms in return for activities such as completing a health risk assessment or participating in a wellness program); (*3*) The application of any pre-existing condition exclusion under the plan, coverage, or policy; and (*4*) Other activities related to the creation, renewal, or replacement of a contract of health insurance or health benefits. **(B)** Underwriting purposes does not include determinations of medical appropriateness where an individual seeks a benefit under the plan, coverage, or policy. We provide here the content of the Final Rule preamble that underpins the prohibited use and disclosure regulatory provision above: “The final rule adopts the proposed prohibition on a health plan’s use or disclosure of genetic information for underwriting purposes, except with regard to health plans that are issuers of long term care policies.... This prohibition, located in this final rule at 45 CFR 164.502(a)(5), applies to all genetic information from the compliance date \[September 23, 2013\] of these modifications forward, regardless of when or where the genetic information originated. We do not believe a clarification of this fact in the regulatory text is necessary. “Consistent with Sec. 101(a) of the \[GINA\] statute, this prohibition should not be construed to limit the ability of a health plan to adjust premiums or contribution amounts for a group health plan based on the manifestation of a disease or disorder of an individual enrolled in the plan, even though a health plan cannot use the manifestation of a disease or disorder in one individual as genetic information about other group members and to further increase the premium for the plan. Similarly, for the individual health insurance market, a health plan is not prohibited from establishing rules for eligibility for an individual to enroll in coverage or from adjusting premium or contribution amounts for an individual based on the manifestation of a disease or disorder in that individual or in a family member of such individual where such family member is covered under the individual’s policy, even though the health plan cannot use the manifestation of a disease or disorder in one individual as genetic information about other individuals to further increase premiums or contribution amounts for those other individuals. \[We covered these issues in an earlier HIPAA.com posting.\] “To illustrate how the prohibition operates, we reiterate the following examples (but for the reasons explained above, decline to include them in the regulatory text). If a health insurance issuer, with respect to an employer-sponsored group health plan, uses an individual’s family medical history or the results of genetic tests maintained in the group health plan’s claims experience information to adjust the plan’s blended, aggregate premium rate for the upcoming year, the issuer would be using protected health information that is genetic information for underwriting purposes in violation of 45 CFR 164.502(a)(5)(i) \[above\]. Similarly, if a group health plan uses family medical history provided by an individual incidental to the collection of other information on a health risk assessment to grant a premium reduction to the individual, the group health plan would be using genetic information for underwriting purposes in violation of 164.502(a)(5)(i). “The prohibition is limited to health plans. A health care provider may use or disclose genetic information as it sees fit for treatment of an individual. If a covered entity, such as an HMO, acts as both a health plan and health care provider, it may use genetic information for purposes of treatment, to determine the medical appropriateness of a benefit, and as otherwise permitted by the Privacy Rule, but may not use such genetic information for underwriting purposes. Such covered entities, in particular, should ensure that appropriate staff members are trained on the permissible and impermissible uses of genetic information.” 78 *Federal Register* 5666-5667 Tomorrow, we look at the second of two categories of modified *prohibited uses and disclosures* regulations: *sale of protected health information.* ### HIPAA Final Rule: Business Associates--Permitted and Required Uses & Disclosures URL: https://hipaa.com/hipaa-final-rule-business-associates-permitted-and-required-uses-disclosures/ Last updated: 2013-03-05T12:34:05.000Z **March 5, 2013**. Today, we continue going through the HIPAA Privacy Rule, section by section, as modified in the Final Rule: [*Modifications to the HIPAA Privacy, Security, Enforcement, and Breach Notification Rules Under the Health Information Technology for Economic and Clinical Health Act \[HITECH Act\] and the Genetic Information Nondiscrimination Act; Other Modifications of the HIPAA Rules*](http://www.gpo.gov/fdsys/pkg/FR-2013-01-25/pdf/2013-01073.pdf?ref=hipaa.com), which was published in the Federal Register on January 25, 2013\. The effective date of the Final Rule is March 26, 2013, and covered entities and business associates must comply by September 23, 2013. Our focus today is on business associates in 45 CFR 164.502: *Uses and disclosures of protected health information: General Rules­*—(a) *Standard*. A covered entity or business associate may not use or disclose protected health information, except as permitted or required by \[the HIPAA Privacy Rule\] or by subpart C of part 160 of this subchapter \[*Compliance and Investigations* of *General Administrative Requirements* of *Administrative Data Standards and Related Requirements*\]. Below we present the modified regulations pertaining to (3) *Business associates: Permitted uses and disclosures*; and (4) *Business associates: Required uses and disclosures*. 78 *Federal Register* 5696 **(3) *Business associates: Permitted uses and disclosures***. A business associate may use or disclose protected health information only as permitted or required by its business associate contract or other arrangement pursuant to 45 CFR 164.504(e) \[*Uses and disclosures: Organizational requirements—Standard. Business associate contracts*: at 78 *Federal Register* 5697-5698\] or as required by law. The business associate may not use or disclose protected health information in a manner that would violate the requirements of \[the HIPAA Privacy Rule\], if done by the covered entity, except for the purposes specified under 164.504(e)(2)(i)(A) or (B) if such uses or disclosures are permitted by its contract or other arrangement. Here are 164.504(e)(2)(i)(A) and (B): 164.504(e)(2): *Implementation specifications: Business associate contracts*. A contract between the covered entity and a business associate must: (i) Establish the permitted and required uses and disclosures of protected health information by the business associate. The contract may not authorize the business associate to use or further disclose the information in a manner that would violate the requirements of \[the HIPAA Privacy Rule\], if done by the covered entity, except that; (A) The contract may permit the business associate to use and disclose protected health information for the proper management and administration of the business associate, as provided in paragraph (e)(4) of this section \[*Implementation specifications: Other requirements for contracts and other arrangements*\]; and (B) The contract may permit the business associate to provide data aggregation services relating to the health care operations of the covered entity. 78 *Federal Register* 5697 **(4) *Business associates: Required uses and disclosures***. A business associate is required to disclose protected health information: (i) When required by the Secretary under subpart C of part 160 of this subchapter \[*Compliance and Investigations* of *General Administrative Requirements* of *Administrative Data Standards and Related Requirements*\] to investigate or determine the business associate’s compliance with this subchapter. (ii) To the covered entity, individual, or individual’s designee, as necessary to satisfy a covered entity’s obligations under 45 CFR 164.524(c)(2)(ii) and (3)(ii) with respect to an individual’s request for an electronic copy of protected health information. Here are 164.524(c)(2)(ii) and (3)(ii): 164.524(c): *Access of individuals to protected health information—* *Implementation specifications: Provision of access:* (2)(ii) *Form of access requested—Notwithstanding* paragraph (c)(2)(i) of this section, if the protected health information that is the subject of a request for access is maintained in one or more designated record sets electronically and if the individual requests an electronic copy of such information, the covered entity must provide the individual with access to the protected health information in the electronic form and format requested by the individual, if it is readily producible in such form and format; or, if not, in a readable electronic form and format as agreed to by the covered entity and the individual. (3)(ii) *Time and manner of access—If* an individual’s request for access directs the covered entity to transmit the copy of protected health information directly to another person designated by the individual, the covered entity must provide the copy to the person designated by the individual. The individual’s request must be in writing, signed by the individual, and clearly identify the designated person and where to send the copy of protected health information. We provide here a selection of the Final Rule preamble that underpins the regulatory provisions above: “\[T\]he final rule provides that a business associate is a person who performs functions or activities on behalf of, or certain services for, a covered entity or another business associate that involve the use or disclosure of protected health information. The final rule establishes that a person becomes a business associate by definition, not by the act of contracting with a covered entity or otherwise. Therefore, liability for impermissible uses and disclosures attaches immediately when a person creates, receives, maintains, or transmits protected health information on behalf of a covered entity or business associate and otherwise meets the definition of a business associate. “Liability also does not depend on the type of protected health information that a business associate creates, receives, maintains, or transmits on behalf of a covered entity or another business associate, or on the type of entity performing the function or service, except to the extent the entity falls within one of the exceptions at paragraph 4 of the definition of business associate. First, protected health information created, received, maintained, or transmitted by a business associate may not necessarily include diagnosis-specific information, such as information about the treatment of an individual, and may be limited to demographic or other information not indicative of the type of health care services provided to an individual. If the information is tied to a covered entity, then it is protected health information by definition since it is indicative that the individual received health care services or benefits from the covered entity, and therefore it must be protected by the business associate in accordance with the HIPAA Rules and its business associate agreement. Second, the definition of business associate is contingent on the fact that the business associate performs certain activities or functions on behalf of, or provides certain services to, a covered entity or another business associate that involve the use or disclosure of protected health information. Therefore, any person, defined in the HIPAA Rules as a natural person, trust or estate, partnership, corporation, professional association or corporation, or other entity, public or private, who performs these functions or activities or services is a business associate for purposes of the HIPAA Rules, regardless of whether such person has other professional or privilege-based duties or responsibilities. … “In response to comments requesting clarification on which HIPAA provisions a business associate is directly liable for compliance, we provide the following. Business associates are directly liable under the HIPAA Rules for impermissible uses and disclosures, for a failure to provide breach notification to the covered entity, for a failure to provide access to a copy of electronic protected health information to either the covered entity, the individual, or the individual’s designee (whichever is specified in the business associate agreement), for a failure to disclose protected health information where required by the Secretary to investigate or determine the business associate’s compliance with the HIPAA Rules, for a failure to provide an accounting of disclosures, and for a failure to comply with the requirements of the Security Rule. Business associates remain contractually liable for other requirements of the business associate agreement … . “With respect to a business associate’s direct liability for a failure to provide access to a copy of electronic protected health information, business associates are liable for providing electronic access in accordance with their business associate agreements. Therefore, business associates may provide electronic access directly to individuals or their designees, or may provide the electronic protected health information to the covered entity (which then provides the electronic access to individuals or their designees). As with many other provisions in the HIPAA Rules, the Department leaves the details to the contracting parties, and is concerned only that access is provided to the individual, not with which party provides the access.” 78 *Federal Register* 5598-5599 Tomorrow, we look at the first of two categories of modified *prohibited uses and disclosures* regulations: use and disclosure of genetic information for underwriting purposes. ### HIPAA Final Rule: Covered Entities--Permitted Uses and Disclosures & Required Disclosures URL: https://hipaa.com/hipaa-final-rule-covered-entities-permitted-uses-and-disclosures-required-disclosures/ Last updated: 2013-03-04T23:17:49.000Z **March 4, 2013**. Today, we start going through the HIPAA Privacy Rule, section by section, as modified in the Final Rule: [*Modifications to the HIPAA Privacy, Security, Enforcement, and Breach Notification Rules Under the Health Information Technology for Economic and Clinical Health Act \[HITECH Act\] and the Genetic Information Nondiscrimination Act; Other Modifications of the HIPAA Rules*](http://www.gpo.gov/fdsys/pkg/FR-2013-01-25/pdf/2013-01073.pdf?ref=hipaa.com), which was published in the Federal Register on January 25, 2013\. The effective date of the Final Rule is March 26, 2013, and covered entities and business associates must comply by September 23, 2013. Our focus today is on covered entities in 45 CFR 164.502: *Uses and disclosures of protected health information: General Rules­*—(a) *Standard*. A covered entity or business associate may not use or disclose protected health information, except as permitted or required by \[the HIPAA Privacy Rule\] or by subpart C of part 160 of this subchapter \[*Compliance and Investigations* of *General Administrative Requirements* of *Administrative Data Standards and Related Requirements*\]. Below we present the modified regulations pertaining to (1) *Covered entities: Permitted uses and disclosures*; and (2) *Covered entities: Required disclosures*. 78 *Federal Register* 5696 **(1) *Covered entities: Permitted uses and disclosures***. A covered entity is permitted to use or disclose protected health information as follows: (i) To the individual; (ii) For treatment, payment, or health care operations, as permitted by and in compliance with 45 CFR 164.506 \[*Uses and disclosures to carry out treatment, payment, or health care operations*\]; (iii) Incident to a use or disclosure otherwise permitted or required by \[the HIPAA Privacy Rule\], provided that the covered entity has complied with the applicable requirements of 45 CFR 164.502(b) \[*Uses and disclosures of protected health information*—*Standard. Minimum necessary*\], 164.514(d) \[*Other requirements relating to uses and disclosures of protected health information—Minimum necessary requirements*\], and 164.530(c) \[*Administrative requirements—Safeguards*\] with respect to such otherwise permitted or required use or disclosure; (iv) Except for uses and disclosures prohibited under 45 CFR 164.502(a)(5)(i) \[*Prohibited uses and disclosures—Use and disclosure of genetic information for underwriting purposes*\], pursuant to and in compliance with a valid authorization under 45 CFR 164.508 \[*Uses and disclosures for which an authorization is required*\]; (v) Pursuant to an agreement under, or as otherwise permitted by, 45 CFR 164.510 \[*Uses and disclosures requiring an opportunity for the individual to agree or to object*\]; (vi) As permitted by and in compliance with this section, 45 CFR 164.512 \[Uses and disclosures for which an authorization or opportunity to agree or object is not required\], 164.514(e) \[Other requirements relating to uses and disclosures of protected health information—*Standard: Limited data set*\], 164.514(f) \[*Fundraising communications*\], or 164.514(g) \[*Standard: Uses and disclosures for underwriting and related purposes*\]. **(2) *Covered entities: Required disclosures*.** A covered entity is required to disclose protected health information: (i) To an individual, when requested under, and required by 45 CFR 164.524 \[*Access of individuals to protected health information*\] and 164.528 \[*Accounting of disclosures of protected health information*\]; and (ii) When required by the Secretary under subpart C of part 160 of this subchapter \[*Compliance and Investigations* of *General Administrative Requirements* of *Administrative Data Standards and Related Requirements*\] to investigate or determine the covered entity’s compliance with this subchapter. Tomorrow, we look at modified permitted and required uses and disclosures regulations pertaining to business associates. ### HIPAA Final Rule: Modified Privacy Rule Definition--Marketing URL: https://hipaa.com/hipaa-final-rule-modified-privacy-rule-definition-marketing/ Last updated: 2013-03-01T19:21:51.000Z **March 1, 2013**. Today, we continue to examine definitions pertaining to the HIPAA Privacy Rule, for which we shall begin to examine modifications next week. Today’s definition is *marketing*, as modified in the Final Rule: [*Modifications to the HIPAA Privacy, Security, Enforcement, and Breach Notification Rules Under the Health Information Technology for Economic and Clinical Health Act \[HITECH Act\] and the Genetic Information Nondiscrimination Act; Other Modifications of the HIPAA Rules*](http://www.gpo.gov/fdsys/pkg/FR-2013-01-25/pdf/2013-01073.pdf?ref=hipaa.com), which was published in the Federal Register on January 25, 2013\. The effective date of the Final Rule is March 26, 2013, and covered entities and business associates must comply by September 23, 2013. Here are excerpts from the relatively lengthy discussion in the Final Rule at 78 *Federal Register* 5595-5597 related to the modifications to the definition of *marketing* from the [Notice of Proposed Rule Making](http://www.hhs.gov/ocr/privacy/hipaa/understanding/coveredentities/nprmhitech.pdf?ref=hipaa.com) (NPRM), followed by the Final Rule definition of *marketing*: “The final rule significantly modifies the proposed rule’s approach to marketing by requiring authorization for all treatment and health care operations communications where the covered entity receives financial remuneration for making the communications from a third party whose product or service is being marketed. … We acknowledge that the distinction between what constitutes a treatment versus a health care operations communication may be difficult to make with precision in all cases, placing covered entities at risk for violating the authorization requirement for marketing communications. We, therefore, believe that requiring authorizations for all subsidized communications that market a health related product or service is the best policy. Such a policy will ensure that all such communications are treated as marketing communications, instead of requiring covered entities to have two processes in place based on whether the communication provided to individuals is for a treatment or a health care operations purpose. … “We adopt the term ‘‘financial remuneration’’ and its definition as proposed without modification in the final rule. Most commenters were generally satisfied with the proposed use of the term and its definition. There was, however, some confusion among commenters as to what constitutes direct or indirect payment from or on behalf of a third party. We clarify that under this provision direct payment means financial remuneration that flows from the third party whose product or service is being described directly to the covered entity. In contrast, indirect payment means financial remuneration that flows from an entity on behalf of the third party whose product or service is being described to a covered entity. “We also clarify that where a business associate (including a subcontractor), as opposed to the covered entity itself, receives financial remuneration from a third party in exchange for making a communication about a product or service, such communication also requires prior authorization from the individual. … Thus, individual authorization also must be obtained if a business associate is to send these communications instead of the covered entity. “We also confirm, in response to comments, that the term ‘‘financial remuneration’’ does not include non-financial benefits, such as in-kind benefits, provided to a covered entity in exchange for making a communication about a product or service. Rather, financial remuneration includes only payments made in exchange for making such communications. In addition, we continue to emphasize that the financial remuneration a covered entity receives from a third party must be for the purpose of making a communication and such communication must encourage individuals to purchase or use the third party’s product or service. If the financial remuneration received by the covered entity is for any purpose other than for making the communication, then this marketing provision does not apply. For example, if a third party provides financial remuneration to a covered entity to implement a program, such as a disease management program, the covered entity could provide individuals with communications about the program without obtaining individual authorization as long as the communications are about the covered entity’s program itself. There, the communications would only be encouraging individuals to participate in the covered entity’s disease management program and would not be encouraging individuals to use or purchase the third party’s product or service. “Under the final rule, for marketing communications that involve financial remuneration, the covered entity must obtain a valid authorization from the individual before using or disclosing protected health information for such purposes, and such authorization must disclose the fact that the covered entity is receiving financial remuneration from a third party. The scope of the authorization need not be limited only to subsidized communications related to a single product or service or the products or services of one third party, but rather may apply more broadly to subsidized communications generally so long as the authorization adequately describes the intended purposes of the requested uses and disclosures (i.e., the scope of the authorization) and otherwise contains the elements and statements of a valid authorization under 45 CFR 164.508 \[*Uses and disclosures for which an authorization is required*\]. This includes making clear in the authorization that the individual may revoke the authorization at any time he or she wishes to stop receiving the marketing material. … “\[N\]o authorization is required where a covered entity receives financial remuneration from a third party to make a treatment or health care operations communication (or other marketing communication), if the communication is made face-to-face by a covered entity to an individual or consists of a promotional gift of nominal value provided by the covered entity. For example, a health care provider could, in a face to face conversation with the individual, recommend, verbally or by handing the individual written materials such as a pamphlet, that the individual take a specific alternative medication, even if the provider is otherwise paid by a third party to make such communications. However, communications made over the phone (as well as all communications sent through the mail or via email) do not constitute face to face communications, and as such, these communications require individual authorization where the covered entity receives remuneration in exchange for making the communications. “With respect to the exception for refill reminders or to otherwise communicate about a drug or biologic currently being prescribed to the individual, we adopt the exception as proposed. We continue to provide a stand-alone exception for refill reminders, given that the HITECH Act expressly does so. … At this time, we clarify that we consider communications about the generic equivalent of a drug being prescribed to an individual as well as adherence communications encouraging individuals to take their prescribed medication as directed fall within the scope of this exception. Additionally, we clarify that where an individual is prescribed a self-administered drug or biologic, communications regarding all aspects of a drug delivery system, including, for example, an insulin pump, fall under this exception. With respect to the array of other examples and suggestions provided by commenters as to what should fall within or outside of the exception, we intend to provide future guidance to address these questions. “The proposed rule contained the Act’s limitation that the financial remuneration received in exchange for providing a refill reminder or to otherwise communicate about a drug or biologic currently being prescribed to the individual must be ‘‘reasonable in amount,’’ by providing that such remuneration must be reasonably related to the covered entity’s cost of making the communication for the exception from marketing to apply. We adopt this provision in the final rule. In response to comments regarding what types of costs fall within permissible remuneration, we clarify that we consider permissible costs for which a covered entity may receive remuneration under this exception are those which cover only the costs of labor, supplies, and postage to make the communication. … "Finally, in addition to the communications that fall within the refill reminder exception, two other types of communications continue to be exempt from the marketing provisions. First, as explained in the NPRM, communications promoting health in general and that do not promote a product or service from a particular provider, such as communications promoting a healthy diet or encouraging individuals to get certain routine diagnostic tests, such as annual mammograms, do not constitute marketing and thus, do not require individual authorization. "Second, communications about government and government-sponsored programs do not fall within the definition of ‘‘marketing’’ as there is no commercial component to communications about benefits through public programs. Therefore, a covered entity may use and disclose protected health information to communicate with individuals about eligibility for programs, such as Medicare, Medicaid, or the State Children’s Health Insurance Program (CHIP) without obtaining individual authorization." Here is the modified definition of *marketing*, 45 CFR 164.501, at 78 *Federal Register* 5696, which is effective March 26, 2013: **(1)** Except as provided in paragraph (2) of this definition, marketing means to make a communication about a product or service that encourages recipients of the communication to purchase or use the product or service. **(2)** Marketing does not include a communication made: (i) To provide refill reminders or otherwise communicate about a drug or biologic that is currently being prescribed for the individual, only if any financial remuneration received by the covered entity in exchange for making the communication is reasonably related to the covered entity’s cost of making the communication. (ii) For the following treatment and health care operations purposes, except where the covered entity receives financial remuneration in exchange for making the communication: (A) For treatment of an individual by a health care provider, including case management or care coordination for the individual, or to direct or recommend alternative treatments, therapies, health care providers, or settings of care to the individual; (B) To describe a health-related product or service (or payment for such product or service) that is provided by, or included in a plan of benefits of, the covered entity making the communication, including communications about: the entities participating in a health care provider network or health plan network; replacement of, or enhancements to, a health plan; and health-related products or services available only to a health plan enrollee that add value to, but are not part of, a plan of benefits; or (C) For case management or care coordination, contacting of individuals with information about treatment alternatives, and related functions to the extent these activities do not fall within the definition of treatment. **(3)** *Financial remuneration* means direct or indirect payment from or on behalf of a third party whose product or service is being described. Direct or indirect payment does not include any payment for treatment of an individual. Next week, we examine modifications to HIPAA Privacy Rule provisions, starting with 45 CFR 164.502 (*Uses and disclosures of protected health information: General Rules)*. ### Definition: Health Care Operations URL: https://hipaa.com/hipaa-final-rule-modified-privacy-rule-definition-health-care-operations/ Last updated: 2013-02-28T15:23:26.000Z Today, we continue to examine definitions pertaining to the HIPAA Privacy Rule, for which we shall begin to examine modifications of provisions next week. Today’s definition is *health care operations*, as modified in the Final Rule: [*Modifications to the HIPAA Privacy, Security, Enforcement, and Breach Notification Rules Under the Health Information Technology for Economic and Clinical Health Act \[HITECH Act\] and the Genetic Information Nondiscrimination Act; Other Modifications of the HIPAA Rules*](http://www.gpo.gov/fdsys/pkg/FR-2013-01-25/pdf/2013-01073.pdf?ref=hipaa.com), which was published in the Federal Register on January 25, 2013\. The effective date of the Final Rule is March 26, 2013, and covered entities and business associates must comply by September 23, 2013. Here is the discussion in the Final Rule related to the proposed modification to the definition of *health care operations* from the [Notice of Proposed Rule Making](http://www.hhs.gov/ocr/privacy/hipaa/understanding/coveredentities/nprmhitech.pdf?ref=hipaa.com) (NPRM), with the proposed modification altered, then accepted in the Final Rule: “The definition of ‘‘health care operations’’ at 45 CFR 164.501 includes at paragraph (3) ‘underwriting, premium rating, and other activities relating to the creation, renewal or replacement of a contract of health insurance or benefits \* \* \*.’ To avoid confusion with the use of both ‘underwriting’ and ‘underwriting purposes’ in the Privacy Rule, and in recognition of the fact that the proposed definition of ‘underwriting purposes’ includes activities that fall within both the definitions of ‘payment’ and ‘health care operations’ in the Rule, the Department proposed to remove the term ‘underwriting’ from the definition of ‘health care operations.’ We also proposed to add the term ‘enrollment’ to the express list of health care operations activities to make clear that the removal of the term ‘underwriting’ would not impact the use or disclosure of protected health information that is not genetic information for enrollment purposes. These proposed revisions were not intended to be substantive changes to the definition and thus, health plans would be permitted to continue to use or disclose protected health information, except genetic information, for underwriting purposes. ... “Due to the confusion and concern expressed by the commenters regarding the removal of the term ‘underwriting’ from the definition, we retain the term ‘underwriting’ within the definition of ‘health care operations’ at 45 CFR164.501\. However, to make clear that a health plan may continue to use or disclose only protected health information that is not genetic information for underwriting, we include a reference to the prohibition on using or disclosing genetic information for underwriting purposes within the definition. The final rule also retains the term ‘enrollment’ within the definition because we believe it is helpful to clarify that this is a permitted health care operations activity.” 78 *Federal Register* 5666 Here is the modified definition of *health care operations*, which will be effective March 26, 2013, with the modifications underlined in (1) and (3): *Health care operations* means any of the following activities of the covered entity to the extent that the activities are related to covered functions: **(1)** Conducting quality assessment and improvement activities, including outcomes evaluation and development of clinical guidelines, provided that the obtaining of generalizable knowledge is not the primary purpose of any studies resulting from such activities; patient safety activities (as defined in 42 CFR 3.20); population-based activities relating to improving health or reducing health care costs, protocol development, case management and care coordination, contacting of health care providers and patients with information about treatment alternatives; and related functions that do not include treatment; **(2)** Reviewing the competence or qualifications of health care professionals, evaluating practitioner and provider performance, health plan performance, conducting training programs in which students, trainees, or practitioners in areas of health care learn under supervision to practice or improve their skills as health care providers, training of non-health care professionals, accreditation, certification, licensing, or credentialing activities; **(3)** Except as prohibited under 45 CFR 164.502(a)(5)(i) \[*Prohibited uses and disclosures Use and disclosure of genetic information for underwriting purposes*\] , u nderwriting, enrollment , premium rating, and other activities relating to the creation, renewal or replacement of a contract of health insurance or health benefits, and ceding, securing, or placing a contract for reinsurance of risk relating to claims for health care (including stop-loss insurance and excess of loss insurance), provided that the requirements of 45 CFR 164.514(g) \[*Standard: Uses and disclosures for underwriting and related purposes*, as modified, 78 *Federal Register* 5700\] are met, if applicable; **(4)** Conducting or arranging for medical review, legal services, and auditing functions, including fraud and abuse detection and compliance programs; **(5)** Business planning and development, such as conducting cost-management and planning-related analyses related to managing and operating the entity, including formulary development and administration, development or improvement of methods of payment or coverage policies; and **(6)** Business management and general administrative activities of the entity, including, but not limited to: (i) Management activities relating to implementation of and compliance with the requirements of this subchapter; (ii) Customer service, including the provision of data analyses for policy holders, plan sponsors, or other customers, provided that protected health information is not disclosed to such policy holder, plan sponsor, or customer. (iii) Resolution of internal grievances; (iv) The sale, transfer, merger, or consolidation of all or part of the covered entity with another covered entity, or an entity that following such activity will become a covered entity and due diligence related to such activity; and (v) Consistent with the applicable requirements of 45 CFR 164.514 \[*Other requirements relating to uses and disclosures of protected health information, as modified, 78 Federal Register 5700-5701*\], creating de-identified health information or a limited data set, and fundraising for the benefit of the covered entity. ### HIPAA Final Rule: Modified Privacy Rule Definition--Payment URL: https://hipaa.com/hipaa-final-rule-modified-privacy-rule-definition-payment/ Last updated: 2013-02-27T23:19:22.000Z **February 27, 2013**. Today, we start to examine definitions pertaining to the HIPAA Privacy Rule, and begin with *payment*, as modified in the Final Rule: [*Modifications to the HIPAA Privacy, Security, Enforcement, and Breach Notification Rules Under the Health Information Technology for Economic and Clinical Health Act \[HITECH Act\] and the Genetic Information Nondiscrimination Act; Other Modifications of the HIPAA Rules*](http://www.gpo.gov/fdsys/pkg/FR-2013-01-25/pdf/2013-01073.pdf?ref=hipaa.com), which was published in the Federal Register on January 25, 2013\. The effective date of the Final Rule is March 26, 2013, and covered entities and business associates must comply by September 23, 2013. Here is the discussion in the Final Rule related to the proposed modification to the definition of *payment* from the [July 14, 2010, Notice of Proposed Rule Making](http://www.hhs.gov/ocr/privacy/hipaa/understanding/coveredentities/nprmhitech.pdf?ref=hipaa.com) (NPRM), with the proposed modification accepted in the Final Rule: “The definition of *payment* in the Privacy Rule at 45 CFR 164.501 includes activities, such as ‘determinations of eligibility or coverage’ by a health plan, some of which may fall within the definition of ‘underwriting purposes.’ To avoid any implication that a health plan would be permitted to use or disclose protected health information for ‘payment’ purposes that are otherwise prohibited by the underwriting prohibition, we proposed to include a cross-reference in the definition of ‘payment’ to the prohibition. Further, we believed the inclusion of such a cross-reference to be necessary to properly align the definition of *payment* in the Privacy Rule with the nondiscrimination provisions of GINA Title I and their implementing regulations. GINA provides a rule of construction at section 102(a)(2), which adds paragraph 2702(c)(3) of the Public Health Service Act (PHSA), to make clear that health plans are not prohibited from obtaining and using the results of a genetic test in making determinations regarding payment, as such term is defined by the HIPAA Privacy Rule. Thus, the proposed exception would make clear that GINA’s rule of construction regarding payment does not allow a health plan to use the results of genetic tests for activities that would otherwise constitute ‘underwriting purposes,’ such as for determinations of eligibility for benefits.” 78 *Federal Register* 5666 Here is the modified definition of *payment*, which will be effective March 26, 2013, with the modification underlined : *Payment* means: (1) The activities undertaken by: (i) Except as prohibited under 45 164.502(a)(5)(i) \[*Prohibited uses and disclosures: Use and disclosure of genetic information for underwriting purposes*\], a health plan to obtain premiums or to determine or fulfill its responsibility for coverage and provision of benefits under the health plan; or (ii) A health care provider or health plan to obtain or provide reimbursement for the provision of health care; and (2) The activities in paragraph (1) of this definition relate to the individual to whom health care is provided and include, but are not limited to: (i) Determinations of eligibility or coverage (including coordination of benefits or the determination of cost sharing amounts), and adjudication or subrogation of health benefit claims; (ii) Risk adjusting amounts due based on enrollee health status and demographic characteristics; (iii) Billing, claims management, collection activities, obtaining payment under a contract for reinsurance (including stop-loss insurance and excess of loss insurance), and related health care data processing; (iv) Review of health care services with respect to medical necessity, coverage under a health plan, appropriateness of care, or justification of charges; (v) Utilization review activities, including precertification and preauthorization of services, concurrent and retrospective review of services; and (vi) Disclosure to consumer reporting agencies of any of the following protected health information relating to collection of premiums or reimbursement: (A) Name and address; (B) Date of birth; (C) Social security number; (D) Payment history; (E) Account number; and (F) Name and address of the health care provider and/or health plan. 45 CFR 164.501, at 78 *Federal Register* 5696 Tomorrow, we continue with the modified Privacy Rule definition: *Health care operations*, and Friday, with *Marketing*. ### HIPAA Final Rule: Enforcement by State Attorneys General URL: https://hipaa.com/hipaa-final-rule-enforcement-by-state-attorneys-general/ Last updated: 2013-02-26T16:04:06.000Z **February 26, 2013**. Today, we examine the HIPAA Rules enforcement role established by the HITECH Act for State attorneys general as modified in the Final Rule: [*Modifications to the HIPAA Privacy, Security, Enforcement, and Breach Notification Rules Under the Health Information Technology for Economic and Clinical Health Act \[HITECH Act\] and the Genetic Information Nondiscrimination Act; Other Modifications of the HIPAA Rules*](http://www.gpo.gov/fdsys/pkg/FR-2013-01-25/pdf/2013-01073.pdf?ref=hipaa.com), which was published in the Federal Register on January 25, 2013\. The effective date of the Final Rule is March 26, 2013, and covered entities and business associates must comply by September 23, 2013. As of February 18, 2009, Section 13410(e) of the HITECH Act granted State attorneys general the authority to enforce HIPAA Rules by bringing civil actions on behalf of State residents in federal district court. In the July 14, 2010, [Notice of Proposed Rule Making](http://www.hhs.gov/ocr/privacy/hipaa/understanding/coveredentities/nprmhitech.pdf?ref=hipaa.com) (NPRM) that was finalized in the January 25, 2013, Final Rule, the Department of Health and Human Services (HHS) noted: “we clarify that we are not issuing regulations with respect to the new authority of the State Attorneys General to enforce the HIPAA Rules.” 75 *Federal Register* 40870 The HITECH Act Section 13410(e)(1) provisions describe the role of State attorneys general for enforcement of HIPAA Rules. Section 13410, *Improved Enforcement* of the HITECH Act provided in subsection (e) for *Enforcement Through State Attorneys General*. Here is the statutory language for provisions in (1) at [123 STAT. 274-275](http://www.hhs.gov/ocr/privacy/hipaa/understanding/coveredentities/hitechact.pdf?ref=hipaa.com): “(1) In General.—Section 1176 of the Social Security Act (42 USC 1320d-5) is amended by adding at the end the following new subsection: ‘(d) Enforcement by State Attorneys General.— ‘**(1)** **Civil Action**.—Except as provided in subsection (b), in any case in which the attorney general of a State has reason to believe that an interest of one or more of the residents of that State has been or is threatened or adversely affected by any person who violates a provision of this part, the attorney general of the State, as parens patriae, may bring a civil action on behalf of such residents of the State in a district court of the United States of appropriate jurisdiction— ‘(A) to enjoin further such violation by the defendant; or ‘(B) to obtain damages on behalf of such residents of the State, in an amount equal to the amount determined under paragraph (2). ‘**(2)** **Statutory Damages**.— ‘(A) In General.—For purposes of paragraph (1)(B), the amount determined under this paragraph is the amount calculated by multiplying the number of violations by up to $100\. For purposes of the preceding sentence, in the case of a continuing violation, the number of violations shall be determined consistent with the HIPAA privacy regulations (as defined in section 1180(b)(3)) for violations of subsection (a). ‘(B) Limitation.—The total amount of damages imposed on the person for all violations of an identical requirement or prohibition during a calendar year may not exceed $25,000. ‘(C) Reduction of Damages.—In assessing damages under subparagraph (A), the court may consider the factors the Secretary may consider in determining the amount of a civil money penalty under subsection (a) under the HIPAA privacy regulations. **‘(3) Attorney Fees**.—In the case of any successful action under paragraph (1), the court, in its discretion, may award the costs of the action and reasonable attorney fees to the State. **‘(4) Notice to the Secretary**.—The State shall serve prior written notice of any action under paragraph (1) upon the Secretary with a copy of its complaint, except in any case in which such prior notice is not feasible, in which case the State shall serve such notice immediately after instituting such action. The Secretary shall have the right— ‘(A) to intervene in the action; ‘(B) upon so intervening, to be heard on all matters arising therein; and ‘(C) to file petitions for appeal. **‘(5) Construction**.—For purposes of bringing any civil action under paragraph (1), nothing in this section shall be construed to prevent an attorney general of a State from exercising the powers conferred on the attorney general by the laws of that State. **‘(6) Venue; Service of Process**.— ‘(A) Venue.—Any action brought under paragraph (1) may be brought in the district court of the United States that meets applicable requirements relating to venue under section 1391 of title 28, United States Code. “(B) Service of Process.—In an action brought under paragraph (1), process may be served in any district in which the defendant— ‘(i) is an inhabitant; or ‘(ii) maintains a physical place of business. **‘(7) Limitation on State Action While Federal Action is Pending**.—If the Secretary has instituted an action against a person under subsection (a) with respect to a specific violation of this part, no State attorney general may bring an action under this subsection against the person with respect to such violation during the pendency of that action. **‘(8) Application of CMP Statute of Limitations**.—A civil action may not be instituted with respect to a violation of this part unless an action to impose a civil money penalty \[CMP\] may be instituted under subsection (a) with respect to such violation consistent with the second sentence of section 1128A(c)(1).’” The following discussion about a modification to 45 CFR 160.310(c)(3), adopted in the Final Rule, is relevant to the enforcement role of State attorneys general \[78 *Federal Register* 5579\]: “Section 160.310 requires that covered entities make information available to and cooperate with the Secretary during complaint investigations and compliance reviews. Section 160.310(c)(3) provides that any protected health information obtained by the Secretary in connection with an investigation or compliance review will not be disclosed by the Secretary, except as necessary for determining and enforcing compliance with the HIPAA Rules or as otherwise required by law. In the proposed rule, we proposed to modify this paragraph to also allow the Secretary to disclose protected health information if permitted under the Privacy Act at 5 U.S.C. 552a(b)(7). Section 5 U.S.C. 552a(b)(7) permits the disclosure of a record on an individual contained within a government system of records protected under the Privacy Act to another agency or instrumentality of any governmental jurisdiction within or under the control of the United States for a civil or criminal law enforcement activity if the activity is authorized by law and if the agency has made a written request to the agency that maintains the record. The proposed change would permit the Secretary to coordinate with other law enforcement agencies, such as the State Attorneys General pursuing civil actions to enforce the HIPAA Rules on behalf of State residents pursuant to section 13410(e) of the Act.... “To facilitate cooperation between the Department and other law enforcement agencies, the final rule adopts the modifications to 45 CFR 160.310(c)(3) as proposed in the NPRM \[referenced earlier in this posting\]. Further, the Department will be working closely with State Attorneys General to coordinate enforcement in appropriate cases, as provided under section 13410(e) of the HITECH Act. The Department will continue to update its web site as necessary and appropriate to maintain transparency with the public and the regulated community about these coordinated activities and its other enforcement actions and activities.” The just referenced Web Site, entitled [*State Attorneys General*](http://www.hhs.gov/ocr/privacy/hipaa/enforcement/sag/index.html?ref=hipaa.com), provides the following information: “This new enforcement authority granted to State Attorneys General (SAG) by section 13410(e) of the HITECH Act will require significant coordination between OCR and SAG. OCR welcomes collaboration with SAG seeking to bring civil actions to enforce the HIPAA Privacy and Security Rules, and OCR will assist SAG in the exercise of this new enforcement authority. OCR will provide information upon request about pending or concluded OCR actions against covered entities or business associates related to SAG investigations. OCR will also provide guidance regarding the HIPAA statute, the HITECH Act, and the HIPAA Privacy, Security, and Enforcement Rules as well as the Breach Notification Rule.” A companion Web site, entitled [*HIPAA Enforcement Training for State Attorneys General*](http://www.hhs.gov/ocr/privacy/hipaa/enforcement/sag/sagmoreinfo.html?ref=hipaa.com), provides the following information: “OCR developed HIPAA Enforcement Training to help State Attorneys General and their staff use their new authority to enforce the HIPAA Privacy and Security Rules. The training course will aid State Attorneys General in investigating and seeking damages for HIPAA violations that affect residents of their states. Videos and slides from live training sessions conducted in 2011 are available through the OCR website.” Tomorrow, we begin to examine modifications to the HIPAA Privacy Rule. ### HIPAA Final Rule: Enforcement--Factors for Determining Civil Money Penalties for HIPAA Violations URL: https://hipaa.com/hipaa-final-rule-enforcement-factors-for-determining-civil-money-penalties-for-hipaa-violations/ Last updated: 2013-02-25T12:45:46.000Z **February 25, 2013**. Today, we examine factors considered in determining the amount of a civil money penalty for a HIPAA violation that are modified in the Final Rule: [*Modifications to the HIPAA Privacy, Security, Enforcement, and Breach Notification Rules Under the Health Information Technology for Economic and Clinical Health Act \[HITECH Act\] and the Genetic Information Nondiscrimination Act; Other Modifications of the HIPAA Rules*](http://www.gpo.gov/fdsys/pkg/FR-2013-01-25/pdf/2013-01073.pdf?ref=hipaa.com), which was published in the Federal Register on January 25, 2013\. The effective date of the Final Rule is March 26, 2013, and covered entities and business associates must comply by September 23, 2013. The Department of Health and Human Services (HHS) identified “five general factors” for modification of 45 CFR 160.408 in conformance with the HITECH Act: - Nature and extent of the violation - Nature and extent of the harm resulting from a violation - History of prior compliance with the administrative simplification provision, including violations by the covered entity or business associate - Financial condition of the covered entity or business associate - Such other matters as justice may require. Within each of the five general categories, HHS identified “specific factors” for consideration, the information relating to which would be collected and compiled during an investigation. As we pointed out in our enforcement posting last week, the modified 45 CFR 160.306, at 78 *Federal Register* 5690, provides for: (c) *Investigation*. (1) The Secretary will investigate any complaint filed under this section when a preliminary review of the facts indicates a possible violation due to willful neglect. (2) The Secretary may investigate any other complaint filed under this section. (3) An investigation under this section may include a review of the pertinent policies, procedures, or practices of the covered entity or business associate and of the circumstances regarding any alleged violation. (4) At the time of the initial written communication with the covered entity or business associate about the complaint, the Secretary will describe the acts and/or omissions that are the basis of the complaint. Here is the modified 45 CFR 160.408, at 78 *Federal Register* 5691, that outlines the five general factors and specific factors within each of the five: **Factors considered in determining the amount of a civil money penalty.** In determining the amount of any civil money penalty, the Secretary will consider the following factors, which may be mitigating or aggravating as appropriate: **(a)** The nature and extent of the violation, consideration of which may include but is not limited to: (1) The number of individuals affected; and (2) The time period during which the violation occurred; **(b)** The nature and extent of the harm resulting from the violation, consideration of which may include but is not limited to: (1) Whether the violation caused physical harm; (2) Whether the violation resulted in financial harm; (3) Whether the violation resulted in harm to an individual’s reputation; and (4) Whether the violation hindered an individual’s ability to obtain health care; **(c)** The history of prior compliance with the administrative simplification provisions, including violations, by the covered entity or business associate, consideration of which may include but is not limited to: (1) Whether the current violation is the same or similar to previous indications of noncompliance; (2) Whether and to what extent the covered entity or business associate has attempted to correct previous indications of noncompliance; (3) How the covered entity or business associate has responded to technical assistance from the Secretary provided in the context of a compliance effort; and (4) How the covered entity or business associate has responded to prior complaints; **(d)** The financial condition of the covered entity or business associate, consideration of which may include but is not limited to: (1) Whether the covered entity or business associate had financial difficulties that affected its ability to comply; (2) Whether the imposition of a civil money penalty would jeopardize the ability of the covered entity or business associate to continue to provide, or to pay for, health care; and (3) The size of the covered entity or business associate; and **(e)** Such other matters as justice may require. We recommend that you visit three of the sites that the Office for Civil Rights (OCR) maintains regarding enforcement: [*Enforcement Process*](http://www.hhs.gov/ocr/privacy/hipaa/enforcement/process/index.html?ref=hipaa.com), [*Case Examples and Resolution Agreements*](http://www.hhs.gov/ocr/privacy/hipaa/enforcement/examples/index.html?ref=hipaa.com), and [*HIPAA Privacy & Security Audit Program*](http://www.hhs.gov/ocr/privacy/hipaa/enforcement/audit/index.html?ref=hipaa.com). OCR is HHS’ enforcement arm for HIPAA Privacy and Security Rules and the HITECH Act Breach Notification Rule. Each of these sites provides information on the enforcement process and examples of the type of information OCR seeks during an investigation to address the general and specific factors identified in 45 CFR 160.408 above, as modified and effective March 26, 2013. Tomorrow, we examine the HITECH Act role of State Attorneys General in the enforcement process. ### HIPAA Final Rule: HIPAA Privacy Rule & FERPA: Student Immunization Records URL: https://hipaa.com/hipaa-final-rule-hipaa-privacy-rule-ferpa-student-immunization-records/ Last updated: 2013-02-24T18:21:58.000Z **February 22, 2013**. Today, we examine modified HIPAA Privacy Rule considerations regarding healthcare provider disclosure of immunization records for students in the Final Rule: [*Modifications to the HIPAA Privacy, Security, Enforcement, and Breach Notification Rules Under the Health Information Technology for Economic and Clinical Health Act \[HITECH Act\] and the Genetic Information Nondiscrimination Act; Other Modifications of the HIPAA Rules*](http://www.gpo.gov/fdsys/pkg/FR-2013-01-25/pdf/2013-01073.pdf?ref=hipaa.com), which was published in the Federal Register on January 25, 2013\. The effective date of the Final Rule is March 26, 2013, and covered entities and business associates must comply by September 23, 2013. Student immunization records are protected under two federal laws: HIPAA, via the HIPAA Privacy Rule, as discussed below, and the Family Educational Rights and Privacy Act (FERPA) “once a student’s immunization records are obtained and maintained by an educational institution or agency to which FERPA applies. This posting focuses on the HIPAA Privacy Rule provisions vis-à-vis such records prior to their receipt by an educational institution or agency to which FERPA applies. For further information on the “intersection of FERPA and HIPAA, consult [*Joint Guidance on the Application of FERPA and HIPAA to Student Health Records*](http://www.hhs.gov/ocr/privacy/hipaa/understanding/coveredentities/hipaaferpajointguide.pdf?ref=hipaa.com). 78 *Federal Register* 5616 The Final Rule states: “The Privacy Rule, at 45 CFR 164.512(b) \[Uses and Disclosures for which an authorization or opportunity to agree or object is not required\], recognizes that covered entities must balance protecting the privacy of health information with sharing health information with those responsible for ensuring public health and safety, and permits covered entities to disclose the minimum necessary protected health information to public health authorities or other designated persons or entities without an authorization for public health purposes specified by the Rule. “Schools play an important role in preventing the spread of communicable diseases among students by ensuring that students entering classes have been immunized. Most States have ‘school entry laws’ which prohibit a child from attending school unless the school has proof that the child has been appropriately immunized. … “Typically, schools ensure compliance with those requirements by requesting the immunization records from parents (rather than directly from a health care provider). However, where a covered health care provider is requested to send the immunization records directly to a school, the Privacy Rule generally requires written authorization by the child’s parent before a covered health care provider may do so…. “ Because of concerns with the difficulty of obtaining authorization in some cases, the “National Committee on Vital and Health Statistics …recommended that HHS regard disclosure of immunization records to schools to be a public health disclosure, thus eliminating the requirement for \[written\] authorization…. While written authorization … would no longer have been required for disclosure of such information under the proposal, the covered entity would still have been required to obtain agreement, which may have been oral, from a parent, guardian or other person acting *in loco parentis* for the individual, or from the individual him- or herself, if the individual is an adult or emancipated minor.” 78 *Federal Register* 5616 *Final Rule*. “The final rule adopts the proposal to amend 45 CFR 164.512(b)(1) by adding a new paragraph that permits a covered entity to disclose proof of immunization to a school where State or other law requires the school to have such information prior to admitting the student. While written authorization will no longer be required to permit this disclosure, covered entities will still be required to obtain agreement, which may be oral, from a parent, guardian or other person acting *in loco parentis* for the individual, or from the individual himself or herself, if the individual is an adult or emancipated minor…. “The final rule additionally requires that covered entities document the agreement obtained under this provision… The documentation must only make clear that agreement was obtained as permitted under this provision. For example, if a parent or guardian submits a written or email request to a covered entity to disclose his or her child’s immunization records to the child’s school, a copy of the request would suffice as documentation of the agreement. Likewise, if a parent or guardian calls the covered entity and requests over the phone that his or her child’s immunization records be disclosed to the child’s school, a notation in the child’s medical record of elsewhere of the phone call would suffice as documentation of the agreement.” “\[W\]e still require active agreement from the appropriate individual, and a health care provider may not disclose immunization records to a school under this provision without such agreement…. A mere request by a school to a health care provider for the immunization records of a student would not be sufficient to permit disclosure under this provision.” 78 *Federal Register* 5617 There is another distinction worth noting here, with emphasis added: “\[T\]he Privacy Rule at 45 CFR 164.512(a) permits a covered entity to use or disclose protected health information to the extent that such use or disclosure is *required* by law and the use or disclosure complies with and is limited to the relevant requirements of such law…. \[W\]ith regard to State laws that *permit but do not require* covered entities to disclose immunization records to schools, this does not meet the requirements of the provisions at 164.512(a), and disclosures of immunization records are subject to the Privacy Rule *agreement and documentation requirements*. 78 *Federal Register* 5618 Note, “the Privacy Rule at 45 CFR 164.512(b) permits a covered entity to disclose protected health information for public health activities. Disclosures of protected health information to State immunization registries are therefore permitted by the Privacy Rule and also do not require authorization.” 78 *Federal Register* 5618. This modification facilities removal of identified bottlenecks in getting immunization records to schools and lessens burdens on covered healthcare providers in documenting written or oral agreements by appropriate parties for doing so. It is important to note that such documentation is required to be maintained under the Privacy Rule *Documentation* standard at 45 CFR 164.530(j). Here is the modified paragraph relating to school immunization records at 45 CFR 164.512(b)(1)(vi) (b) *Standard: Uses and disclosures for public health activities.* (1) A covered entity may use or disclose protected health information for the public health activities and purposes described in this paragraph to: (vI) A school, about an individual who is a student or prospective student of the school, if: (A) The protected health information that is disclosed is limited to proof of immunization; (B) The school is required by State or other law to have such proof of immunization prior to admitting the individual; and (C) The covered entity obtains and documents the agreement to the disclosure from either: (1) A parent, guardian, or other person acting *in loco parentis* of the individual, if the individual is an unemancipated minor; or (2) The individual, if the individual is an adult or emancipated minor. On Monday, we look at 45 CFR 160.408: *Factors considered in determining the amount of a civil money penalty*. ### HIPAA Final Rule: Enforcement: Four Penalty Tiers URL: https://hipaa.com/hipaa-final-rule-enforcement-four-penalty-tiers/ Last updated: 2013-02-21T21:34:51.000Z **February 21, 2013**. Today, we examine the four penalty tiers for violations of HIPAA Rules in the Final Rule: [*Modifications to the HIPAA Privacy, Security, Enforcement, and Breach Notification Rules Under the Health Information Technology for Economic and Clinical Health Act \[HITECH Act\] and the Genetic Information Nondiscrimination Act; Other Modifications of the HIPAA Rules*](http://www.gpo.gov/fdsys/pkg/FR-2013-01-25/pdf/2013-01073.pdf?ref=hipaa.com), which was published in the Federal Register on January 25, 2013\. The effective date of the Final Rule is March 26, 2013, and covered entities and business associates must comply by September 23, 2013. We start with two definitions, the first of which, *Reasonable cause*, was modified in the Final Rule, and the second of which, was not modified: *“Reasonable cause* means an act or omission in which a covered entity or business associate knew, or by exercising reasonable diligence would have known, that the act or omission violated an administrative simplification provision, but in which the covered entity or business associate did not act with willful neglect.” 45 CFR 160.401, at 78 *Federal Register* 5691 As modified, this definition "would now include violations due both to circumstances that would make it unreasonable for the covered entity or business associate, despite the exercise of ordinary business care and prudence, to comply with the administrative simplification provision violated, as well as to other circumstances in which a covered entity or business associate has knowledge of a violation but lacks the conscious intent or reckless indifference associated with the willful neglect category of violations." 78 *Federal Register* 5580 “*Reasonable diligence* means the business care and prudence expected from a person seeking to satisfy a legal requirement under similar circumstances.” The Final Rule states: “\[S\]ection 13410(d) of the HITECH Act revised section 1176 of the Social Security Act to establish four tiers of increasing penalty amounts to correspond to the levels of culpability associated with the violation. The first category of violation (and lowest penalty tier) covers situations where the covered entity of business associate did not know, and by exercising reasonable diligence would not have known, of a violation. The second category of violation (and next highest penalty tier) applies to violations due to reasonable cause and not to willful neglect. The third and fourth categories apply to circumstances where the violation was due to willful neglect that is corrected with a certain time period (second highest penalty tier) and willful neglect that is not corrected (highest penalty tier).” 78 *Federal Register* 5580 Willful neglect was discussed in yesterday’s posting. Here are the penalties for each tier from 45 CFR 160.404(b)(2), effective March 26, 2013, with modified paragraphs underlined and the modification in italics: (i) For a violation in which it is established that the covered entity or business associate did not know and, by exercising reasonable diligence, would not have known that the covered entity *or business associate* violated such provision , (A) In the amount of less than $100 or more than $50,000 for each violation; or (B) In excess of $1,500,000 for identical violations during a calendar year (January 1 through the following December 31); (ii) For a violation in which it is established that the violation was due to reasonable cause and not to willful neglect, (A) In the amount of less than $1,000 or more than $50,000 for each violation; or (B) In excess of $1,500,000 for identical violations during a calendar year (January 1 through the following December 31); (iii) For a violation in which it is established that the violation was due to willful neglect and was corrected during the 30-day period beginning on the first date the covered entity *or business associate* liable for the penalty knew, or, would have known that the violation occurred , (A) In the amount of less than $10,000 or more than $50,000 for each violation; or (B) In excess of $1,500,000 for identical violations during a calendar year (January 1 through the following December 31); (iv ) For a violation in which it is established that the violation was due to willful neglect and was not corrected during the 30-day period beginning on the first date the covered entity *or business associate* liable for the penalty knew, or, by exercising reasonable diligence, would have known that the violation occurred , (A) In the amount of less than $50,000 for each violation; or (B) In excess of $1,500,000 for identical violations during a calendar year (January 1 through the following December 31); Tomorrow, we look at the relationship of FERPA and HIPAA vis-a-vis disclosure of immunization records to schools, with a return to enforcement Monday and Tuesday of next week. ### HIPAA Final Rule: Enforcement: Willful Neglect URL: https://hipaa.com/hipaa-final-rule-enforcement-willful-neglect/ Last updated: 2013-02-20T18:45:17.000Z **February 20, 2013**. Today, we begin examination of HITECH Act modifications of HIPAA Enforcement, focusing on the meaning and consequences of *willful neglect* in the Final Rule: [*Modifications to the HIPAA Privacy, Security, Enforcement, and Breach Notification Rules Under the Health Information Technology for Economic and Clinical Health Act \[HITECH Act\] and the Genetic Information Nondiscrimination Act; Other Modifications of the HIPAA Rules*](http://www.gpo.gov/fdsys/pkg/FR-2013-01-25/pdf/2013-01073.pdf?ref=hipaa.com), which was published in the Federal Register on January 25, 2013\. The effective date of the Final Rule is March 26, 2013, and covered entities and business associates must comply by September 23, 2013. *Willful neglect* is defined as “conscious, intentional failure or reckless indifference to the obligation to comply with the administrative simplification provision violated.” 45 CFR 160.401 Section 13410(a) of the HITECH Act \[123 STAT. 271\] added a new subsection (c) to [section 1176 of the Social Security Act](http://www.ssa.gov/OP%5FHome/ssact/title11/1176.htm?ref=hipaa.com): (c) Noncompliance Due to Willful Neglect. (1) In general. A violation of a provision of this part due to willful neglect is a violation for which the Secretary is required to impose a penalty under subsection (a)(1) \[General Penalty. In General.\] (2) Required investigation. For purposes of paragraph (1), the Secretary shall formally investigate any complaint of a violation of a provision of this part if a preliminary investigation of the facts of the complaint indicate such a possible violation due to willful neglect. HHS made four proposed modifications to buttress investigations and imposition of penalties for willful neglect that were adopted in the Final Rule \[78 *Federal Register* 5578\]: Complaint Investigations . “The October 30, 2009, Enforcement Rule at 45 CFR 160.306(c) currently provides the Secretary with discretion to investigate HIPAA complaints through the use of the word ‘may.’ As a practical matter, however, the Department currently conducts a preliminary review of every complaint received and proceeds with the investigation in every eligible case where its preliminary review of the facts indicates a possible violation of the HIPAA Rules. Nonetheless, to implement section 1176(c)(2) \[above\], the Department proposed to add a new paragraph (1) \[above\] … to make clear that the Secretary **will investigate** any complaint filed under this section when a preliminary review of the facts indicates a possible violation due to willful neglect. \[emphasis added\] Under proposed 45 CFR 160.306(c)(2), the Secretary would have continued discretion with respect to investigating any other complaints. Compliance Reviews . “The Department proposed to modify 45 CFR 160.308 by adding a new paragraph (a) to provide that the Secretary will conduct a compliance review to determine whether a covered entity or business associate is complying with the applicable administrative simplification provision when a preliminary review of the facts indicates a possible violation due to willful neglect. Like 45 CFR 160.306(c) with respect to complaints \[discussed above\], the current 160.308(c) provides the Secretary with discretion to conduct compliance reviews. While section 13410(a) of the HITECH Act specifically mentions complaints and not compliance reviews with respect to willful neglect, the Department proposed to treat compliance reviews in the same manner because it believed doing so would strengthen enforcement with respect to potential violations of willful neglect and would ensure that investigations, whether or not initiated by a complaint, would be handled in a consistent manner. Under proposed 45 CFR 160.308(b), the Secretary would continue to have discretion to conduct compliance reviews in circumstances not indicating willful neglect. Resolving Investigations or Compliance Reviews . “Given the HITECH Act’s requirement that the Secretary impose a penalty for any violation due to willful neglect, the Department proposed changes to 45 CFR 160.312, which currently requires the Secretary to attempt to resolve investigations or compliance reviews indicating noncompliance by informal means. The NPRM proposed to provide instead in 45 CFR 160.312(a) that the Secretary ‘‘may’’ rather than ‘‘will’’ attempt to resolve investigations or compliance reviews indicating noncompliance by informal means. This change would permit the Department to proceed with a willful neglect violation determination as appropriate, while also permitting the Department to seek resolution of complaints and compliance reviews that did not indicate willful neglect violations by informal means (e.g., where the covered entity or business associate did not know and by exercising reasonable diligence would not have known of a violation, or where the violation is due to reasonable cause). Compliance Cooperation . “The Department proposed a conforming change to 45 CFR 160.304(a), which currently requires the Secretary to seek, to the extent practicable, the cooperation of covered entities in obtaining compliance with the HIPAA Rules. The [July 14, 2010, Notice of Proposed Rule Making (NPRM)](http://www.hhs.gov/ocr/privacy/hipaa/understanding/coveredentities/nprmhitech.pdf?ref=hipaa.com) proposed to clarify that the Secretary would continue to do so ‘consistent with the provisions of this subpart’ in recognition of the new HITECH Act requirement to impose a civil money penalty for a violation due to willful neglect. While the Secretary often will still seek to correct indications of noncompliance through voluntary corrective action, there may be circumstances (such as circumstances indicating willful neglect), where the Secretary may proceed directly to formal enforcement.” The Final Rule adopted the modifications discussed above, which are in 45 CFR 160.304, 160.306, 160.308, and 160.312, effective March 26, 2013, and accessible online at the link at the top of this post \[78 *Federal Register* 5690-5691\]. Tomorrow, we look at the penalty structure for violations of HIPAA Rules. ### HIPAA Final Rule: Genetic Information Nondiscrimination Act: Manifestation or Manifested URL: https://hipaa.com/hipaa-final-rule-genetic-information-nondiscrimination-act-manifestation-or-manifested/ Last updated: 2013-02-19T21:04:10.000Z **February 19, 2013**. Today, we finish examination of modifications of HIPAA Privacy under the Genetic Information Nondiscrimination Act (GINA), by focusing on the definition: *manifestation or manifested*. The modifications of HIPAA Privacy are in the Final Rule: [*Modifications to the HIPAA Privacy, Security, Enforcement, and Breach Notification Rules Under the Health Information Technology for Economic and Clinical Health Act \[HITECH Act\] and the Genetic Information Nondiscrimination Act; Other Modifications of the HIPAA Rules*](http://www.gpo.gov/fdsys/pkg/FR-2013-01-25/pdf/2013-01073.pdf?ref=hipaa.com), which was published in the Federal Register on January 25, 2013\. The effective date of the Final Rule is March 26, 2013, and covered entities and business associates must comply by September 23, 2013. We presented in the posting of February 15 *manifestation or manifested* as one of the new definitions related to GINA cited in the Final Rule, and repeat it here: ***Manifestation* or *manifested***means, with respect to a disease, disorder, or pathological condition, that an individual has been or could reasonably be diagnosed with the disease, disorder, or pathological condition by a health care professional with appropriate training and expertise in the field of medicine involved. For purposes of this subchapter, a disease, disorder, or pathological condition is not manifested if the diagnosis is based principally on genetic information. \[78 *Federal Register* 5689\] GINA did not define *manifestation or manifested*, but the Department did in the Final Rule “given the importance of the term.” \[78 *Federal Register* 5663\] The Final Rule discusses the concept of *manifestation or manifested*: “Although not separately defined by GINA, the terms *manifestation* or *manifested* are used in GINA in three important contexts: First, GINA uses the term *manifestation* to incorporate ‘family medical history’ into the definition of ‘genetic information’ by stating that ‘genetic information’ includes, with respect to an individual, the manifestation of a disease or disorder in family members of such individual. Second, GINA uses the term ‘manifested’ to exclude from the definition of ‘genetic test’ those tests that analyze a physical malady rather than genetic makeup by excluding from the definition analyses of proteins or metabolites that are directly related to a manifested disease, disorder, or pathological condition. Third, GINA uses the term ‘manifestation’ to clarify that nothing in Title I of GINA should be construed to limit the ability of a health plan to adjust premiums or contribution amounts for a group health plan based on the manifestation of a disease or disorders of an individual enrolled in the plan. \[Final Rule *Footnote*: ‘We note that the Affordable Care Act, enacted on March 23, 2010, includes a provision effective for plan years beginning on or after January 1, 2014, that prohibits insurers from discriminating against individuals or charging individuals higher rates based on pre-existing conditions. See Public Law 111-148’\] However, GINA provides that, in such case, the manifestation of a disease or disorder in one individual cannot also be used as genetic information about other group members and to further increase the premium for the plan. Similarly, for the individual health insurance market, GINA clarifies that it does not prohibit a health plan from establishing rules for eligibility for an individual to enroll in coverage or from adjusting premium or contribution amounts for an individual based on the manifestation of a disease or disorder in that individual or in a family member of such individual where such family member is covered under the individual’s policy. However, under GINA, the manifestation of a disease or disorder in one individual cannot also be used as genetic information about other individuals and to further increase premiums or contribution amounts.” \[78 *Federal Register* 5663\] In contrast to health plans, “\[a\] health care provider may use or disclose genetic information as it sees fit for treatment of an individual. If a covered entity, such as an HMO, acts as both a health plan and health care provider, it may use genetic information for purposes of treatment, to determine the medical appropriateness of a benefit, and as otherwise permitted by the Privacy Rule, but may not use such genetic information for underwriting purposes. Such covered entities, in particular, should ensure that appropriate staff members are trained on the permissible and impermissible uses of genetic information.” \[78 *Federal Register* 5667\] We recommend that any covered entity that creates, receives, or maintains genetic information, as defined at 45 CFR 60.103, 78 *Federal Register* 5688-5689, and effective March 26, 2013, carefully read Section VI of the Preamble in the Final Rule: *Modifications to the HIPAA Privacy Rule* (pages 5658-5669). Tomorrow, we begin to examine Final Rule modifications related to enforcement. ### HIPAA Final Rule: Genetic Information Nondiscrimination Act: Underwriting Prohibitions URL: https://hipaa.com/hipaa-final-rule-genetic-information-nondiscrimination-act-underwriting-prohibitions/ Last updated: 2013-02-19T01:10:07.000Z **February 18, 2013**. Today, we examine underwriting prohibitions as they relate to modifications of the HIPAA Privacy Rule required under the Genetic Information Nondiscrimination Act (GINA). These modifications are in the Final Rule: [*Modifications to the HIPAA Privacy, Security, Enforcement, and Breach Notification Rules Under the Health Information Technology for Economic and Clinical Health Act \[HITECH Act\] and the Genetic Information Nondiscrimination Act; Other Modifications of the HIPAA Rules*](http://www.gpo.gov/fdsys/pkg/FR-2013-01-25/pdf/2013-01073.pdf?ref=hipaa.com), which was published in the Federal Register on January 25, 2013\. The effective date of the Final Rule is March 26, 2013, and covered entities and business associates must comply by September 23, 2013. The Final Rule states: “The final rule adopts the approach of the proposed rule to apply the prohibition on using or disclosing protected health information that is genetic information for underwriting purposes to all health plans that are covered entities under the HIPAA Privacy Rule, including those to which GINA does not expressly apply, except with regard to issuers of long term care policies…. We also continue to believe that individuals have a strong privacy interest in not having their genetic information used in an adverse manner for underwriting purposes and to believe that this privacy interest outweighs any adverse impact on most health plans covered by the Privacy Rule.” \[78 *Federal Register* 5660\] With regard to long-term care plans: “The Department did hear from a number of sources \[during the public comment period\] about the potential adverse impact a prohibition on using genetic information for underwriting would have on the ability of a long-term care insurer to effectively underwrite and thus, on the viability of the long-term care insurance market generally. The Department recognizes the importance of long-term care insurance coverage and the need to ensure its continued availability. The Department also acknowledges that, at this time, it does not have the information necessary to more precisely and carefully measure the extent of such an impact on the long-term market in order to appropriately balance an individual’s privacy interests with such an impact. Thus, this final rule excludes long-term care plans from the underwriting prohibition…. At the current time,…, we do not have sufficient information to determine the proper balance between the individual’s privacy interests and the industry’s concerns about the cost effects of excluding genetic information…. Based on the information the Department may obtain, the Department will reassess how best to move forward in this area in the future.” \[78 *Federal Register* 5661\] While the Final Rule extends coverage of the HIPAA Privacy Rule to health plans beyond those covered under GINA, it is important to note, given the discussion excluding for now long-term care plans from the underwriting restriction pertaining to genetic information, that those long-term care plans still fall under HIPAA Privacy as covered entities. \[78 *Federal Register* 5659\] The Final Rule states: “Long-term care plans, while not subject to the underwriting prohibition, continue to be bound by the Privacy Rule, as are all other covered health plans, to protect genetic information from improper uses and disclosure and to only use or disclose genetic information as required or expressly permitted by the Rule, or as otherwise authorized by the individual who is the subject of the genetic information.” \[78 *Federal Register* 5661\] In the posting on Friday, February 15, we presented the new definitions in the Final Rule pertaining to GINA. With regard to the definition of *underwriting purposes*, which was defined in the proposed rule, the Final Rule adopted the definition, but moved it to “within the underwriting prohibition at 45 CFR 164.502(a)(5)(i).” \[78 *Federal Register* 5665\] The underwriting prohibition paragraphs are presented here with the embedded definition of *underwriting purposes*: (5) *Prohibited uses and disclosures.* (i) *Use and disclosure of genetic information for underwriting purposes:* Notwithstanding any other provision of this subpart, a health plan, excluding an issuer of a long-term care policy falling within paragraph (1)(viii) of the definition of *health plan,* shall not use or disclose protected health information that is genetic information for underwriting purposes. For purposes of paragraph (a)(5)(i) of this section, underwriting purposes means, with respect to a health plan: (A) Except as provided in paragraph (a)(5)(i)(B) of this section: (*1*) Rules for, or determination of, eligibility (including enrollment and continued eligibility) for, or determination of, benefits under the plan, coverage, or policy (including changes in deductibles or other cost- sharing mechanisms in return for activities such as completing a health risk assessment or participating in a wellness program); (*2*) The computation of premium or contribution amounts under the plan, coverage, or policy (including discounts, rebates, payments in kind, or other premium differential mechanisms in return for activities such as completing a health risk assessment or participating in a wellness program); (*3*) The application of any pre-existing condition exclusion under the plan, coverage, or policy; and (*4*) Other activities related to the creation, renewal, or replacement of a contract of health insurance or health benefits. (B) Underwriting purposes does not include determinations of medical appropriateness where an individual seeks a benefit under the plan, coverage, or policy. \[78 *Federal Register* 5696\] Tomorrow, we finish up the discussion on the HIPAA Privacy Rule with regard to genetic information. ### HIPAA Final Rule: Genetic Information Nondiscrimination Act (GINA) Definitions URL: https://hipaa.com/hipaa-final-rule-genetic-information-nondiscrimination-act-gina-definitions/ Last updated: 2013-02-15T23:51:12.000Z **February 15, 2013**. Today, we present several new definitions relating to the Genetic Information Nondiscrimination Act (GINA), which addressed the application of the HIPAA Privacy Rule to genetic information. The definitions are in the Final Rule: [*Modifications to the HIPAA Privacy, Security, Enforcement, and Breach Notification Rules Under the Health Information Technology for Economic and Clinical Health Act \[HITECH Act\] and the Genetic Information Nondiscrimination Act; Other Modifications of the HIPAA Rules*](http://www.gpo.gov/fdsys/pkg/FR-2013-01-25/pdf/2013-01073.pdf?ref=hipaa.com), which was published in the Federal Register on January 25, 2013\. The effective date of the Final Rule is March 26, 2013, and covered entities and business associates must comply by September 23, 2013. The Final Rule states: “The Genetic Information Nondiscrimination Act of 2008, Public Law 110-233, 122 STAT. 881, prohibits discrimination based on an individual’s genetic information in both the health coverage and employment contexts. With respect to health coverage, Title I of GINA generally prohibits discrimination in premiums or contributions for group coverage based on genetic information, proscribes the use of genetic information as a basis for determining eligibility or setting premiums in the individual and Medicare supplemental (Medigap) insurance markets, and limits the ability of group health plans, health insurance issuers, and Medigap issuers to collect genetic information or to request or require that individuals undergo genetic testing. Title II of GINA generally prohibits use of genetic information in the employment context, restricts employers and other entities covered by Title II from requesting, requiring, or purchasing genetic information, and strictly limits such entities from disclosing genetic information… “In addition to these nondiscrimination provisions, section 105 of Title I of GINA contains new privacy protections for genetic information, which require the Secretary of HHS to revise the Privacy Rule to clarify that genetic information is health information and to prohibit group health plans, health insurance issuers (including HMOs), and issuers of Medicare supplemental policies from using or disclosing genetic information for underwriting purposes.” 78 *Federal Register* 5658-5659 Below are new GINA-related definitions for the discussion in this series on the January 25, 2013, Final Rule Modifications as they relate to HIPAA Privacy Rule provisions. 45 CFR 160.103, at 78 *Federal Register* 5688-5689 ***Family member*** means, with respect to an individual: (1) A dependent (as such term is defined in 45 CFR 144.103), of the individual; or (2) Any other person who is a first-degree, second-degree, third-degree, or fourth-degree relative of the individual or of a dependent of the individual. Relatives by affinity (such as by marriage or adoption) are treated the same as relatives by consanguinity (that is, relatives who share a common biological ancestor). In determining the degree of the relationship, relatives by less than full consanguinity (such as half-siblings, who share only one parent) are treated the same as relatives by full consanguinity (such as siblings who share both parents). (i) First-degree relatives include parents, spouses, siblings, and children. (ii) Second-degree relatives include grandparents, grandchildren, aunts, uncles, nephews, and nieces. (iii) Third-degree relatives include great-grandparents, great-grandchildren, great aunts, great uncles, and first cousins. (iv) Fourth-degree relatives include great-great grandparents, great-great grandchildren, and children of first cousins. **Genetic information** means: (1) Subject to paragraphs (2) and (3) of this definition, with respect to an individual, information about: (i) The individual’s genetic tests; (ii) The genetic tests of family members of the individual; (iii) The manifestation of a disease or disorder in family members of such individual; or (iv) Any request for, or receipt of, genetic services, or participation in clinical research which includes genetic services, by the individual or any family member of the individual. (2) Any reference in this subchapter to genetic information concerning an individual or family member of an individual shall include the genetic information of: (i) A fetus carried by the individual or family member who is a pregnant woman; and (ii) Any embryo legally held by an individual or family member utilizing an assisted reproductive technology. (3) Genetic information excludes information about the sex or age of any individual. **Genetic services** means: (1) A genetic test; (2) Genetic counseling (including obtaining, interpreting, or assessing genetic information); or (3) Genetic education. **Genetic test** means an analysis of human DNA, RNA, chromosomes, proteins, or metabolites, if the analysis detects genotypes, mutations, or chromosomal changes. Genetic test does not include an analysis of proteins or metabolites that is directly related to a manifested disease, disorder, or pathological condition. ***Manifestation* or *manifested***means, with respect to a disease, disorder, or pathological condition, that an individual has been or could reasonably be diagnosed with the disease, disorder, or pathological condition by a health care professional with appropriate training and expertise in the field of medicine involved. For purposes of this subchapter, a disease, disorder, or pathological condition is not manifested if the diagnosis is based principally on genetic information. In addition to the new GINA-related definitions above, the definition of *Health information* below was revised “to make clear that the term includes ‘genetic information’. **Health information** means any information, including genetic information , whether oral or recorded in any form or medium, that: (1) Is created or received by a health care provider, health plan, public health authority, employer, life insurer, school or university, or health care clearinghouse; and (2) Relates to the past, present, or future physical or mental health or condition of an individual; the provision of health care to an individual; or the past, present, or future payment for the provision of health care to an individual. Next week, on Monday and Tuesday, we look at how GINA modified the HIPAA Privacy Rule, Wednesday and Thursday, we look at how the Final Rule modified the Enforcement Rule, and Friday look at how FERPA and HIPAA interact with respect to school immunization records. ### HIPAA Final Rule: Modification of Business Associate Definition, Part (6)--Exceptions URL: https://hipaa.com/hipaa-final-rule-modification-of-business-associate-definition-part-6-exceptions/ Last updated: 2013-02-14T15:00:31.000Z **February 14, 2013**. Today, we finish examining the business associate definition, focusing on exceptions, as modified by the Final Rule: [*Modifications to the HIPAA Privacy, Security, Enforcement, and Breach Notification Rules Under the Health Information Technology for Economic and Clinical Health Act \[HITECH Act\] and the Genetic Information Nondiscrimination Act; Other Modifications of the HIPAA Rules*](http://www.gpo.gov/fdsys/pkg/FR-2013-01-25/pdf/2013-01073.pdf?ref=hipaa.com), which was published in the Federal Register on January 25, 2013\. The effective date of the Final Rule is March 26, 2013, and covered entities and business associates must comply by September 23, 2013. Paragraph (4) of the modified definition outlines 4 exceptions (45 CFR 160.103, *Definitions*, as shown at 78 *Federal Register* 5688): (4) *Business associate* does not include: (i) A health care provider, with respect to disclosures by a covered entity to the health care provider concerning the treatment of the individual. (ii) A plan sponsor, with respect to disclosures by a group health plan (or by a health insurance issuer or HMO with respect to a group health plan) to the plan sponsor, to the extent that the requirements of 164.504(f) \[*Standard: Requirements for group health plans*\]of this subchapter apply and are met. (iii) A government agency, with respect to determining eligibility for, or enrollment in, a government health plan that provides public benefits and is administered by another government agency, or collecting protected health information for such purposes, to the extent such activities are authorized by law. (iv) A covered entity participating in an organized health care arrangement that performs a function or activity as described by paragraph (1)(i) of this definition for or on behalf of such organized health care arrangement, or that provides a service as described in paragraph (1)(ii) of this definition to or for such organized health care arrangement by virtue of such activities or services. In general, these exclusions have been a part of the HIPAA Rules, but three have been moved from other parts of the Rules, as described below, to the definition, and wording has been tightened or modified (e.g., in (iii), *protected health information* has been substituted for *individually identifiable health information*).\[78 *Federal Register* 5574\] Exception (iv) was part of the predecessor definition of *business associate* at 45 CFR 160.103(2), with slight changes in wording, but not substance. The Final Rule discusses items (i)-(iii): “Sections 164.308(b)(2) \[*Standard: Business associate contracts and other arrangements* “does not apply”\] and 164.502(e)(1)(ii) \[*Standard: Disclosures to business associates* “does not apply”\] of the HIPAA Rules currently describe certain circumstances, such as when a covered entity discloses protected health information to a health care provider concerning the treatment of an individual \[i\], in which a covered entity is not required to enter into a business associate contract or other arrangement with the recipient of the protected health information. We proposed to \[and did, in the Final Rule\] move these provisions to the definition of ‘business associate’ itself as exceptions to make clear that the Department does not consider the recipients of the protected health information in these circumstances to be business associates. The movement of these exceptions also was intended to help clarify that a person or an entity is a business associate if the person or entity meets the definition of ‘business associate,’ even if a covered entity, or business associate with respect to a subcontractor, fails to enter into the required business associate contract with the person or entity.” \[78 *Federal Register* 5574\] Tomorrow, we begin to examine new definitions in the Final Rule, and next week we look at modifications in the Final Rule regarding enforcement. ### HIPAA Final Rule: Modification of Business Associate Definition, Part (5)--Subcontractors URL: https://hipaa.com/hipaa-final-rule-modification-of-business-associate-definition-part-5-subcontractors/ Last updated: 2013-02-13T19:54:08.000Z **February 13, 2013**. Today, we finish examining (3)—the third paragraph of four—of the business associate definition, as modified by the Final Rule: [*Modifications to the HIPAA Privacy, Security, Enforcement, and Breach Notification Rules Under the Health Information Technology for Economic and Clinical Health Act \[HITECH Act\] and the Genetic Information Nondiscrimination Act; Other Modifications of the HIPAA Rules*](http://www.gpo.gov/fdsys/pkg/FR-2013-01-25/pdf/2013-01073.pdf?ref=hipaa.com), which was published in the Federal Register on January 25, 2013\. The effective date of the Final Rule is March 26, 2013, and covered entities and business associates must comply by September 23, 2013. Here is the last of three parts of this paragraph: "(3) *Business associate* includes: (iii) A subcontractor that creates, receives, maintains, or transmits protected health information on behalf of the business associate.” \[78 *Federal Register* 5688\] *Predecessor Definition:* The HIPAA Security Rule *Organizational Requirements* at 45 CFR 164.314(a)(2)(i)(B), requires the following: "(a) *Standard: Business associate contracts or other arrangements*. (2) *Implementation specifications* (Required). (i) *Business associate contracts*. The contract between a covered entity and a business associate must provide that the business associate will-- (B) Ensure that any agent, including subcontractor, to whom it provides such information agrees to implement reasonable and appropriate safeguards to protect it." \[[www.ecfr.gov](http://www.ecfr.gov/?ref=hipaa.com)\] There is no specificity as to the nature of the agreement or requirements between a business associate and subcontractor with respect to the implementation of “reasonable and appropriate safeguards.” *Modified Definition*: The Final Rule explicitly defines a subcontractor as a business associate, and modified 45 CFR 164.314(a)(2)(iii) provides for the following: (a) *Standard: Business associate contracts or other arrangements*. (2) *Implementation specifications* (Required). “(iii) *Business associate contracts with subcontractors*. The requirements of paragraphs (a)(2)(i) \[*Business associate contracts*\] and (a)(2)(ii) \[*Other arrangements*\] of this section apply to the contract or other arrangement between a business associate and a subcontractor required by 164.308(b)(3) in the same manner as such requirements apply to contracts or other arrangements between a covered entity and business associate.” Under the Final Rule modified definition, we have specificity with respect to the agreement and requirements: implement the Security Rule as a business associate. Under the Final Rule, the definition of subcontractor is added to 45 CFR 160.103: *Definitions*, and is as follows: “A subcontractor is a person to whom a business associate has delegated a function, activity, or service, other than in the capacity of a member of the workforce of such business associate.” \[78 *Federal Register* 5689\] Again, as a reminder, as also defined at 45 CFR 160.103, *person* means “a natural person, trust or estate, partnership, corporation, professional association or corporation, or other entity, public or private.” The Final Rule goes on to clarify further: “A subcontractor is then a business associate where that function, activity, or service involves the creation, receipt, maintenance, or transmission of protected health information.” ... and ”makes clear that a covered entity is not required to enter into a contract or other arrangement with a business associate that is a subcontractor.” \[78 *Federal Register* 5573\] As to “satisfactory assurances” that a subcontractor will appropriately safeguard protected health information, the Final Rule states: “\[C\]overed entities must ensure that they obtain satisfactory assurances required by the Rules from their business associates, and business associates must do the same with regard to subcontractors, and so on, no matter how far ‘down the chain’ the information flows. This ensures that individuals’ health information remains protected by all parties that create, receive, maintain, or transmit the information in order for a covered entity to perform its health care functions. For example, a covered entity may contract with a business associate (contractor), the contractor may delegate to a subcontractor (subcontractor 1) one or more functions, services, or activities the business associate has agreed to perform for the covered entity that require access to protected health information, and the subcontractor may in turn delegate to another subcontractor (subcontractor 2) one or more functions, services, or activities it has agreed to perform for the contractor that require access to protected health information, and so on. Both the contractor and all of the subcontractors are business associates under the final rule to the extent they create, receive, maintain, or transmit protected health information.” \[78 *Federal Register* 5574\] Finally, in light of the discussion earlier this week with respect to transmission services and conduits having an impact on a person who may or may not be deemed a business associate, the Final Rule notes: “\[T\]he same interpretations that apply to determining whether a first tier contractor is a business associate also apply to determining whether a subcontractor is a business associate. Thus, our interpretation of who is and is not excluded from the definition of business associate as a conduit also applies in the context of subcontractors as well.” \[78 *Federal Register* 5574\] Here are several things to remember about subcontractors: - Subcontractors are business associates to the extent they create, receive, maintain, or transmit protected health information. - Subcontractors are not business associates of covered entities, but rather to another business associate. - If a subcontractor discovers a breach, the subcontractor reports it up the line through the hierarchy of subcontractors, if applicable, to the business associate that is the contractor to the covered entity, and it is the business associate contractor that reports the discovered breach to the covered entity. Tomorrow, we conclude the discussion of business associate by looking at four categories of persons in paragraph (4) that are excluded as business associates. ### HIPAA Final Rule: Modification of Business Associate Definition, Part (4)--Personal Health Record Vendor URL: https://hipaa.com/hipaa-final-rule-modification-of-business-associate-definition-part-4-personal-health-record-vendor/ Last updated: 2013-02-12T15:25:51.000Z **February 12, 2013**. Today, we examine the role of the personal health record vendor in paragraph (3)—the third paragraph of four—of the business associate definition, as modified by the Final Rule: [*Modifications to the HIPAA Privacy, Security, Enforcement, and Breach Notification Rules Under the Health Information Technology for Economic and Clinical Health Act \[HITECH Act\] and the Genetic Information Nondiscrimination Act; Other Modifications of the HIPAA Rules*](http://www.gpo.gov/fdsys/pkg/FR-2013-01-25/pdf/2013-01073.pdf?ref=hipaa.com), which was published in the Federal Register on January 25, 2013\. The effective date of the Final Rule is March 26, 2013, and covered entities and business associates must comply by September 23, 2013. Here is the second of three parts of this paragraph, which is the subject of today’s post: (3) *Business associate* includes: “(ii) A person that offers a personal health record to one or more individuals on behalf of a covered entity.” \[78 *Federal Register* 5688\] Again, as a reminder, “business associate means, with respect to a covered entity, a *person*.” \[emphasis added\] As defined at 45 CFR 160.103, *person* means “a natural person, trust or estate, partnership, corporation, professional association or corporation, or other entity, public or private.” The Final Rule modified the definition of business associate to include explicitly a personal health record vendor under certain conditions to enable provisions of the HITECH Act, and discusses the role of the personal health record vendor as follows: “As with data transmission services \[discussed in the February 11, 2013, post\], determining whether a personal health record vendor is a business associate is a fact specific determination. A personal health record vendor is not a business associate of a covered entity solely by virtue of entering into an interoperability relationship with a covered entity. For example, when a personal health record vendor and a covered entity establish the electronic means for a covered entity’s electronic health record to send protected health information to the personal health record vendor pursuant to the individual’s written authorization, it does not mean that the personal health record vendor is offering the personal health record on behalf of the covered entity, even if there is an agreement between the personal health record vendor and the covered entity governing the exchange of data (such as an agreement specifying the technical specifications for exchanging of data or specifying that such data shall be kept confidential). In contrast, when a covered entity hires a vendor to provide and manage a personal health record service the covered entity wishes to offer its patients or enrollees, and provides the vendor with access to protected health information in order to do so, the personal health record vendor is a business associate. “A personal health record vendor may offer personal health records directly to individuals and may also offer personal health records on behalf of covered entities. In such cases, the personal health record vendor is only subject to HIPAA as a business associate with respect to personal health records that are offered to individuals on behalf of covered entities. “\[A\] personal health record vendor that offers a personal health record to a patient on behalf of a covered entity does not act merely as a conduit. Rather, the personal health record vendor is maintaining protected health information on behalf of the covered entity (for the benefit of the individual). Further, a personal health record vendor that operates a personal health record on behalf of a covered entity is a business associate if it has access to protected health information, regardless of whether the personal health record vendor actually exercises this access…. As with other aspects of the definition of ‘business associate,’ we intend to provide future guidance on when a personal health record vendor is a business associate for purposes of the HIPAA Rules.” \[78 *Federal Register* 5572\] Tomorrow, we take up the third of three parts of paragraph (3) of the modified definition of business associate: subcontractors. ### HIPAA Final Rule: Modification of Business Associate Definition, Part (3) URL: https://hipaa.com/hipaa-final-rule-modification-of-business-associate-definition-part-3/ Last updated: 2013-02-12T02:35:12.000Z **February 11, 2013**. Today, we start to examine (3)—the third paragraph of four—of the business associate definition, as modified by the Final Rule: [*Modifications to the HIPAA Privacy, Security, Enforcement, and Breach Notification Rules Under the Health Information Technology for Economic and Clinical Health Act \[HITECH Act\] and the Genetic Information Nondiscrimination Act; Other Modifications of the HIPAA Rules*](http://www.gpo.gov/fdsys/pkg/FR-2013-01-25/pdf/2013-01073.pdf?ref=hipaa.com), which was published in the Federal Register on January 25, 2013\. The effective date of the Final Rule is March 26, 2013, and covered entities and business associates must comply by September 23, 2013. Here is the first of three parts of this paragraph, (i), which is the subject of today’s post: (3) *Business associate* includes: “(i) A Health Information Organization, E-prescribing Gateway, or other person that provides data transmission services with respect to protected health information to a covered entity and that requires access on a routine basis to such protected health information.” \[78 *Federal Register* 5688\] Again, as a reminder, “business associate means, with respect to a covered entity, a *person*.” \[emphasis added\] As defined at 45 CFR 160.103, *person* means “a natural person, trust or estate, partnership, corporation, professional association or corporation, or other entity, public or private.” The Final Rule modified the definition of business associate to include explicitly each of the organizations listed above to conform with provisions of the HITECH Act. *Health Information Organization*. According to the Final Rule: “We decline to provide a definition for Health Information Organization. We recognize that the industry continues to develop and thus the type of entities that may be considered Health Information Organizations continues to evolve. For this reason, we do not think it prudent to include in the regulation a specific definition at this time. We anticipate continuing to issue guidance in the future on our Web site on the types of entities that do and do not fall within the definition of business associate, which can be updated as the industry evolves.” \[78 *Federal Registe*r 5571\] *Access on a routine basis*. The Final Rule distinguishes between a business associate that requires *access on a routine basis* versus a *conduit* function or activity. The Final Rule states: “a determination will be fact specific based on the nature of the services provided and the extent to which the entity needs access to protected health information to perform the service for the covered entity. The conduit exception is a narrow one … a conduit transports information but does not access it other than on a random or infrequent basis as necessary to perform the transportation service or as required by law…. Such occasional, random access to protected health information would not qualify \[a\] company as a business associate….We intend to issue further guidance in this area as electronic health information exchange continues to evolve.” \[78 *Federal Register* 5571-5572\] The Final Rule discusses another critical difference: “We note that the conduit exception is limited to transmission services (whether digital or hard copy), including any temporary storage of transmitted data incident to such transmission. In contract, an entity that maintains protected health information on behalf of a covered entity is a business associate and not a conduit, even if the entity does not actually view the protected health information. We recognize that in both situations, the entity providing the service to the covered entity has the opportunity to access the protected health information. However, the difference between the two situations is the transient versus persistent nature of that opportunity. For example, a data storage company that has access to protected health information (whether digital or hard copy) qualifies as a business associate, even if the entity does not view the information or only does so on a random or infrequent basis…. To help clarify this point, we have modified the definition of ‘business associate’ to generally provide that a business associates includes a person who ‘creates, receives, *maintains*, or transmits’ (emphasis added) protected health information on behalf of a covered entity.” \[78 *Federal Register* 5572\] Tomorrow, we discuss personal health record vendors as business associates. ### HIPAA Final Rule: Modification of Business Associate Definition, Parts (1) & (2) URL: https://hipaa.com/hipaa-final-rule-modification-of-business-associate-definition-parts-1-2/ Last updated: 2013-02-09T02:48:18.000Z February 8, 2013\. Today, we examine (1) and (2)—the first two parts of four—of the business associate definition, as modified by the Final Rule: [*Modifications to the HIPAA Privacy, Security, Enforcement, and Breach Notification Rules Under the Health Information Technology for Economic and Clinical Health Act \[HITECH Act\] and the Genetic Information Nondiscrimination Act; Other Modifications of the HIPAA Rules*](http://www.gpo.gov/fdsys/pkg/FR-2013-01-25/pdf/2013-01073.pdf?ref=hipaa.com), which was published in the Federal Register on January 25, 2013\. The effective date of the Final Rule is March 26, 2013, and covered entities and business associates must comply by September 23, 2013. As with its predecessor, the modified definition of business associate refers to “business associate means, with respect to a covered entity, a *person*.” \[emphasis added\] That’s legal lingo. As defined at 45 CFR 160.103, *person* means “a natural person, trust or estate, partnership, corporation, professional association or corporation, or other entity, public or private.” Here is the modified version of the first two parts of business associate definition, with modifications underlined, followed by the complete predecessor version of the business associate definition. ***Modified Definition of Business Associate*** (1) Except as provided in paragraph (4) \[Exceptions to Business Associate\] of this definition, business associate means, with respect to a covered entity, a person who: (i) On behalf of such covered entity or of an organized health care arrangement (as defined in this section) in which the covered entity participates, but other than in the capacity of a member of the workforce of such covered entity or arrangement, creates, receives, maintains, or transmits protected health information for a function or activity regulated by this subchapter, including claims processing or administration, data analysis, processing or administration, utilization review, quality assurance, patient safety activities listed at 42 CFR 3.20 , billing, benefit management, practice management, and repricing; or (ii) Provides, other than in the capacity of a member of the workforce of such covered entity, legal, actuarial, accounting, consulting, data aggregation (as defined in § 164.501 of this subchapter), management, administrative, accreditation, or financial services to or for such covered entity, or to or for an organized health care arrangement in which the covered entity participates, where the provision of the service involves the disclosure of protected health information from such covered entity or arrangement, or from another business associate of such covered entity or arrangement, to the person. (2) A covered entity may be a business associate of another covered entity. ***Predecessor Definition of Business Associate*** (1) Except as provided in paragraph (2) of this definition, *business associate* means, with respect to a covered entity, a person who: (i) On behalf of such covered entity or of an organized health care arrangement (as defined in § 164.501 of this subchapter) in which the covered entity participates, but other than in the capacity of a member of the workforce of such covered entity or arrangement, performs, or assists in the performance of: (A) A function or activity involving the use or disclosure of individually identifiable health information, including claims processing or administration, data analysis, processing or administration, utilization review, quality assurance, billing, benefit management, practice management, and repricing; or (B) Any other function or activity regulated by this subchapter; or (ii) Provides, other than in the capacity of a member of the workforce of such covered entity, legal, actuarial, accounting, consulting, data aggregation (as defined in § 164.501 of this subchapter), management, administrative, accreditation, or financial services to or for such covered entity, or to or for an organized health care arrangement in which the covered entity participates, where the provision of the service involves the disclosure of individually identifiable health information from such covered entity or arrangement, or from another business associate of such covered entity or arrangement, to the person. (2) A covered entity participating in an organized health care arrangement that performs a function or activity as described by paragraph (1)(i) of this definition for or on behalf of such organized health care arrangement, or that provides a service as described in paragraph (1)(ii) of this definition to or for such organized health care arrangement, does not, simply through the performance of such function or activity or the provision of such service, become a business associate of other covered entities participating in such organized health care arrangement. (3) A covered entity may be a business associate of another covered entity. Here are three key modifications in (1) of the modified definition, aside from some wording rearrangement. 1. “Individually identifiable health information” in the predecessor version is modified to “protected health information” in the modified version. The reason for the modification: “a business associate has no obligation under the HIPAA Rules with respect to individually identified health information that is not protected health information.” \[78 *Federal Register* 5574\] 2\. "Performs, or assists in the performance of” in the predecessor version is modified to “creates, receives, maintains, or transmits protected health information” in the modified version. The reason for the modification: “to clarify that a business associate includes an entity that ‘creates, receives, maintains, or transmits’ protected health information on behalf of a covered entity. This change is to make the definition more consistent with language at 164.308(b) \[Security Rule *Business associate contracts and other arrangements* standard\] and 164.502(e) \[Privacy Rule *Disclosures to business associates* standard\], as well as to clarify that entities that maintain or store protected health information on behalf of a covered entity are business associates, even if they do not actually view the protected health information. \[78 *Federal Register* 5574\] 3\. The modified version includes a new activity, *patient safety activities* performed by an organization as a business associate: *Patient Safety Organization (PSO)*. The Patient Safety and Quality Improvement Act of 2005 (PSQIA) “provides that PSOs must be treated as business associates when applying the Privacy Rule. PSQIA provides for the establishment of PSOs to receive reports of patient safety events or concerns from providers and provide analyses of events to reporting providers. A reporting provider may be a HIPAA covered entity and, thus, information reported to a PSO may include protected health information that the PSO may analyze on behalf of the covered provider. The analysis of such information is a patient safety activity for purpose of PSQIA and the Patient Safety Rule, 42 CFR 3.10, et seq. While the HIPAA Rules as written would treat a PSO as a business associate when the PSO was performing quality analyses and other activities on behalf of a covered health care provider, … this change to the definition of ‘business associate’ \[is\] to more clearly align the HIPAA and Patient Safety Rules.” \[78 *Federal Register* 5570\] Finally, note that (2) in the modified version of the business associate definition is identical to (3) in the predecessor definition. An example is a healthcare clearinghouse in a business associate role with a healthcare provider. Monday, we begin examination of the new provisions of the modified business associate definition in part (3) of 4 parts. ### HIPAA Final Rule: Business Associate Definition URL: https://hipaa.com/hipaa-final-rule-business-associate-definition/ Last updated: 2013-02-08T02:48:05.000Z **February 7, 2013**. Today, we provide the business associate definition, as modified by the Final Rule: [*Modifications to the HIPAA Privacy, Security, Enforcement, and Breach Notification Rules Under the Health Information Technology for Economic and Clinical Health Act \[HITECH Act\] and the Genetic Information Nondiscrimination Act; Other Modifications of the HIPAA Rules*](http://www.gpo.gov/fdsys/pkg/FR-2013-01-25/pdf/2013-01073.pdf?ref=hipaa.com), which was published in the Federal Register on January 25, 2013\. The effective date of the Final Rule is March 26, 2013, and covered entities and business associates must comply by September 23, 2013. Business Associate : Definition (78 *Federal Register 5688)--* “(1) Except as provided in paragraph (4) of this definition, business associate means, with respect to a covered entity, a person who: (i) On behalf of such covered entity or of an organized health care arrangement (as defined in this section) in which the covered entity participates, but other than in the capacity of a member of the workforce of such covered entity or arrangement, creates, receives, maintains, or transmits protected health information for a function or activity regulated by this subchapter, including claims processing or administration, data analysis, processing or administration, utilization review, quality assurance, patient safety activities listed at 42 CFR 3.20, billing, benefit management, practice management, and repricing; or (ii) Provides, other than in the capacity of a member of the workforce of such covered entity, legal, actuarial, accounting, consulting, data aggregation (as defined in § 164.501 of this subchapter), management, administrative, accreditation, or financial services to or for such covered entity, or to or for an organized health care arrangement in which the covered entity participates, where the provision of the service involves the disclosure of protected health information from such covered entity or arrangement, or from another business associate of such covered entity or arrangement, to the person. (2) A covered entity may be a business associate of another covered entity. (3) *Business associate* includes: (i) A Health Information Organization, E-prescribing Gateway, or other person that provides data transmission services with respect to protected health information to a covered entity and that requires access on a routine basis to such protected health information. (ii) A person that offers a personal health record to one or more individuals on behalf of a covered entity. (iii) A subcontractor that creates, receives, maintains, or transmits protected health information on behalf of the business associate. (4) *Business associate* does not include: (i) A health care provider, with respect to disclosures by a covered entity to the health care provider concerning the treatment of the individual. (ii) A plan sponsor, with respect to disclosures by a group health plan (or by a health insurance issuer or HMO with respect to a group health plan) to the plan sponsor, to the extent that the requirements of § 164.504(f) of this subchapter apply and are met. (iii) A government agency, with respect to determining eligibility for, or enrollment in, a government health plan that provides public benefits and is administered by another government agency, or collecting protected health information for such purposes, to the extent such activities are authorized by law. (iv) A covered entity participating in an organized health care arrangement that performs a function or activity as described by paragraph (1)(i) of this definition for or on behalf of such organized health care arrangement, or that provides a service as described in paragraph (1)(ii) of this definition to or for such organized health care arrangement by virtue of such activities or services.” HIPAA.com will discuss each of the 4 categories over the next five days, beginning tomorrow with (1) and (2). The discussion will be based on the presentation at 78 *Federal Register* 5570-5575\. Monday through Wednesday next week will focus on each of the three new categories in (3), and Thursday will conclude the discussion with (4), the business associate exclusions. ### HIPAA Final Rule: Modified Rule for Business Associates and Subcontractors URL: https://hipaa.com/hipaa-final-rule-modified-rule-for-business-associates-and-subcontractors/ Last updated: 2013-02-07T01:03:15.000Z **February 6, 2013**. Today, we cover the business associate Administrative Safeguard (b) of the Security Rule, as modified by the Final Rule: [Modifications to the HIPAA Privacy, Security, Enforcement, and Breach Notification Rules Under the Health Information Technology for Economic and Clinical Health Act \[HITECH Act\] and the Genetic Information Nondiscrimination Act; Other Modifications of the HIPAA Rules](http://www.gpo.gov/fdsys/pkg/FR-2013-01-25/pdf/2013-01073.pdf?ref=hipaa.com), which was published in the Federal Register on January 25, 2013\. The effective date of the Final Rule is March 26, 2013, and covered entities and business associates must comply by September 23, 2013. HIPAA did not directly regulate business associates of covered entities. The HITECH Act's 13401 statutorily changed that: The Security Rule’s administrative, physical, and technical safeguard requirements, and policies and procedures and documentation requirements were made applicable to business associates “in the same manner” as they applied to covered entities, and business associates became civilly and criminally liable for violations of these provisions.” \[78 *Federal Register* 5589\] The Final Rule published on January 25, 2013, modified and extended federal regulatory enforcement, with “direct liability for compliance with the Security Rule to business associates” instead of just having covered entities relying on "satisfactory assurances" in a business associate agreement, where a covered entity's recourse, in the absence of an indemnification provision, was terminating the agreement. The Final Rule notes that “the Security Rule currently requires a covered entity to establish a business associate agreement that requires business associates to implement administrative, physical, and technical safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of the electronic protected health information that they create, receive, maintain, or transmit on behalf of the covered entity as required by the Security Rule; and to ensure that any agent, including subcontractor, to whom they provide such information agrees to implement reasonable and appropriate safeguards to protect it.” \[78 *Federal Register* 5589\] The Final Rule defines *subcontractor* as “a person to whom a business associate delegates a function, activity, or service, other than in the capacity of a member of the workforce of such business associate.” \[78 *Federal Register* 5689\]. In the Final Rule, “a covered entity is not required to enter into a business associate agreement with a subcontractor; rather, this is the obligation of the business associate that has engaged subcontractor to perform a function or service that involves the use or disclosure of protected health information.” \[78 *Federal Register* 5590\] “To ensure appropriate and strong security protections for electronic protected health information, subcontractors are required to comply with the Security Rule to the same extent as business associates with a direct relationship with a covered entity.” With respect to notification of a discovered breach, a subcontractor would notify the business associate, who would in turn notify the covered entity for carrying out further notifications, as applicable. The Final Rule provides new language pertaining to the relationship between the covered entity and business associate, and between the business associate and a subcontractor under the modified Security Rule Administrative Safeguards: (b)(1) **Business associate contracts and other arrangements*.* A covered entity may permit a business associate to create, receive, maintain, or transmit electronic protected health information on the covered entity’s behalf only if the covered entity obtains satisfactory assurances, in accordance with § 164.314(a), that the business associate will appropriately safeguard the information. A covered entity is not required to obtain such satisfactory assurances from a business associate that is a subcontractor. (2) A business associate may permit a business associate that is a subcontractor to create, receive, maintain, or transmit electronic protected health information on its behalf only if the business associate obtains satisfactory assurances, in accordance with § 164.314(a), that the subcontractor will appropriately safeguard the information. (3) *Implementation specifications: Written contract or other arrangement (Required).* Document the satisfactory assurances required by paragraph (b)(1) or (b)(2) of this section through a written contract or other arrangement with the business associate that meets the applicable requirements of § 164.314(a). On January 25, 2013, the Office for Civil Rights (OCR) of the Department of Health and Human Services (HHS) launched a [Business Associate Contract Web site](http://www.hhs.gov/ocr/privacy/hipaa/understanding/coveredentities/contractprov.html?ref=hipaa.com) with *Sample Business Associate Agreement Provisions* that provides guidance to covered entities on preparing an appropriate business associate agreement with required provisions. Tomorrow, we present the Final Rule modified definition of Business Associate. ### HIPAA Final Rule: Security Standards, General Rules & Administrative Safeguard Modifications URL: https://hipaa.com/hipaa-final-rule-security-standards-general-rules-administrative-safeguard-modifications/ Last updated: 2026-10-25T21:06:38.000Z February 5, 2013\. Today, we cover the modifications to *Security Standards: General Rules*, and *Administrative Safeguards* in the HIPAA Security Rule, as modified by the Final Rule: [*Modifications to the HIPAA Privacy, Security, Enforcement, and Breach Notification Rules under the Health Information Technology for Economic and Clinical Health Act \[HITECH Act\] and the Genetic Information Nondiscrimination Act; Other Modifications of the HIPAA Rules*](http://www.gpo.gov/fdsys/pkg/FR-2013-01-25/pdf/2013-01073.pdf?ref=hipaa.com), which was published in the *Federal Register* on January 25, 2013\. The effective date of the Final Rule is March 26, 2013, and covered entities and business associates must comply by September 23, 2013. *Security Standards: General Rules*. The five General Rules govern how the administrative, physical, and technical safeguards are implemented by covered entities, and, as modified, by business associates. They are, where Final Rule modified wording is underlined: (a) **General Requirements**: Covered entities and business associates must do the following: (1) Ensure the confidentiality, integrity, and availability of all electronic protected health information the covered entity or business associate creates, receives, maintains, or transmits. (2) Protect against any reasonably anticipated threats or hazards to the security or integrity of such information. (3) Protect against any reasonably anticipated uses or disclosures of such information that are not permitted or required under the HIPAA Privacy Rule \[as modified\]. (4) Ensure compliance with the HIPAA Security Rule by its workforce. (b) **Flexibility of Approach**: (1) Covered entities and business associates may use any security measures that allow the covered entity or business associate to reasonably and appropriately implement the standards and implementations specifications as specified in the HIPAA Security Rule. (2) In deciding which security measures to use, a covered entity or business associate must take into account the following factors: (i) The size, complexity, and capabilities of the covered entity or business associate . (ii) The covered entity's or the business associate's technical infrastructure, hardware, and software security capabilities. (iii) The costs of security measures. (iv) The probability and criticality of potential risks to electronic protected health information. (c) **Standards**. A covered entity or business associate must comply with the applicable standards as provided in this section and in 164.308 (Administrative safeguards), 164.310 (Physical safeguards), 164.312 (Technical safeguards), 164.314 (Organizational requirements), and 164.316 (Policies and procedures and documentation requirements) with respect to all electronic protected health information. (d) **Implementation Specifications**. In the HIPAA Security Rule-- (1) Implementation specifications are required or addressable. If an implementation specification is required, the word *Required* appears in parentheses after the the title of the implementation specification. If an implementation specification is addressable, the word *Addressable* appears in parentheses after the title of the implementation specification. (2) When a standard adopted in 164.308, 164.310, 164.312, 164.314, or 164.316, includes required implementation specifications, a covered entity or business associate must implement the implementation specifications. (3) When a standard adopted in 164.308, 164.310, 164.312, 164.314, or 164.316, includes addressable implementation specifications, a covered entity or business associate must-- (i) Assess whether each implementation specification is a reasonable and appropriate safeguard in its environment, when analyzed with reference to the likely contribution to protecting electronic protected health information; and (ii) As applicable to the covered entity or business associate \-- (A) Implement the implementation specification if reasonable and appropriate; or (B) If implementing the implementation specification is not reasonable and appropriate-- (*1*) Document why it would not be reasonable and appropriate to implement the implementation specification; and (*2*) Implement an equivalent alternative measure if reasonable and appropriate. (e) **Maintenance**. A covered entity or business associate must review and modify the security measures implemented under the HIPAA Security Rule as needed to continue provision of reasonable and appropriate protection of electronic protected health information, and update as needed documentation of such security measures in response to environmental or operational changes affecting the security of the ePHI \[i.e., in accordance with 45 CFR 164.316(b)(2)(iii) of the required *Updates* implementation specification of the *Documentation* standard\]. As shown by the underlinings, the *General Rule* modifications require compliance by business associates by September 23, 2013\. Compliance for covered entities began on April 20, 2005, except for small health plans, which had an extra year to comply. Except for a rewording of (e) Maintenance, the substance of the *General Rules* was not modified except for applicability to business associates. *Administrative Safeguard Modifications (a).* There are eight standards in (a). As discussed in yesterday's post, the introductory text was modified to include business associates: "A covered entity or business associate must, in accordance with 164.306 \[*Security Standards: General Rules*, as modified\]." We show only the modifications below for each of the eight standards, with modifications underlined. (1)(i) Standard: Security Management Process (ii) Implementation specifications (A) *Risk analysis (Required)*. Conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of electronic protected health information held by the covered entity or business associate . (C) *Sanction policy (Required)*. Apply appropriate sanctions against workforce members who fail to comply with the security policies and procedures of the covered entity or business associate . (2) Standard: Assigned Security Responsibility. Identify the security official who is responsible for the development and implementation of the policies and procedures required by the HIPAA Security Rule for the covered entity or business associate . (3)(i) Standard: Workforce Security (ii) Implementation specifications (C) *Termination procedures (Addressable)*. Implement procedures for terminating access to electronic protected health information when the employment of , or other arrangement with, a workforce member ends or as required by determinations made as specified in the preceding addressable implementation specification, *Workforce clearance procedure* \[paragraph (a)(3)(ii)(B)\]. (4)(i) Standard: Information access management (ii) Implementation specifications (C) *Access establishment and modification (Addressable)*. Implement polices and procedures that, based upon the covered entity's or the business associate's access authorization policies, establish, document, review, and modify a user's right of access to a workstation, transaction, program, or process. (5) Standard: Security Awareness and Training--No modification (6)(i) Standard: Security Incident Procedures (ii) Implementation specification--*Response and reporting (Required)*. Identify and respond to suspected or know security incidents; mitigate, to the extent practicable, harmful effects of security incidents that are known to the covered entity or business associate ; and document security incidents and their outcomes. (7) Standard: Contingency plan--No modification (8) Standard: Evaluation. Perform a periodic technical and nontechnical evaluation, based initially upon the standards implemented under this rule and, subsequently, in response to environmental or operational changes affecting the security of electronic protected health information, that establishes the extent to which a covered entity's or business associate's security policies and procedures meet the requirements of the HIIPAA Security Rule. With one exception, the modifications in Administrative Safeguards (a) are to extend applicability to business associates, and in a few instances, as underlined, to clarify that an entity meant covered entity. The exception relates to "or other arrangement with" in the *Termination procedures* implementation specification of the Workforce Security Standard (a)(3)(i). The Final Rule states: "The final rule adopts the proposed modifications to 164.308\. We proposed a technical change to (a)(3)(ii)(C) regarding security termination procedures for workforce members...in recognition of the fact that not all workforce members are employees (e.g., some may be volunteers) of a covered entity or business associate." \[78 *Federal Register* 5590\] Tomorrow, we examine modifications relating to Administrative Safeguards (b): *Business associate contracts and other arrangements*. ### Final HIPAA Rule: Security Statutory Authority and Direct Regulation of Business Associates URL: https://hipaa.com/final-hipaa-rule-security-statutory-authority-and-direct-regulation-of-business-associates/ Last updated: 2026-10-25T21:07:38.000Z **February 4, 2013**. Today, we cover the security safeguards of the HIPAA Security Rule, as Modified by the Final Rule: [*Modifications to the HIPAA Privacy, Security, Enforcement, and Breach Notification Rules under the Health Information Technology for Economic and Clinical Health Act \[HITECH Act\] and the Genetic Information Nondiscrimination Act; Other Modifications of the HIPAA Rules*](http://www.gpo.gov/fdsys/pkg/FR-2013-01-25/pdf/2013-01073.pdf?ref=hipaa.com), which was published in the *Federal Register* on January 25, 2013\. The effective date of the Final Rule is March 26, 2013, and covered entities and business associates must comply by September 23, 2013. The statutory authority for applicability of the HIPAA Security Rule is in Section 13401 of the HITECH Act (123 STAT. 262): *Application of Security Provisions and Penalties to Business Associates of Covered Entities* (a) Application of Security Provisions.--Sections 164.308 (Administrative Safeguards), 164.310 (Physical Safeguards), 164.312 (Technical Safeguards), and 164.316 (Policies and Procedures and Documentation Requirements) of title 45, Code of Federal Regulations, shall apply to a business associate of a covered entity in the same manner that such sections apply to the covered entity. The additional requirements of this title that relate to security and that are made applicable with respect to covered entities shall also be applicable to such a business associate and shall be incorporated into the business associate agreement between the business associate and the covered entity. (b) Application of Civil and Criminal Penalties.--In the case of a business associate that violates any security provision specified in subsection (a), sections 1176 and 1177 of the Social Security Act (42 USC 1320d-5, 1320d-6) shall apply to the business associate with respect to such violation in the same manner such sections apply to a covered entity that violates such security provision. We focus on (a) in this post, and will discuss (b) later in this series of posts when we discuss Enforcement. In general, the modifications to the HIPAA Security Rule by the Final Rule HITECH Act modifications were as stated in the statutory language above: business associates are directly regulated by the federal government in a manner similar to that of covered entities. Previously, the business associate provided "satisfactory assurances" in the business associate contract, so enforcement was contractual via the covered entity rather than through direct federal regulation. Today, we look at modifications to the definitions of administrative, physical, and technical safeguards. Tomorrow, we look at the change in language in the administrative safeguards (a)(1)-(8), and Wednesday the change in language for administrative safeguard (b): *Business associate contracts and other arrangements*. First, the introductory texts of 164.308, 164.310, and 164.310, as noted above in (a) with respect to application, were changed to include "business associate," so each reads the same: "A covered entity or business associate, in accordance with 45 CFR 164.306:" where 164.306 is *Security Standards: General Rules*. We will cover modifications to 164.306 tomorrow. Next, the language of the standards and implementation specifications for the Physical Safeguards (164.310) and Technical Safeguards (164.312) were not modified in the Final Rule, but the modification of the introductory text requires business associates to comply and document compliance with them, as well as with the Administrative Safeguards (164.308), where in some standards, "business associate" is included in the regulatory language, as we will show tomorrow. Finally, the definitions of Administrative Safeguards and Physical Safeguards are modified to include "business associate," whereas the Technical Safeguard definition is not modified. *Definitions* (modifications are underlined ) *Administrative safeguards* are administrative actions, and policies and procedures, to manage the selection, development, implementation, and maintenance of security measures to protect electronic protected health information and to manage the conduct of the covered entity's or business associate's workforce in relation to the protection of that information. *Physical safeguards* are physical measures, policies, and procedures to protect a covered entity's or business associate's electronic information systems and related buildings and equipment, from natural and environmental hazards, and unauthorized intrusion. *Technical safeguards* means the technology and the policy and procedures for its use that protect electronic protected health information and control access to it. Tomorrow, *Security Standards: General Rules* and *Administrative Safeguards* (a). ### HIPAA Final Rule: Business Associate Notification Timing, Policy and Procedure Updates, Retraining, and Documentation URL: https://hipaa.com/hipaa-final-rule-business-associate-notification-timing-policy-and-procedure-updates-retraining-and-documentation/ Last updated: 2013-02-01T20:43:44.000Z **February 1, 2013**. Today, we wrap up discussion of breach notification in the Final Rule: [*Modifications to the HIPAA Privacy, Security, Enforcement, and Breach Notification Rules Under the Health Information Technology for Economic and Clinical Health Act \[HITECH Act\] and the Genetic Information Nondiscrimination Act; Other Modifications to the HIPAA Rules*](http://www.gpo.gov/fdsys/pkg/FR-2013-01-25/pdf/2013-01073.pdf?ref=hipaa.com). The Final Rule is effective on March 26, 2013, and requires compliance by covered entities and business associates on September 23, 2013\. The focus is on timing of reporting a breach by a business associate to a covered entity, and, because the definition of breach was modified in the Final Rule, on the requirements to update policies and procedures, retrain the workforce on those updated policies and procedures, and document all breach characteristics and notifications. *Notification by a Business Associate*. There was only a "technical and non-substantive correction" in 45 CFR 164.410: *Notification by a Business Associate*. \[78 *Federal Register* 5656\]. Here is the *Standard \[164.410(a)\]* from the Final Rule: "(1) *General Rule*. A business associate shall, following discovery of a breach of unsecured protected health information, notify the covered entity of such breach. "(2) *Breaches treated as discovered*. For purposes of paragraph (a)(1) of this section, a breach shall be treated as discovered by a business associate as of the first day on which such breach is known to the business associate or, by exercising reasonable diligence, would have been known to the business associate. A business associate shall be deemed to have knowledge of a breach if the breach is known, or by exercising reasonable diligence would have been known, to any person, other than the person committing the breach, who is an employee, officer, or other agent of the business associate (determined in accordance with the Federal common law of agency)." \[78 *Federal Register* 5695\] Here is an important point from the Final Rule regarding timing and discovery: "Section 164.410(b) requires that a business associate provide notice of a breach of unsecured protected health information to a covered entity without unreasonable delay and in no case later than 60 days following the discovery of a breach. With respect to timing, if a business associate is acting as an agent of a covered entity, then, pursuant to 164.404(a)(2) \[*Notification to individuals: breaches treated as discovered*\], the business associate's discovery of the breach will be imputed to the covered entity. In such circumstances, the covered entity must provide notifications under 164.404(a) \[to individuals\] based on the time the business associate discovers the breach, not from the time the business associate notifies the covered entity. In contrast, if the business associate is not an agent of the covered entity, then the covered entity is required to provide notification based on the time the business associate notifies the covered entity of the breach. We encouraged \[in the 2009 discussion of the interim final rule\] covered entities and business associates to address the timing of this notification in their business associate contracts." \[78 *Federal Register* 5655\] "Because of the agency implications on the timing of breach notifications, we encourage covered entities to discuss and define in their business associate agreements the requirements regarding how, when, and to whom a business associate should notify the covered entity of a potential breach." \[78 *Federal Register* 5656\] Consult with your organization attorney on defining any agency role and timing in the business associate agreement, and, for guidance on the business associate agreement, also visit the Office for Civil Rights (OCR) Web site: [*Business Associate Contract--Sample Business Associate Agreement Provisions*](http://www.hhs.gov/ocr/privacy/hipaa/understanding/coveredentities/contractprov.html?ref=hipaa.com), published January 25, 2013. *Administrative Requirements and Burden of Proof*. 45 CFR 164.414 was not modified in the Final Rule. Nevertheless, the preamble makes two important points: With respect to administrative requirements, "\[w\]e emphasize the importance of ensuring that all workforce members are appropriately trained and knowledgable about what constitutes a breach and on the policies and procedures for reporting, analyzing, and documenting a possible breach of unsecured protected health information. We note that because this final rule modifies the definition of breach as stated in the interim final rule, covered entities will need to update their policies and procedures and retrain workforce members as necessary to reflect such modifications." \[78 *Federal Register* 5657-5658\] This applies to business associates as well. Remember, your organization will have 180 days between the effective date of the Final Rule, March 26, 2013, and the compliance date of the Final Rule, September 23, 2013, to update policies and procedures and retain your workforce members on all of the modifications in the Final Rule. For assistance on training, visit [HIPAA School](http://www.hipaaschool.com/?ref=hipaa.com); if you are a member of the American Medical Association, visit [AMA HIPAA School](http://ama.hipaaschool.com/?ref=hipaa.com). With respect to burden of proof, "section 13402 of the \[HITECH Act\] places the burden of proof on a covered entity or business associate, if applicable, to demonstrate that all notifications were made as required. Therefore, section 45 CFR 164.530(j)(1)(iv) \[of the HIPAA Privacy Rule\] requires covered entities to maintain documentation to meet this burden of proof. This includes documentation that all required notifications have been provided or that no breach occurred and notification was not necessary. If a covered entity's determination with respect to whether a breach occurred is called into question, the covered entity should produce the documentation that demonstrates the reasonableness of its conclusions based on the findings of its risk assessment." \[78 *Federal Register* 5658\] Remember, the burden is on the covered entity--not the business associate--to report the particulars of the breach and notifications to the HHS Secretary on the OCR Web site: [*Instructions for Submitting Notice of a Breach to the Secretary*](http://www.hhs.gov/ocr/privacy/hipaa/administrative/breachnotificationrule/brinstruction.html?ref=hipaa.com). *Next week, we take up modifications to the Security Rule.* ### HIPAA Final Rule: More on Breach Notification Rule Changes URL: https://hipaa.com/hipaa-final-rule-more-on-breach-notification-rule-changes/ Last updated: 2026-10-25T20:40:29.000Z **January 31, 2013**. Today, we briefly identify key changes or reminders regarding breach notification in the preamble of the Final Rule: [*Modifications to the HIPAA Privacy, Security, Enforcement, and Breach Notification Rules Under the Health Information Technology for Economic and Clinical Health Act \[HITECH Act\] and the Genetic Information Nondiscrimination Act; Other Modifications to the HIPAA Rules*](http://www.gpo.gov/fdsys/pkg/FR-2013-01-25/pdf/2013-01073.pdf?ref=hipaa.com), published in the *Federal Register* on January 25, 2013\. The Final Rule becomes effective March 26, 2013 and requires compliance by covered entities and business associates on September 23, 2013\. Earlier this week, we have examined the changed definition of *breach*, the substitution of the "probability standard" for the current "harm standard" underpinning a risk assessment to determine if unsecured protected health information has been compromised by impermissible use or disclosure such that a breach notification is required, and the importance of the *Guidance* in securing protected health information. *Limited Data Sets*. "In addition to the removal of the harm standard and the creation of more objective factors to evaluate the probability that protected health information has been compromised, we have removed the exception for limited data sets that do not contain any dates of birth and zip codes. In the final rule, following the impermissible use of disclosure of any limited data set, a covered entity or business associate must perform a risk assessment that evaluates the factors discussed \[earlier this week\] to determine if breach notification is not required." \[78 *Federal Register* 5644\] *Notification to Individuals*. Without modification, but the Final Rule makes this point with respect to implementation specification (d): *Methods of individual notification*\--"In response to questions raised with respect to a breach at or by a business associate, we note that the covered entity ultimately maintains the obligation to notify affected individuals of the breach under *Notification to Individuals*, although a covered entity is free to delegate the responsibility to the business associate that suffered the breach or to another of its business associates.... Covered entities and business associates should consider which entity is in the best position to provide notice to the individual, which may depend on various circumstances, such as the functions the business associate performs on behalf of the covered entity and which entity has the relationship with the individual." \[78 *Federal Register* 5650-5651\] *Notification to Media*. With a minor change that aligns the definition of "State" \[American Samoa and Northern Mariana Islands\] with HIPAA Rules, and not germane herein for discussion, the Final Rule does point out this caution: "We also emphasize that posting a press release regarding a breach \[involving 500 or more residents of a State or jurisdiction\] of unsecured protected health information on the home page of the covered entity's Web site will not fulfill the obligation to provide notice to the media (although covered entities are free to post a press release regarding a breach on their Web site). To fulfill this obligation, notification, which may be in the form of a press release, must be provided directly to prominent media outlets serving the State or jurisdiction where the affected individuals reside." \[78 *Federal Register* 5653\] *Notification to the Secretary*. There is one modification that focuses on breaches "discovered" in a calendar year as opposed to "occurred" in a calendar year. "The modification clarifies that covered entities are required to notify the Secretary of all breaches of unsecured protected health information affecting fewer than 500 individuals not later than 60 days after the end of the calendar year in which the breaches were 'discovered,' not in which the breaches 'occurred.'" \[78 *Federal Register* 5654\]. Here is a reminder: "Although covered entities need only provide notification to the Secretary of breaches involving less than 500 individuals annually, they must still provide notification of such breaches to affected individuals without unreasonable delay and not later than 60 days after discovery of the breach pursuant to 45 CFR 164.404 \[*Notification to Individuals*\]. \[78 *Federal Register* 5654\] Finally, another Final Rule reminder for large breaches: "With respect to breaches involving 500 or more individuals, we interpreted the term 'immediately' in the statute to require notification be sent to the Secretary concurrently with the notification sent to the individual under 45 CFR 164.404 \[*Notification to Individuals*\] (i.e., without unreasonable delay but in no case later than 60 calendar days following discovery of a breach.)" \[78 *Federal Register* 5653\] For more on notification, visit the HHS [*Notification to the Secretary* Web site](http://www.hhs.gov/ocr/privacy/hipaa/administrative/breachnotificationrule/brinstruction.html?ref=hipaa.com): "Instructions for Submitting Notice of a Breach to the Secretary." Tomorrow, we wrap up discussion of the breach notification rule. Next week, HIPAA.com looks at the modifications to the Security Rule. ### HIPAA Final Rule: Breach Notification Guidance Safe Harbor URL: https://hipaa.com/hipaa-final-rule-breach-notification-guidance-safe-harbor/ Last updated: 2026-10-25T20:44:01.000Z **January 30, 2013**. Today, we look at the definition of *unsecured protected health information* and the [*Guidance Specifying the Technologies and Methodologies that Render Protected Health Information Unusable , Unreadable, or Indecipherable to Unauthorized Individuals*](http://www.hhs.gov/ocr/privacy/hipaa/administrative/breachnotificationrule/brguidance.html?ref=hipaa.com) \["Guidance"\] as discussed in the January 25, 2013 Final Rule: [*Modifications to the HIPAA Privacy, Security, Enforcement, and Breach Notification Rules under the Health Information Technology for Economic and Clinical Health Act \[HITECH Act\]; Other Modifications to the HIPAA Rules*](http://www.gpo.gov/fdsys/pkg/FR-2013-01-25/pdf/2013-01073.pdf?ref=hipaa.com). The Final Rule becomes effective on March 26, 2013, and requires compliance by covered entities and business associates on September 23, 2013. Here is the definition of *unsecured protected health information*: "protected health information that is not rendered unusable, unreadable, or indecipherable to unauthorized persons through the use of a technology or methodology specified by the Secretary \[of the Department of Health and Human Services (HHS)\] under section 13402(h)(2) of Public Law 111-5." \[78 *Federal Register* 5695\] Public Law 111-5 is the American Recovery and Reinvestment Act of 2009, which included the HITECH Act, and was enacted on February 17, 2009\. There are two minor changes in the definition: first, "unauthorized individuals" in the interim final rule is changed to "unauthorized persons" in the Final Rule, with the following reason: "the term 'individual' is defined in 45 CFR 160.103 to mean the person who is the subject of the protected health information, which is not what is intended with the reference to 'individual' in the definition of 'unsecured protected health information. Accordingly, the final rule uses more appropriately the term 'unauthorized persons." \[78 *Federal Register* 5647\] Second, the Final Rule definition removes at the end of the interim final rule definition, "on the HHS Wed site as unnecessary language." \[78 *Federal Register* 5647\] Note, however, the Final Rule indicates: "While we remove the reference to the HHS Web site from the regulatory text, we do plan to continue to post updates to the guidance on the Web site as they are issued." In accordance with the HITECH Act, the Secretary of HHS issued the Guidance on April 17, 2009, and it was published in the *Federal Register* on April 27, 2009\. \[74 *Federal Register* 19006\] Subsequently, it was published in the *Federal Register* as part of the Interim Final Breach Notification Rule on August 24, 2009\. \[74 *Federal Register* 42742-42743\] The *Guidance* as published in 2009 is in force today and available on the HHS Web site, which is linked in the first paragraph. Note the following from the Final Rule: "Covered entities and business associates that implement the specified technologies and methodologies with respect to protected health information are not required to provide notifications in the event of a breach of such information--that is, the information is not considered 'unsecured' in such cases. " \[78 *Federal Register* 5639\] Finally, "\[w\]e encourage covered entities and business associates to take advantage of the safe harbor provision of the breach notification rule by encrypting limited data sets and other protected health information pursuant to the Guidance. If protected health information is encrypted pursuant to this guidance, then no breach notification is required following an impermissible use or disclosure of the information." \[78 *Federal Register* 5644\] Tomorrow, we discuss further changes in the Final Breach Notification Rule. ### HIPAA Final Rule: Breach Risk Assessment Factors for "Probability Standard" URL: https://hipaa.com/hipaa-final-rule-breach-risk-assessment-factors-for-probability-standard/ Last updated: 2026-10-25T20:45:35.000Z **January 29, 2013**. Today, we cover the four risk assessment factors pertaining to breach notification in the [*Modifications to the HIPAA Privacy, Security, Enforcement, and Breach Notification Rules under the Health Information Technology for Economic and Clinical Health Act \[HITECH Act\] and the Genetic Information Nondiscrimination Act; Other Modifications to the HIPAA Rules*](http://www.gpo.gov/fdsys/pkg/FR-2013-01-25/pdf/2013-01073.pdf?ref=hipaa.com)*: Final Rule* that was published in the *Federal Register* on Friday, January 25, 2013\. As discussed in yesterday's post, these risk assessment factors are used in assessing the probability of impermissible use or disclosure compromising protected health information, thereby requiring breach notification.This "probability standard" replaces the "harm standard," becomes effective March 26, 2013, and requires compliance on September 23, 2013 by covered entities and business associates. **Risk Assessment Factors**. The four risk assessment factors that must be considered are in subsection two of the definition of *breach*. “As we have modified and incorporated the factors that must be considered when performing a risk assessment into the regulatory text, covered entities and business associates should examine their policies to ensure that when evaluating the risk of an impermissible use or disclosure they consider all of the required factors.” \[78 *Federal Register* 5695\] Note that these are the *required* factors that must be considered. There may be others the covered entity or business associate should consider as necessary based on particular circumstances related to or characteristics of the covered entity or business associate. \[78 *Federal Register* 5642\] Here are the factors \[78 *Federal Register* 5695\], following the opening statement: (2) "Except as provided in paragraph (1) of this definition, an acquisition, access, use, or disclosure of protected health information in a manner not permitted under subpart E \[HIPAA Privacy Rule\] is presumed to be a breach unless the covered entity or business associate, as applicable, demonstrate that there is a low probability that the protected health information has been compromised based on a risk assessment of at least the following factors": (2)(i). "The nature and extent of the protected health information involved, including the types of identifiers and the likelihood of re-identification." In the risk assessment, examine the sensitivity of the identifiers involved and the likelihood of re-identification or linkage to other information to determine probability of impermissible use or disclosure. The “identifiers of the individual or of relatives, employers, or household members of the individual” are at 45 CFR 164.514(b)(2)(i): (A) Names; (B) All geographic subdivisions smaller than a State, including street address, city, county, precinct, zip code, and their equivalent geocodes, except for the initial three digits of a zip code if, according to the current publicly available data from the Bureau of the Census: ( *1* ) The geographic unit formed by combining all zip codes with the same three initial digits contains more than 20,000 people; and ( *2* ) The initial three digits of a zip code for all such geographic units containing 20,000 or fewer people is changed to 000. (C) All elements of dates (except year) for dates directly related to an individual, including birth date, admission date, discharge date, date of death; and all ages over 89 and all elements of dates (including year) indicative of such age, except that such ages and elements may be aggregated into a single category of age 90 or older; (D) Telephone numbers; (E) Fax numbers; (F) Electronic mail addresses; (G) Social security numbers; (H) Medical record numbers; (I) Health plan beneficiary numbers; (J) Account numbers; (K) Certificate/license numbers; (L) Vehicle identifiers and serial numbers, including license plate numbers; (M) Device identifiers and serial numbers; (N) Web Universal Resource Locators (URLs); (O) Internet Protocol (IP) address numbers; (P) Biometric identifiers, including finger and voice prints; (Q) Full face photographic images and any comparable images; and (R) Any other unique identifying number, characteristic, or code. Note footnote 12 on page 5642 of the Final Rule: "Information that has been de-identified in accordance with 45 CFR 164.514(a)-(c) is not protected health information, and thus, any inadvertent or unauthorized use or disclosure of such information is not considered a breach for purposes of this rule." In other words, de-identified data are without any of the identifiers noted above in (a)-(r). (2)(ii). "The unauthorized person who used the protected health information or to whom the disclosure was made." In the risk assessment, examine “whether the unauthorized person who received the information has obligations to protect the privacy and security of the information,” \[78 *Federal Register* 5643\] and the likelihood of re-identification, discussed above with respect to (2)(i), to determine probability of impermissible use or disclosure. "The final rule expressly includes a factor that would require consideration of the re-identifiability of the information, as well a factor that requires an assessment of the unauthorized person who used the protected health information or to whom the disclosure was made (i.e., whether this person has the ability to re-identify the affected individuals)." \[78 *Federal Register* 5644\] For more on re-identification, see 45 CFR 164.514(c): *Implementation specifications: re-identification*. (2)(iii). "Whether the protected health information was actually acquired or viewed." In the risk assessment, consider the distinction between actual acquisition or view of unsecured protected health information versus the opportunity for the information to be acquired or viewed, to determine the probability of impermissible use or disclosure, as the following example in the Final Rule illustrates: “\[I\]f a laptop computer was stolen and later recovered and a forensic analysis shows that the protected health information on the computer was never accessed, viewed, acquired, transferred, or otherwise compromised, the entity could determine that the information was not actually acquired by an unauthorized individual event though the opportunity existed.” \[78 *Federal Register* 5643\] (2)(iv). "The extent to which the risk to the protected health information has been mitigated." In the risk assessment, “consider the extent and efficacy of the mitigation when determining the probability that the protected health information has been compromised,” \[78 *Federal Register* 5643\] as the following example in the Final Rule illustrates: “Covered entities and business associates should attempt to mitigate the risks to the protected health information following any impermissible use or disclosure, such as by obtaining the recipient’s satisfactory assurances that the information will not be further used or disclosed (through a confidentiality agreement or similar means) or will be destroyed,”… and “acknowledge that the recipient of the information will have an impact on whether the covered entity \[or business associate\] can conclude that an impermissible use or disclosure has been appropriately mitigated.” Tomorrow, we will look at the definition of *unsecured protected health information* and the state of the [*Guidance Specifying the Technologies and Methodologies that Render Protected Health Information Unusable, Unreadable, and Indecipherable to Unauthorized Individuals*](http://www.hhs.gov/ocr/privacy/hipaa/administrative/breachnotificationrule/brguidance.html?ref=hipaa.com), which may provide a safe harbor for breach notification. --- ### Final Rule: Modified Definition of Breach URL: https://hipaa.com/final-rule-modified-definition-of-breach/ Last updated: 2026-10-25T20:47:17.000Z **January 28, 2013**. Today, we want to explore the modified definition of *breach* in the [Final HIPAA/HITECH Act Privacy, Security, Breach Notification, and Enforcement Rule](http://www.gpo.gov/fdsys/pkg/FR-2013-01-25/pdf/2013-01073.pdf?ref=hipaa.com) published in the *Federal Register* on Friday, January 25, 2013\. Here is the modified definition \[45 CFR 164.402, *Definitions,* effective March 26, 2013; 78 *Federal Register* 5695\]: *Breach* means the acquisition, access, use, or disclosure of protected health information in a manner not permitted under subpart E \[HIPAA Privacy Rule\] of this part \[Part 164\] which compromises the security or privacy of the protected health information. (1) Breach excludes: (i) Any unintentional acquisition, access, or use of protected health information by a workforce member or person acting under the authority of a covered entity or a business associate, if such acquisition, access, or use was made in good faith and within the scope of authority and does not result in further use or disclosure in a manner not permitted under subpart E of this part. (ii) Any inadvertent disclosure by a person who is authorized to access protected health information at a covered entity or business associate to another person authorized to access protected health information at the same covered entity or business associate, or organized health care arrangement in which the covered entity participates, and the information received as a result of such disclosure is not further used or disclosed in a manner not permitted under subpart E of this part. (iii) A disclosure of protected health information where a covered entity or business associate has a good faith belief that an unauthorized person to whom the disclosure was made would not reasonably have been able to retain such information. (2) Except as provided in paragraph (1) of this definition, an acquisition, access, use, or disclosure of protected health information in a manner not permitted under subpart E is presumed to be a breach unless the covered entity or business associate, as applicable, demonstrates that there is a low probability that the protected health information has been compromised based on a risk assessment of a least the following factors: (i) The nature and extent of the protected health information involved, including the types of identifiers and the likelihood of re-identification; (ii) The unauthorized person who used the protected health information or to whom the disclosure was made; (iii) Whether the protected health information was actually acquired or viewed; and (iv) The extent to which the risk to the protected health information has been mitigated. The Health Information Technology for Economic and Clinical Health Act (HITECH Act) was enacted as part of the American Recovery and Reinvestment Act of 2009 on February 17, 2009, and Section 13402 provided statutory authority for *Notification in the Case of Breach*. \[123 STAT. 260-263\] After publishing a notice of proposed rule making (NPRM) in the *Federal Register* on April 27, 2009, for public comment, the Department of Health and Human Services (HHS) published an Interim Final Rule (IFR) for breach notification for unsecured protected health information on August 24, 2009\. \[74 *Federal Register* 42740-42770\] The effective date of the IFR was September 23, 2009, and enforcement of breach notification for breaches on or after that date began on February 22, 2010. As required by the HITECH Act, the Secretary of HHS published as part of the April 27, 2009, NPRM [*Guidance Specifying the Technologies and Methodologies That Render Protected Health Information Unusable, Unreadable, or Indecipherable to Unauthorized Individuals*](http://www.hhs.gov/ocr/privacy/hipaa/administrative/breachnotificationrule/brguidance.html?ref=hipaa.com). This was included in the IFR and is in force currently. “Covered entities and business associates that implement the specified technologies and methodologies with respect to protected health information are not required to provide notifications in the event of a breach of such information—that is, the information is not considered ‘unsecured’ in such cases.” \[78 *Federal Register* 5639\] “\[O\]nly encryption and destruction, consistent with National Institute of Standards and Technology (NIST) guidelines, renders protected health information unusable, unreadable, or indecipherable to unauthorized individuals such that notification is not required in the event of a breach of such information.” \[78 *Federal Register* 5647\] According to the Final Rule: “We encourage covered entities and business associates to take advantage of the safe harbor provision of the breach notification rule by encrypting limited data sets and other protected health information pursuant to the \[*Guidance*\]. If protected health information is encrypted pursuant to this guidance, then no breach notification is required following an impermissible use of disclosure of the information.” \[78 *Federal Register* 5644\] In the event of a breach of an “impermissible use or disclosure” of unsecured protected health information that does not fall under one of the exclusions in the definition above, the language of which did not change from the IFR to the Final Rule, then a covered entity or business associate, as applicable, is obligated to conduct a risk assessment. The burden of proof is on the covered entity or business associate, as applicable, to document and demonstrate why an impermissible use of disclosure would fall under one of the breach exclusions. Based on the definition in the IFR, the risk assessment was to determine whether “’compromises the security or privacy of the protected health information’ \[meant\] poses a significant risk of financial, reputational, or other harm to the individual.” \[78 *Federal Register* 5639\] Under the Final Rule, which modified and clarified the definition of breach and risk assessment, the purpose of the risk assessment changed to that outlined in paragraph (2) in the definition of breach above, namely, to demonstrate that there has been “a low probability that the protected health information has been compromised” based on consideration of the specified factors in (2)(i)-(2)(iv). The Final Rule elaborates on the change from the requirement in the IFR \[78 *Federal Register* 5641, 5643\]: “First, we have added language to the definition of breach to clarify that an impermissible use or disclosure of protected health information is presumed to be a breach unless the covered entity or business associate, as applicable, demonstrates that there is a low probability that the protected health information has been compromised…. As a result, we have clarified our position that breach notification is necessary in **all situations** except those in which the covered entity or business associate, as applicable, demonstrates that there is a low probability that the protected health information has been compromised (or one of the other exceptions to the definition of breach applies).” \[emphasis added\] There was an exception for breach notification in the IFR for “limited data sets that do not contain any dates of birth and zip codes” that has been removed in the Final Rule. A risk assessment is required for all situations involving an impermissible use or disclosure of protected health information to determine whether a breach notification is not necessary. The Final Rule does note that “a covered entity or business associate has the discretion to provide the required notifications following an impermissible use or disclosure of protected health information without performing a risk assessment. Because the final rule clarifies the presumption that a breach has occurred following every impermissible use or disclosure of protected health information, entities may decide to notify without evaluation of the probability that the protected health information has been compromised.” \[ emphasis added\] "Second, to further ensure that \[the definition of breach and the risk assessment approach\] is applied uniformly and objectively by covered entities and business associates, we have removed the harm standard and modified the risk assessment to focus more objectively on the risk that the protected health information has been compromised. Thus, breach notification is not required under the final rule if a covered entity or business associate, as applicable, demonstrates through a risk assessment that there is a low probability that the protected health information has been compromised, rather than demonstrate that there is no significant harm to the individual as was provided under the interim final rule. *The final rule also identifies the more objective factors covered entities and business associates must consider when performing a risk assessment to determine if the protected health information has been compromised and breach notification is necessary*." \[emphasis added\] Tomorrow's posting will discuss the four factors that must be addressed as part of the risk assessment of the probability of protected health information being compromised. ### Final HIPAA/HITECH Act Privacy, Security, Enforcement, Breach Notification Rules Published in Federal Register January 25, 2013. URL: https://hipaa.com/final-hipaahitech-act-privacy-security-enforcement-breach-notification-rules-published-in-federal-register-january-25-2013/ Last updated: 2013-01-25T14:40:02.000Z **January 25, 2013**. The Final Rule is published, at last! [*Modifications to the HIPAA Privacy, Security, Enforcement, and Breach Notification Rules Under the Health Information Technology for Economic and Clinical Health Act and the Genetic Information Nondiscrimination Act; Other Modifications to the HIPAA Rules; Final Rule* ](http://www.gpo.gov/fdsys/pkg/FR-2013-01-25/pdf/2013-01073.pdf?ref=hipaa.com)cleared the Office of Management and Budget on January 16, was issued online on the *Federal Register's* Electronic Public Inspection Desk in pre-publication format on January 17, and published in the *Federal Register* today. The Final Rule is 136 pages (pp.5566-5702). The effective date of the Final Rule is Tuesday, March 26, 2013, and the compliance date is Monday, September 23, 2013. Here is the Final Rule Summary: "The Department of Health and Human Services (HHS) is issuing this final rule to: Modify the Health Insurance Portability and Accountability Act (HIPAA) Privacy, Security, and Enforcement Rules to implement statutory amendments under the Health Information Technology for Economic and Clinical Health Act (HITECH Act) to strengthen the privacy and security protection for individuals' health information; modify the rule for Breach Notification for Unsecured Protected Health Information (Breach Notification Rule) under the HITECH Act to address public comment received on the interim final rule; modify the HIPAA Privacy Rule to strengthen the privacy protections for genetic information by implementing section 105 of Title I of the Genetic Information Nondiscrimination Act of 2008 (GINA); and make certain other modifications to the HIPAA Privacy, Security, Breach Notification, and Enforcement Rules (the HIPAA Rules) to improve their workability and effectiveness and to increase flexibility for and decrease burden on the regulated entities." Beginning Monday, January 28, and each weekday through the effective date, March 26, HIPAA.com will post on some aspect of the Final Rule. On Monday, the discussion will focus on the change in definition of *breach* and the change from a "harm standard" to "probability standard" pertaining to breach notification. ### OCR of HHS FINALLY Issues HIPAA/HITECH Act Privacy, Security, Enforcement, and Breach Notification Modifications Final Rule URL: https://hipaa.com/ocr-of-hhs-finally-issues-hipaahitech-act-privacy-security-enforcement-and-breach-notification-modifications-final-rule/ Last updated: 2013-01-18T14:20:06.000Z **January 18, 2013.** On January 16, 2013, the Office of Management and Budget (OMB) completed its EO 12866 regulatory review of [RIN: 0945-AA03](http://www.reginfo.gov/public/do/eAgendaViewRule?pubId=201210&RIN=0945-AA03&ref=hipaa.com), and the long-awaited release of the Department of Health and Human Services' Office for Civil Rights (OCR) so-called "Omnibus" Final Rule was published at 4:15 PM on January 17, 2013, in [pre-publication final draft form](http://www.ofr.gov/OFRUpload/OFRData/2013-01073%5FPI.pdf?ref=hipaa.com) on the *Federal Register's* Electronic Public Inspection Desk. Publication in the *Federal Register* is scheduled for Friday, January 25, 2013\. The title of the Final Rule is: *45 CFR Parts 160 and 164: Modifications to the HIPAA Privacy, Security, Enforcement, and Breach Notification Rules under the Health Information Technology for Economic and Clinical Health Act and the Genetic Information Nondiscrimination Act; Other Modifications to the HIPAA Rules.* The effective date of the final rule is March 26, 2013\. "Covered entities and business associates must comply with the applicable requirements of this final rule by September 23, 2013." HIPAA.com will be providing commentary on the provisions of the "Omnibus" Final Rule on weekdays beginning on January 25, 2013--the day of publication in the *Federal Register*\--and continuing through March 26, 2013--the effective date of the final rule. You may sign up on the upper right of this screen to be notified of postings. Here, we provide from the "Omnibus" Final Rule, the Summary, followed by the Summary of Major Provisions. **Summary**. "The Department of Health and Human Services (HHS) is issuing this final rule to: Modify the Health Insurance Portability and Accountability Act (HIPAA) Privacy, Security, and Enforcement Rules to implement statutory amendments under the Health Information Technology for Economic and Clinical Health Act (HITECH Act) to strengthen the privacy and security protection for individuals' health information; modify the rule for Breach Notification for Unsecured Protected Health Information (Breach Notification Rule) under the HITECH Act to address public comment received on the interim final rule; modify the HIPAA Privacy Rule to strengthen the privacy protections for genetic information by implementing section 105 of Title I of the Genetic Information Nondiscrimination Act of 2008 (GINA); and make certain other modifications to the HIPAA Privacy, Security, Breach Notification, and Enforcement Rules (the HIPAA Rules) to improve their workability and effectiveness and to increase flexibility for and decrease burden on the regulated entities." **Summary of Major Provisions**. "This omnibus final rule is comprised of the following four final rules: 1. Final modifications to the HIPAA Privacy, Security, and Enforcement Rules mandated by the HITECH Act, and certain other modifications to improve the Rules, which were issued as a proposed rule on July 14, 2010\. These modifications: - Make business associates of covered entities directly liable for compliance with certain of the HIPAA Privacy and Security Rules' requirements. - Strengthen the limitations on the use and disclosure of protected health information for marketing and fundraising purposes, and prohibit the sale of protected health information without individual authorization. - Expand individuals' rights to receive electronic copies of their health information and to restrict disclosures to a health plan concerning treatment for which the individual has paid out of pocket in full. - Require modifications to, and redistribution of, a covered entity's notice of privacy practices. - Modify the individual authorization and other requirements to facilitate research and disclosure of child immunization proof to schools, and to enable access to decedent information by family members or others. - Adopt the additional HITECH Act enhancements to the Enforcement Rule not previously adopted in the October 30, 2009, interim final rule (referenced in #2 below), such as the provisions addressing enforcement of noncompliance with the HIPAA Rule due to willful neglect. 2\. Final rule adopting changes to the HIPAA Enforcement Rule to incorporate the increased and tiered civil money penalty structure provided by the HITECH Act, originally published as an interim final rule on October 30, 2009. 1. Final rule on Breach Notification for Unsecured Protected Health Information under the HITECH Act, which replaces the breach notification rule's 'harm' threshold with a more objective standard and supplants an interim final rule published on August 24, 2009. 2. Final rule modifying the HIPAA Privacy Rule as required by the Genetic Information Nondiscrimination Act (GINA) to prohibit most health plans from using or disclosing genetic information for underwriting purposes, which was published as a proposed rule on October 7, 2009." ### ONC Touts its 10 Step Plan for Meeting Meaningful Use Privacy and Security Attestation Requirements URL: https://hipaa.com/onc-touts-its-10-step-plan-for-meeting-meaningful-use-privacy-and-security-attestation-requirements/ Last updated: 2026-10-25T21:08:36.000Z In a recent [Tweet](http://www.twitter.com/ONC%5FHealthIT/status/270295340236816385?ref=hipaa.com), the Office of the National Coordinator for Health Information Technology (ONC) stated: "Move into the 21st Century and check out the [Privacy & Security 10-Step Plan](http://bit.ly/GNwpwO?ref=hipaa.com) before you implement an Electronic Health Record." ONC makes the following recommendation to an Eligible Professional (EP) covered entity participating in the Medicare and Medicaid Financial Incentive Program for Adoption and Meaningful Use of Certified Electronic Health Record (EHR) Technology: "An EP must meaningfully use certified EHR technology for an EHR reporting period, and then attest to CMS \[the Centers for Medicare & Medicaid Services\] that he or she has met meaningful use for that period. Start your 10-step process at least 90 days before you begin the EHR reporting period." The outline of the 10 steps for Meaningful Use are: 1. Confirm that you are a covered entity. 2. Provide leadership \[Most importantly, appoint a Privacy Official and a Security Official, which may be the same person, depending upon the scale of your practice\]. 3. Document your process, findings, and actions \[Most importantly, you must document in writing (which may be electronic) your privacy and security policies and procedures\]. 4. Conduct a security risk analysis. 5. Develop an action plan \[to mitigate identified threats and vulnerabilities to your electronic systems and electronic protected health information\]. 6. Manage and mitigate risks \[by implementing your action plan\]. 7. Prevent breaches with eduction and training of your workforce. 8. Communicate with patients about the confidentiality and security of their protected health information. 9. Update business associate agreements \[to include HITECH Act Breach Notification requirements\]. 10. Attest for the Security Risk Analysis Meaningful Use Objective. The Stage 1 Meaningful Use Core Objective and Measure 15 are: *Objective:* Protect electronic health information created or maintained by the certified EHR technology through the implementation of appropriate technical capabilities. \[The Stage 1 technical capabilities relate to: access control, emergency access,automatic log-off, audit log, integrity, authentication, general encryption, encryption with when exchanging electronic health information, accounting of disclosures (optional)\]. *Measure:* Conduct or review a security risk analysis in accordance with the requirements under 45 CFR 160.308(a)(1) \[HIPAA Administrative Safeguard Standard: *Security Management Process*\] and implement security updates as necessary and correct identified security deficiencies as part of its risk management process. [*Attestation, Core Measure 15*](http://www.cms.gov/Regulations-and-Guidance/Legislation/EHRIncentivePrograms/downloads/EP%5FAttestation%5FUser%5FGuide.pdf?ref=hipaa.com) *(Yes or No Response):* Have you conducted or reviewed a security risk analysis per 45 CFR 164.308(a)(1) and implemented security updates as necessary and corrected identified security deficiencies as part of your risk management process? "Providers ...can only attest after they have met the meaningful use requirements for an EHR reporting period. Only attest for an EHR incentive program, after you have fulfilled the security risk analysis requirements and have documented your efforts. ... "When you attest to meaningful use, it is a legal statement that you have met specific standards, including that you protect electronic health information. Providers participating in the EHR Incentive Program can be audited." CMS attestation [Audits](http://www.hitechanswers.net/meaningful-use-audits-begin/?ref=hipaa.com) began in Summer 2012. Chapter 3 of ONC's *Guide to Privacy and Security of Health Information: 10 Step Plan for Meeting Privacy and Security Portions of Meaningful Use* concludes (p.26): "If you attest prior to actually meeting the meaningful use security requirement, you could increase your business liability for federal law violations and making a [false claim](http://www.falseclaimsact.com/ffca%5Ffcastatute.php?ref=hipaa.com). From this perspective, consider implementing multiple security measures as feasible, prior to attesting. The priority would be mitigating high-impact and high-likelihood risks." In addition to the Meaningful Use Audit program as it pertains to the Stage 1 Core Objectives, including security, under auspices of CMS, also be aware of the [HIPAA Privacy & Security Audit Program](http://www.hhs.gov/ocr/privacy/hipaa/enforcement/audit/index.html?ref=hipaa.com) conducted under auspices of the Office for Civil Rights (OCR) of the Department of Health and Human Services, which HIPAA.com has discussed in earlier postings. HIPAA.com noted at the beginning that ONC recommends giving yourself at least 90 days to conduct security compliance activities as they pertain to attestation, and even longer to meet HIPAA privacy, security, and breach notification implementation specifications as well. Take this new climate of privacy and security enforcement and increased probability of audit of risk analysis, policies and procedures, and workforce training seriously. \[20121204\] ### Final Administrative Simplification Rules for Plan ID, NPI Addition, and ICD-10 Code Set Compliance Delay Published in Federal Register URL: https://hipaa.com/final-administrative-simplification-rules-for-plan-id-npi-addition-and-icd-10-code-set-compliance-delay-published-in-federal-register/ Last updated: 2012-09-05T19:36:16.000Z **September 5, 2012**. Today, the Federal Register published the Centers for Medicare & Medicaid Services (CMS) Final Rule: [*Administrative Simplification: Adoption of a Standard for a Unique Health Plan Identifier; Addition to the National Provider Identifier \[NPI\] Requirements; and a Change to the Compliance Date for the International Classification of Diseases, 10th Edition (ICD-10-CM and ICD-10-PCS) Medical Data Code Sets*](http://www.gpo.gov/fdsys/pkg/FR-2012-09-05/pdf/2012-21238.pdf?ref=hipaa.com). We provided the detailed "Executive Summary" in our August 24, 2012, posting, based on the preview posting at the *Federal Register's* Electronic Public Inspection Desk. Below we provide the shorter publication "Summary" \[p.54664\]: "This final rule adopts the standard for a national unique health plan identifier (HPID) and establishes requirements for the implementation of the HPID. In addition,it adopts a data element that will serve as an other entity identifier (OEID), or an identifier for entities that are not health plans, health care providers, or individuals, but that need to be identified in standard transactions. This final rule also specifies the circumstances under which an organization covered health care provider must require certain noncovered individual health care providers who are prescribers to obtain and disclose a National Provider Identifier (NPI). Lastly, this final rule changes the compliance date for the International Classification of Diseases, 10th Revision, Clinical Modification (ICD-10-CM) for diagnosis coding, including the Official ICD-10-CM Guidelines for Coding and Reporting, and the International Classification of Diseases, 10th Revision, Procedure Coding System (ICD-10-PCS) for inpatient hospital procedure coding, including the Official ICD-10-PCS Guidelines for Coding and Reporting, from October 1, 2013 to October 1, 2014." This Final Rule as official policy is effective on November 5, 2012\. Health plans other than small health plans must obtain an HPID by November 5, 2014\. Small health plans have an additional year to comply, on November 5, 2015\. Covered entities must use the HPID in standard transactions on or after November 7, 2016\. With regard to the NPI, an organization covered health care provider must comply by May 6, 2013, with the implementation specifications in 45 CFR 162.410(b): "An organization covered health care provider that has as a member, employs, or contracts with, an individual health care provider who is not a covered entity and is a prescriber, must require such health care provider to-- (1) Obtain an NPI form the National Plan and Provider Enumeration System ([NPPES](https://nppes.cms.hhs.gov/NPPES/Welcome.do?ref=hipaa.com)); and (2) To the extent the prescriber write a prescription while acting within the scope of the prescriber's relationship with the organization, disclose the NPI upon request to any entity that needs it to identify the prescriber in a standard transaction." \[p. 54719\] ### CMS and ONC Publish Final Rules for Meaningful Use Stage 2 Security in Federal Register URL: https://hipaa.com/cms-and-onc-publish-final-rules-for-meaningful-use-stage-2-security-in-federal-register/ Last updated: 2012-09-03T15:59:03.000Z **September 4, 2012**. The Department of Health and Human Services (HHS) entities: Centers for Medicare & Medicaid Services (CMS) and Office of the National Coordinator for Health Information Technology (ONC), published their Final Rules for Meaningful Use Stage 2 in today's *Federal Register*. This posting focuses on the preamble relating to the following Stage 2 *security* objective in the CMS Final Rule entitled [*Medicare and Medicaid Programs; Electronic Health Record Incentive Program*](http://www.gpo.gov/fdsys/pkg/FR-2012-09-04/pdf/2012-21050.pdf?ref=hipaa.com): "Protect electronic health information created or maintained by the Certified EHR Technology \[CEHRT\] through the implementation of appropriate technical capabilities." Reference numbers in brackets refer to the page number(s) in the September 4, 2012, *Federal Register*. Associated with this objective is a *Measure* that is the same for Eligible Professionals \[45 CFR 495.6(j)(16)(i) at p. 54154\], and for Eligible Hospitals or Critical Access Hospitals (CAHs) \[45 CFR 495.6(l)(15)(i) at p. 54156\]: "Conduct or review a security risk analysis in accordance with the requirements \[of the HIPAA Security Rule\] under 45 CFR 164.308(a)(1) \[*Security Management Process* Administrative SafeguardStandard\], including addressing the encryption/security of data stored in Certified EHR Technology \[CEHRT\] in accordance with \[HIPAA Security Rule\] requirements under 45 CFR 164.312(a)(2)(iv) \[*Encryption and decryption* addressable implementation specification of the Technical Safeguard *Access Control* Standard\] and 45 CFR 164.306(d)(3) \[*Addressable* requirements for Security Standard *Implementation Specifications*\], and implement security updates as necessary and correct identified security deficiencies as part of the \[EP's, Eligible Hospitals, CAH's\] risk management process." Preamble comments include the following excerpts related to this measure: "As noted in the proposed rule, this measure is the same as in Stage 1 except that we specifically highlight the encryption/security of data that is stored in CEHRT (data at rest). Recent HHS analysis of reported breaches indicates that almost 40 percent of large breaches (breaches affecting 500 or more individuals) involve lost or stolen devices. Had these devices been encrypted, their data would have been secured. It is for these reasons that we specifically call out this requirement under 45 CFR 308(a)(1). We did not propose to change the HIPAA Security Rule requirements, or require any more under this measure than is required under HIPAA. We only emphasize the importance of an EP or hospital including in its security risk analysis an assessment of the reasonable\[ness\] and appropriateness of encrypting electronic protected health information as a means of securing it, and where it is not reasonable and appropriate, the adoption of an equivalent alternative measure. \[pp. 54002-54003\] ... "We do not proposes to change the HIPAA Security Rule requirements or impose additional requirements under this measure than those required under HIPAA. **A \[risk analysis\] review must be conducted for each EHR reporting period** and any security updates and deficiencies that are identified should be included in the provider's risk management process and implemented or corrected as dictated by that process. \[emphasis added\] We refer providers to the requirements under 45 CFR 164.308(a)(1), including addressing the encryption/security of data at rest in accordance with the requirements under 45 CFR 164.312(a)(2)(iv) and 45 CFR 164.306(d)(3), of the [HIPAA Security Rule](http://www.hhs.gov/ocr/privacy/hipaa/administrative/securityrule/rafinalguidancepdf.pdf?ref=hipaa.com). The scope of the security risk analysis for purposes of this meaningful use measure applies only to data created or maintained by CEHRT. This measure does not apply to data centers that are not part of CEHRT. However, we note that such data centers may be subject to the security requirements under 45 CFR 164.308(a)(1) and refer providers to the HIPAA Security Rules for compliance information. \[p. 54003\] ... "We are making a change in this final rule to the language of 'data at rest' to specify our intention of data that is stored in CEHRT.... We further specify that in order to meet this objective and measure, an EP, eligible hospital, or CAH must use the capabilities and standards of CEHRT at 45 CFR 170.314(d)(1) through 170.314(d)(8)." These "capabilities and standards of CEHRT," as referenced are published in the September 4, 2012, *Federal Register* in the ONC Final Rule entitled: [*Health Information Technology: Standards, Implementation Specifications, and Certification Criteria for Electronic Health Record Technology, 2014 Edition; Revisions to the Permanent Certification Program for Health Information Technology*](http://www.gpo.gov/fdsys/pkg/FR-2012-09-04/pdf/2012-20982.pdf?ref=hipaa.com). They are: 45 CFR 170.314: *2014 Edition electronic health record certification criteria* (d): *Privacy and security* \[pp. 54289-54290\] (1) *Authentication, access control, and authorization* (2) *Auditable events and tamper-resistance* (3) *Audit report(s)* (4) *Amendments* (5) *Automatic log-off* (6) *Emergency access* (7) *End-user device encryption* (8) *Integrity* ### CMS Issues Final Administrative Simplification Final Rules Regarding Identifiers and ICD-10 Code Set Compliance Delay URL: https://hipaa.com/cms-issues-final-administrative-simplification-final-rules-regarding-identifiers-and-icd-10-code-set-compliance-delay/ Last updated: 2012-08-24T18:06:35.000Z August 24, 2012\. Today, the Office of Management and Budget (OMB) completed review and sent to the *Federal Register* for publication on September 5, 2012, the Centers for Medicare & Medicaid Services (CMS) Final Rule: *Administrative Simplification: Adoption of a Standard for a Unique Health Plan Identifier; Addition to the National Provider Identifier Requirements; and a Change to the Compliance Date for the International Classification of Diseases, 10th Edition (ICD-10-CM and ICD-10-PCS) Medical Data Code Sets*. The effective date of the Rule is November 5, 2012\. Prior to publication, the [Final Rule](http://www.ofr.gov/inspection.aspx?ref=hipaa.com) may be examined at or downloaded from the Office of the Federal Register's Electronic Public Inspection Desk. Here is the Executive Summary from the Final Rule: "This rule adopts a standard unique health plan identifier (HPID) and a data element that will serve as an other entity identifier (OEID). This rule also adopts an addition to the National Provider Identifier (NPI) requirements. Finally, this rule changes a compliance date for the ICD-10-CM and ICD-10-PCS medical data code sets (hereinafter 'code sets') from October 1, 2013 to October 1, 2014. "**(1) HPID**. Currently, health plans and other entities that perform health plan functions, such as third party administrators and clearinghouses, are identified in Health Insurance and Portability and Accountability Act of 1996 (HIPAA) standard transactions with multiple identifiers that differ in length and format. Covered health care providers are frustrated by various problems associated with the lack of a standard identifier, such as: improper routing of transactions; rejected transactions due to insurance identification errors; difficulty in determining patient eligibility; and challenges resulting from errors in identifying the correct health plan during claims processing. "The adoption of the HPID and the OEID will increase standardization with HIPAA standard transactions and provide a platform for other regulatory and industry initiatives. Their adoption will allow for a higher level of automation for health care provider offices, particularly for provider processing of billing and insurance related tasks, eligibility responses from health plans, and remittance advice that describes health care claim payments. \[Health plans with the exception of small health plans must obtain an HPID by November 5, 2014\. Small health plans must obtain an HPID by November 5, 2015\. Covered entities must use HPIDs in the standard transactions on or after November 7, 2016.\] "**(2) NPI**. In the January 23, 2004 *Federal Register* (69 FR 3434), the U.S. Department of Health and Human Services (HHS) published a final rule establishing the standard for a unique health identifier for health care providers for use in the health care system and adopting the National Provider Identifier (NPI) as that standard ('2004 NPI final rule'). The rule also established the implementation specifications for obtaining and using the NPI. Since that time, pharmacies have encountered situations where they need to include the NPI of a prescribing health care provider in a pharmacy claim, but where the prescribing health care provider has been a noncovered health care provider who did not have an NPI because he or she was not required to obtain one. This situation has become particularly problematic in the Medicare Part D program. The addition to the NPI requirements addresses this issue. \[An organization covered health care provider must comply by May 6, 2013 with the implementation specifications in 45 CFR 162.410(b), as shown on page 202 of the final rule version referenced above.\] "**(3) ICD-10-CM and ICD-10-PCS Code Sets**. In the January 16, 2009 *Federal Register* (74 FR 3328), HHS published a final rule in which the Secretary of of HHS ('the Secretary') adopted the ICD-10-CM and ICD-10-PCS ('ICD-10') code sets as the HIPAA standards to replace the previously adopted International Classification of Diseases, 9th Revision, Clinical Modification, Volumes 1 and 2 (diagnoses), and 3 (procedures) including the Official ICD-9-CM Guidelines for Coding and Reporting. The compliance date set by the final rule was October 1, 2013. "Since that time, some provider groups have expressed strong concern about their ability to meet the October 1, 2013 compliance date and the serious claims payment issues that might ensue if they do not meet the date. Some providers' concerns about being able to meet the ICD-10 compliance date are based, in part, on difficulties they had meeting the compliance deadline for the adopted Associated Standard Committee's ('ASC') X12 Version 5010 standards ('Version 5010') for electronic health care transactions. Compliance with Version 5010 and ICD-10 by all covered entities is essential to a smooth transition to the updated medical data code sets, as the failure of any one industry segment to achieve compliance would negatively affect all other industry segments and result in returned claims and provider payment delays. We believe the change in the compliance date for ICD-10 \[to October 1, 2014\] gives health care providers and other covered entities more time to prepare and fully test their systems to ensure a smooth and coordinated transition by all covered entities." ### Five HIPAA Compliance Activities Your Organization Must Undertake URL: https://hipaa.com/happy-16th-birthday-hipaa-five-hipaa-compliance-activities-your-organization-must-undertake-now/ Last updated: 2026-10-25T20:54:11.000Z HIPAA Administrative Simplification was enacted on August 21, 1996 as [Subtitle F of Title II of Public Law 104-191](http://www.hhs.gov/ocr/privacy/hipaa/administrative/statute/index.html?ref=hipaa.com). The so-called [HITECH Act “Omnibus” regulation](http://www.reginfo.gov/public/do/eAgendaViewRule?pubId=201110&RIN=0945-AA03&ref=hipaa.com) that modifies HIPAA privacy and security provisions will be published in the *Federal Register* by the end of this summer, [according to the head of HHS’ National Coordinator for Health Information Technology, Farzad Mostashari, M.D.](http://www.healthdatamanagement.com/news/hipaa-summit-privacy-security-breach-44739-1.html?zkPrintable=true&ref=hipaa.com) Based on the timeline in the Notice of Proposed Rule Making, compliance by all covered entities and their business associates would be required 240 days after publication, most likely sometime in May 2013, assuming the end-of-summer deadline is met. All covered entities and their business associates will be required to comply with provisions of the Omnibus regulation. From enactment of HIPAA Administrative Simplification in August 1996 through issuance of HIPAA privacy (April 2003) and security (April 2005) enabling regulations until enactment of the HITECH Act, federal enforcement was lax and covered entities evinced attitudes of “we’re compliant,” without understanding what compliance entailed, or “the feds will never check on whether I am compliant or not.” Be forewarned: detection and enforcement has increased markedly, both at federal and state levels, and is about to get much tougher with the release of the Omnibus regulation ([especially you, Texas](http://www.dallasbar.org/content/new-medical-privacy-law-texas-what-you-need-know?ref=hipaa.com)). Further, penalties for violations of privacy, security, and breach notification provisions are substantial. Currently, as a covered entity, your organization is subject to HHS’ privacy and security enforcement agency, Office for Civil Rights (OCR), compliance audits that were initiated earlier this year, and to investigations relating to complaints and to breaches of protected health information (PHI). Achieving compliance is a time-consuming process. Here are five activities your organization should be doing NOW in advance of release of the Omnibus regulations and that it needs to complete before compliance kicks in sometime in May 2013. ## 1\. Conduct a thorough risk analysis or update an existing risk analysis. The foundation of safeguarding your organization’s oral, hard copy, and electronic PHI is the risk analysis that identifies threats and vulnerabilities to PHI that your organization creates, maintains, receives, or transmits, and consideration of risk mitigation strategies and tools that are the basis for your organization’s [policies and procedures for safeguarding its PHI](http://csrc.nist.gov/publications/drafts/800-30-rev1/SP800-30-Rev1-ipd.pdf?ref=hipaa.com). Failure to have conducted a new risk analysis or review periodically an existing risk analysis is evidence of non-compliance, and the penalties are such to imperil your organization as a viable business. Failure to conduct a risk analysis is tantamount to *willful neglect*! ## 2\. Document your privacy, security, breach notification polices and procedures. On June 26, 2012, OCR issued audit procedures by security, privacy, and breach notification *implementation specification* identifying the inquiries that will be addressed to senior management and the written documentation that compliance auditors will need to review, and in some cases, take samples of, as evidence of compliance. Your documented policies and procedures will be the next step after completing a risk analysis or its update, the findings of which will be the basis for the safeguard policies and procedures. Failure to document may subject your organization to *willful neglect—not corrected* violations, for which the penalty is a mandatory $50,000 per violation up to a maximum of $1.5 million for repeat of a specific violation in a calendar year. Those penalties were raised in 2009 from $100 per violation up to a maximum of $25,000 for repeat of a specific violation in a calendar year. In addition, participants in the Medicare and Medicaid Financial Incentive Programs for Adoption and Meaningful Use of Certified Electronic Health Record Technology must document risk analysis and Core security policies, and are subject to [compliance audits that began in July 2012](http://www.cms.gov/Regulations-and-Guidance/Legislation/EHRIncentivePrograms/Attestation.html?ref=hipaa.com). ## 3\. Train your workforce members, including management. When privacy, security, and breach notification policies and procedures are in place, as they should be now and modified later to reflect the [HITECH Act Omnibus regulatory provisions](http://ecfr.gpoaccess.gov/cgi/t/text/text-idx?c=ecfr&sid=c83ef165e5b089a3351012715b247a02&tpl=/ecfrbrowse/Title45/45cfr164%5Fmain%5F02.tpl&ref=hipaa.com), covered entities are required to provide each workforce member access to them and to train each workforce member on their implementation so that its PHI is safeguarded. Workforce members are required to have “awareness and understanding” of the safeguards and to follow the policies and procedures, and the covered entity must document that such training has occurred. A review of case examples and HHS resolution agreement “corrective action plans” shows that [training is a key element in demonstrating compliance in an audit](http://www.hhs.gov/ocr/privacy/hipaa/enforcement/examples/index.html?ref=hipaa.com) and as part of the remediation enforcement process. For example, in reference to the [Blue Cross Blue Shield Tennessee (BCBST) resolution agreement](http://www.hhs.gov/news/press/2012pres/03/20120313a.html?ref=hipaa.com), in which BCBST paid a fine of $1.5 million, the Director of OCR, Leon Rodriguez said: “This settlement sends an important message that OCR expects health plans and health care providers to have in place a carefully designed, delivered, and monitored HIPAA compliance program. The HITECH Breach Notification Rule is an important enforcement tool and OCR will continue to vigorously protect patients’ right to private and secure health information.” The three pillars of that compliance program will be *risk analysis*, *documented policies and procedures*, and *privacy and security training*. ## 4\. Encrypt your protected health information on mobile and portable devices. As of August 23, 2012, [OCR has publicly disclosed 487 breaches](http://www.hhs.gov/ocr/privacy/hipaa/administrative/breachnotificationrule/breachtool.html?ref=hipaa.com) involving 500 or more individuals since September 23, 2009, affecting a total of just over 21 million persons. Of the total number of breaches where location of breached information is known (e.g., electronic or hard copy source), 73% of the breaches involve electronic sources and 27% paper sources. Of the total irrespective of source, just under 19% involve a business associate. Of the electronic sourced breaches, just over 60% involved a laptop or other portable electronic device, and just under 92% of those are reported as stolen or lost. Many of these incidents could be avoided if the data were secured through encryption, which is required under OCR [*Guidance Specifying the Technologies and Methodologies that Render Protected Health Information Unusable, Unreadable, or Indecipherable to Unauthorized Individuals*](http://www.hhs.gov/ocr/privacy/hipaa/administrative/breachnotificationrule/brguidance.html?ref=hipaa.com). ## 5\. Remember the 1981 Oil Filter commercial adage: “You can pay me now or pay me later.” Remediating breaches is costly, not only financially, but also in time, potential damage to reputation and customer goodwill, and lost business. The Ponemon Institute, a privacy and information management research firm, in March 2011, announced results of the sixth annual U.S. [Cost of a Data Breach Study](http://www.ponemon.org/blog/post/cost-of-a-data-breach-climbs-higher?ref=hipaa.com). According to this study, based on survey data, breach incidents cost U.S. companies $214 per compromised customer record (2010 data). Looking just at OCR’s publicly disclosed 487 breaches, affecting just over 21 million individuals, potentially the cost is just under $4.5 billion for remediation. The August 3, 2011, HDM Breaking News article, [*What Happens After a Data Breach?*](http://www.healthdatamanagement.com/news/protected-health-information-data-breach-42935-1.html?ref=hipaa.com) states: “\[t\]he cost to reduce the risk to protected health information before a breach can be as low as 10 percent of the cost to remediate a medium-sized breach.” As [the old automotive oil filter TV ad stated](http://www.youtube.com/watch?v=aq3wL8ZXjBU&ref=hipaa.com), “you can pay me now or pay me later.” Investment now in HIPAA/HITECH Act privacy and security safeguards to minimize risk to PHI is a cost-effective and wise investment, especially in ENCRYPTING YOUR PHI on mobile and portable electronic devices and media with a high likelihood of being lost or stolen. If your organization has already performed items 1-3 above, it will have to address those items again to reflect HITECH Act modifications in the Omnibus regulation. ### EFT and RA Transaction Operating Rules IFC Published in Federal Register August 10 URL: https://hipaa.com/eft-and-ra-transaction-operating-rules-ifc-published-in-federal-register-august-10/ Last updated: 2012-08-10T18:21:24.000Z **August 10, 2012**. Today, the Interim Final Rule with comment period (IFC): *Administrative Simplification: Adoption of Operating Rules for Electronic Funds Transfers (EFT) and Remittance Advice Transactions*, was published in the [*Federal Register*](http://www.gpo.gov/fdsys/pkg/FR-2012-08-10/pdf/2012-19557.pdf?ref=hipaa.com). The effective date of the IFC is the date of publication, August 10, 2012\. Comments on the IFC may be submitted to the Department of Health and Human Services (HHS) on or before October 9, 2012, with submission instructions included on page 48008 of the IFC. The Executive Summary (without footnotes) from the IFC follows: "A. Purpose of the Regulatory Action. Health care spending in the United States constitutes nearly 18 percent of the US Gross Domestic Product (GDP) and costs an average of $9,000 per person annually. Many factors contribute to the high cost of health care in the United States, but studies point to administrative costs as having a substantial impact on the growth of spending and an area of costs that could likely be reduced. "One area of administrative burden that can be lessened for health care providers is the time and labor spent interacting with multiple health insurance plans, called billing and insurance related (BIR) tasks. The average physician spends a cumulative total of 3 weeks a year on BIR tasks according to one study, and, in a physician's office, two-thirds of a full-time employee per physician is necessary to conduct BIR tasks. "The tasks and costs of activities directly related to collecting payments is a category of BIR tasks. Nearly 40 percent of nonclinical staff time spent on BIR tasks in a physician practice is dedicated to activities directly related to collecting payments. According to estimates that are discussed more broadly in the Regulatory Impact Analysis (RIA) \[of the IFC\], most health care providers collect and deposit paper checks, and manually post and reconcile the health care claim payments in their accounting systems. By automating some of these tasks, time and labor spent on the collection of payments can be decreased. Automation can be achieved through the electronic transfer of information or electronic date interchange (EDI). Through the use of electronic funds transfers (EFT) for health care claim payments and the use of electronic remittance advice (ERA) that describes adjustments to the payments, BIR costs can be decreased. "The benefits of EFT have been realized in many other industries. The benefits include material cost savings, fraud control, and improved cash flow and cash forecasting. The benefits of ERA have also been demonstrated in terms of cost savings in paper and mailings. By receiving remittance advice electronically, providers can use electronic denial management tools that dramatically improve payment recovery and reconciliation. Despite these advantages, an estimated 70 percent of health care claim payments continue to be in paper check form and an estimated 75 percent of remittance advices is sent through the mail in paper form. "There is evidence that the use of operating rules for specific electronic health care transactions results in higher use of EDI by health care providers. We expect usage of EFT and ERA by the health care industry will increase and administrative savings will be realized when industry implements the operating rules for those transactions. "B. Legal Authority for the Regulatory Action. The legal authority for the adoption of operating rules rests in section 1173(g) of the Social Security Act (the Act). Section 1173(g) of the Act was added by section 1104(b)(2) of the Patient Protection and Affordable Care Act (Public Law 111-148), enacted on March 23, 2010, as amended by the Health Care and Education Reconciliation Act of 2010 (Public Law 111-152), enacted on March 30, 2010 (collectively known as and hereinafter referred to as the Affordable Care Act. "C. Summary of the Major Provisions of the Regulatory Action. In this interim final rule with comment period (IFC), we are adopting the Phase III Council for Affordable Quality Healthcare (CAQH) Committee on Operating Rules for Information Exchange (CORE) EFT & ERA Operating Rule Set, including the CORE v5010 Master Companion Guide Template, for the health care EFT and remittance advice transaction (hereinafter referred to as the EFT & ERA Operating Rule Set), with one exception: We are not adopting Requirement 4.2, titled 'Health Care Claim Payment/Advice Batch Acknowledgement Requirements,' of the Phase III Core 350 Health Care Claim Payment/Advice (835) Infrastructure Rule because that requirement requires the use of the Accredited Standards Committee (ASC) X12 999 acknowledgement standard, and the Secretary \[of HHS\] has not adopted standards for acknowledgements. "Covered entities must be in compliance with the EFT & ERA Operating Rule Set by January 1, 2014. "D. Costs and Benefits. Both costs and benefits are analyzed by examining the costs and cost savings of implementing and using the EFT & ERA Operating Rule Set adopted in this IFC in the following four areas of administrative tasks-- - Provider enrollment in EFT and ERA; - Implementing infrastructure and communication networks between trading partners; - Reassociation of the payment information with the remittance information; and - Posting payment adjustments and claim denials. "To a large extent, the costs of implementing the EFT & ERA Operating Rule Set will be borne by the health plans, with much of the benefits accruing to providers. Many health plans actively participated in the development of these rules, and the requirements they put on themselves were carefully deliberated. In the RIA of this IFC, we estimate the cost to implement the EFT & ERA Operating Rule Set is $1.2 to $2.7 billion for government and commercial health plans, including third party administrators (TPAs), hospitals, and physician offices. The savings from and cost benefit of using the EFT & ERA Operating Rule Set is $3 to $4.5 billion for government and commercial health plans, hospitals, and physician offices. The net savings derived from using the EFT & ERA Operating Rule Set over 10 years ranges from approximately $300 million to $3.3 billion." ### OCR Publishes HIPAA/HITECH Act Privacy and Security Compliance Audit Protocol URL: https://hipaa.com/ocr-publishes-hipaahitech-act-privacy-and-security-compliance-audit-protocol/ Last updated: 2012-07-09T19:30:00.000Z **July 9, 2012**. Late in June, the Office for Civil Rights (OCR) of the Department of Health and Human Services (HHS) published its [HIPAA/HITECH Act Privacy and Security *Compliance Audit* Protocol](http://www.hhs.gov/ocr/privacy/hipaa/enforcement/audit/protocol.html?ref=hipaa.com). Here is OCR's description of the program, which outlines 77 audit procedures for the HIPAA Security Rule and 88 audit procedures for the HIPAA Privacy and HITECH Act Breach Notification Rules: "The OCR HIPAA Audit program analyzes processes, controls, and policies of selected covered entities pursuant to the HITECH Act audit mandate. OCR established a comprehensive audit protocol that contains the requirements to be assessed through these performance audits. The entire audit protocol is organized around modules, representing separate elements of privacy, security, and breach notification. The combination of these multiple requirements may vary based on the type of covered entity selected for review. - The audit protocol covers Privacy Rule requirements for (1) notice of privacy practices for PHI \[protected health information\], (2) rights to request privacy protection for PHI, (3) access of individuals to PHI, (4) administrative requirements, (5) uses and disclosures of PHI, (6) amendment of PHI, and (7) accounting of disclosures. - The protocol covers Security Rule requirements for administrative, physical, and technical safeguards. - The protocol covers requirements for the Breach Notification Rule." The OCR Audit Protocol Web site link highlighted above outlines each of the audit procedures that starts with the phrase "inquire of management," and permits *keyword search*. As an example, we identify below the first audit procedure under the Security Rule, whose key activity is: *conduct risk assessment:* **Section*:* 45 CFR 164.308 ***Established Performance Criteria***: 45 CFR 164.308(a)(1). Security Management Process (45 CFR 164.308(a)(1)(ii)(a)--Conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of electronic protected health information held by the covered entity. ***Key Activity***: Conduct Risk Assessment ***Audit Procedures***: Inquire of management as to whether formal or informal policies or practices exist to conduct an accurate assessment of potential risks and vulnerabilities to the confidentiality, integrity, and availability of ePHI \[electronic PHI\]. Obtain and review relevant documentation and evaluate the content relative to the specified criteria for an assessment of potential risks and vulnerabilities of ePHI. Evidence of covered entity risk assessment process or methodology considers the elements in the criteria and \[whether the it\] has been updated or maintained to reflect changes in the covered entity's environment. Determine if the covered entity risk assessment has been conducted on a periodic basis. Determine if the covered entity has identified all systems that contain, process, or transmit ePHI. *Implementation Specification*: Required. HIPAA.com recommends that covered entities pay close attention to the wording of OCR's audit procedures as they pertain to their documented and implemented policies and procedures for successfully passing a compliance audit and avoiding potentially costly and time consuming OCR enforcement action. ### OCR's Publicly Disclosed Large Breaches Now Top 20 Million Impacted Individuals URL: https://hipaa.com/ocrs-publicly-disclosed-large-breaches-now-top-20-million-impacted-individuals/ Last updated: 2012-05-16T14:39:06.000Z **May 16, 2012**. The Department of Health and Human Services' (HHS) HIPAA/HITECH Act privacy and security enforcement arm, Office for Civil Rights (OCR), is responsible under the HITECH Act to publicly disclose privacy and security breaches that affect 500 or more individuals on its [Breach Notification Web site](http://www.hhs.gov/ocr/privacy/hipaa/administrative/breachnotificationrule/breachtool.html?ref=hipaa.com). With the now reported Utah Department of Health hacking/IT incident breach occurring in the period March 10-April 2, 2012 and affecting a reported 780,000 individuals, the total number in 435 breaches reported since September 22, 2009, now totals 20,079,189 impacted individuals. Of the total number of breaches where location of breached information is known (e.g., electronic or hard copy source), 72% of the breaches involve electronic sources and 28% paper sources. Of the total irrespective of source, just under 20% involve a business associate. Of the electronic sourced breaches, just over 61% involved a laptop or other portable electronic device, and just under 92% of those are reported as stolen or lost. Many of these incidents could be avoided if the data were secured through encryption. The Office of Management and Budget (OMB) has been sitting on the delayed [Final Privacy, Security, Breach Notification, and Enforcement Rules](http://www.reginfo.gov/public/do/eAgendaViewRule?pubId=201110&RIN=0945-AA03&ref=hipaa.com) since March 24, 2012\. A speedier exit from OMB's EO 12866 review of these Final Rules before publication in the *Federal Register* might get greater attention of covered entities and business associates to securing protected health information (PHI) and diminishing the likelihood of these large breaches, the consequences of which are costly and time consuming to remedy, as has been shown in the recent *Corrective Action Plan* that is part of the April 17, 2012, Phoenix Cardiac Surgery [Resolution Agreement](http://www.hhs.gov/ocr/privacy/hipaa/enforcement/examples/pcsurgery%5Fagreement.pdf?ref=hipaa.com) with HHS. Hopefully, OMB soon will release the delayed Final Rules, and OCR will accompany publication of them with a comprehensive and continued educational effort that highlights the importance of conducting a risk analysis, developing policies and procedures to safeguard PHI, training workforce members on those safeguards, and demonstrating consequences of not achieving compliance. ### ONC Issues Meaningful Use Guide for Privacy & Security Attestation Compliance URL: https://hipaa.com/onc-issues-meaningful-use-guide-for-privacy-security-attestation-compliance/ Last updated: 2012-05-09T22:20:42.000Z **May 9, 2012**. The [Office of the National Coordinator for Health Information Technology](http://healthit.hhs.gov/portal/server.pt/community/healthit%5Fhhs%5Fgov%5F%5Fhome/1204.?ref=hipaa.com) (ONC) has issued a [*Guide to Privacy and Security of Health Information*](http://www.healthit.gov/sites/default/files/pdf/privacy/privacy-and-security-guide.pdf?ref=hipaa.com) (Version 1.1 022312). This Guide is targeted to medical practitioners who participate in the Medicare and Medicaid Program for Adoption and Meaningful Use of Certified Electronic Health Record Technology. Chapters are: 1. What Is Privacy & Security and Why Does It Matter? 2. Privacy & Security and Meaningful Use. 3. Privacy & Security Step Plan for Meaningful Use. 4. Integrating Privacy and Security into Your Practice. 5. Privacy and Security Resources. The Guide highlights two of the Stage 1 Meaningful Use Objectives and Corresponding Measures relating to Privacy (Objective #12) and Security (Objective #15): *"Objective #12*: Provide Patients with an electronic copy of their health information (including diagnostic test results, problem list, medication lists, medication allergies) upon request. *Measure*: More than 50 percent of all patients who request an electronic copy of their health information are provided it within three business days. Under the HIPAA Privacy Rule (access), patients have a right to view and obtain a copy of their protected health information (PHI) in your designated record set, including information stored in your EHR \[electronic health record\]. *"Objective #15:* Protect electronic health information created or maintained by the certified EHR technology through the implementation of appropriate technical capabilities. *Measure*: Conduct or review a security risk analysis in accordance with the requirements under the HIPAA Security Rule (45 CFR 164.308(a)(1)(ii)(A)), implement security updates as necessary and correct identified security deficiencies as part of the risk management process. Under the HIPAA Security Rule, you are required to conduct a security risk analysis (45 CFR 164.308)." The Guide also outlines 10 steps for achieving Meaningful Use: "1\. Confirm you are a 'covered entity' 1. Provide leadership 2. Document your process, findings, and actions 3. Conduct security risk analysis 4. Develop an action plan 5. Manage and mitigate risks 6. Prevent with education and training 7. Communicate with patients 8. Update business associate agreements 9. Attest for the Security Risk Analysis MU \[meaningful use\] Objective." While each of those steps is important, the content provides little guidance for compliance with HIPAA Privacy and Security and HITECH Act Breach Notification Rules, and ONC does not have enforcement authority for them. The Guide does state on page 7: "\[t\]hese Meaningful Use requirements \[Core Objectives and Measures 12 and 15\] are not intended to supersede or substitute for compliance required under HIPAA. If you are a covered entity, you are still required to comply with the HIPAA Privacy and Security Rules." While the content in the Guide focuses on attaining and attesting to Privacy and Security related to Meaningful Use of Certified EHR Technology, the resources identified in this Guide in Chapter 5 are useful for assembling information on HIPAA Privacy, Security, and HITECH Act Breach Notification Rules. Again, other than for risk analysis guidance, the content in the Guide is insufficient for meaningfully attaining compliance with the HIPAA Privacy, Security, and HITECH Act Breach Notification Rules, particularly standards and implementation specifications, and should not be relied upon for that. In addition to the risk analysis, HIPAA Privacy and Security and HITECH Act Breach Notification compliance requires mitigating security risks, such as securing protected health information (PHI) from unauthorized access or use, *preparing and documenting administrative, physical, and technical policies and procedures for safeguarding PHI*, and *training* workforce members and designated representatives of business associates on those safeguards. We have covered these topics extensively on HIPAA.com and additional information is available at the HHS enforcement arm for privacy and security, the [Office for Civil Rights](http://www.hhs.gov/ocr/privacy/hipaa/understanding/coveredentities/index.html?ref=hipaa.com) (OCR). ### OCR Penalizes Physician Practice for HIPAA Privacy and Security Rule Violations URL: https://hipaa.com/ocr-penalizes-physician-practice-for-hipaa-privacy-and-security-rule-violations/ Last updated: 2012-04-18T19:03:13.000Z April 18, 2012\. Late last week, the Office for Civil Rights (OCR) of the Department of Health and Human Services (HHS) executed a [*Resolution Agreement*](http://www.hhs.gov/ocr/privacy/hipaa/enforcement/examples/pcsurgery%5Fagreement.pdf?ref=hipaa.com)and included *Corrective Action Plan* (Appendix A) as a settlement for violations of HIPAA Privacy and Security Rules by a physician practice, Phoenix Cardiac Surgery, P.C., of Phoenix and Prescott, AZ. In its April 17, 2012, [*News Release*](http://www.hhs.gov/news/press/2012pres/04/20120417a.html?ref=hipaa.com), HHS stated: "The incident giving rise to OCR's investigation was a report that the physician practice was posting clinical and surgical appointments for its patients on an Internet-based calendar that was publicly accessible. On further investigation, OCR found that Phoenix Cardiac Surgery had implemented few policies and procedures to comply with the HIPAA Privacy and Security Rules, and had limited safeguards in place to protect patients' electronic protected health information (ePHI). "'This case is significant because it highlights a multi-year, continuing failure on the part of this provider to comply with the requirements of the Privacy and Security Rules,' said Leon Rodriguez, director of OCR. 'We hope that health care providers pay careful attention to this resolution agreement and understand that the HIPAA Privacy and Security Rules have been in place for many years, and OCR expects full compliance no matter the size of a covered entity.' "OCR's investigation \[of Phoenix Cardiac Surgery\] also revealed the following issues: - Failed to implement adequate polices and procedures to appropriately safeguard patient information; - Failed to document that it trained any employees on its policies and procedures on the Privacy and Security Rules; - Failed to identify a security official and conduct a risk analysis; and - Failed to obtain business associate agreements with Internet-based email and calendar services where the provision of the service included storage of and access to its ePHI. "Under the HHS resolution agreement, Phoenix Cardiac Surgery has agreed to pay a $100,000 settlement amount and \[to\] a corrective action plan that includes a review of recently developed policies and other actions taken to come into full compliance with the Privacy and Security Rules." HIPAA.com recommends that the reader review the *Corrective Action Plan*, especially sections V. (Corrective Action Obligations: A. Policies and Procedures; B. Distribution and Updating of Policies and Procedures; C. Minimum Content of the Policies and Procedures; D. Training; and E. Reportable Events) on pages 7-10; VI. (Implementation Report) on pages 10-11; and VIII. (Breach Provisions: D. Imposition of CMP (civil money penalty) \["for any violations of the Privacy and Security Rules related to the Covered Conduct set forth in paragraph 2 of the Agreement and for any other act or failure to act that constitutes a violation of the Privacy or Security Rules"\]) on page 12\. As we have mentioned frequently in earlier posts, covered entities--and business associates after publication of the [Final Rules ](http://www.reginfo.gov/public/do/eAgendaViewRule?pubId=201110&RIN=0945-AA03&ref=hipaa.com)in the *Federal Register*\--will find it less onerous, costly, and time consuming *now* to conduct a risk analysis, implement policies and procedures for safeguarding protected health information, and train workforce members than under constraints of a possible *Corrective Action Plan* *after* discovery of HIPAA Privacy or Security Rule violations from a compliance audit, complaint investigation, or breach. ### HHS Publishes NPRM for HIPAA Health Plan Identifier and Delay for ICD-10 Compliance Date URL: https://hipaa.com/hhs-publishes-nprm-for-hipaa-health-plan-identifier-and-delay-for-icd-10-compliance-date/ Last updated: 2012-04-17T15:52:55.000Z **April 17, 2012**. The Office of the Secretary of the Department of Health and Human Services (HHS) published today in the *Federal Register* its Notice of Proposed Rule Making (NPRM): [Administrative Simplification: Adoption of a Standard for a Unique Health Plan Identifier; Addition to the National Provider Identifier Requirements; and a Change to the Compliance Date for ICD-10-CM and (CD-10-PCS Medical Data Code Sets.](http://www.gpo.gov/fdsys/pkg/FR-2012-04-17/pdf/2012-8718.pdf?ref=hipaa.com) From the NPRM is the *Summary of the Major Provisions:* "a. HPID. This rule proposes the adoption of the HPID \[national unique health plan identifier\] as the standard for the unique identifier for health plans and definitions for 'Controlling Health Plan' and 'Subhealth Plan.' The proposed definitions of these two terms seek to differentiate between health plan entities that would be required to obtain an HPID, and those that would be eligible, but not required, to obtain an HPID. This rule also proposes to require all covered entities to use an HPID whenever a covered entity identifies a health plan in a covered transaction. Because health plans today have many different business structures and arrangements that affect how health plans are identified in standard transactions, these two proposed definitions also seek to enable health plans to obtain HPIDs to reflect differing business arrangements so they can be identified appropriately in standard transactions. "This rule also proposes the adoption of a data element that would serve as an other entity identifier (OEID). The OEID would serve as an identifier for entities that are not health plans, health care providers, or 'individuals' (as defined in 45 CFR 160.103), but that need to be identified in standard transactions (including, for example, third party administrators, transaction vendors, clearinghouses, and other payers). Under this proposed rule, these other entities would not be required to obtain an OEID, but they could obtain and use one if they needed to be identified in covered transactions. Because other entities are identified in standard transactions in a similar manner as health plans, we believe that establishing a data element to serve as an identifier for these entities will increase efficiency by encouraging the use of a uniform identifier. "The most significant benefit of the HPID and the OEID is that they will increase standardization within HIPAA standard transactions by establishing uniform identifiers. "b. NPI. This rule purpose that an organization covered health care provider require certain non covered individual health care providers who are prescribers to: (1) Obtain NPIs \[National Provider Identifiers\] and; (2) to the extent the prescribers write prescriptions while acting within the scope of the prescribers' relationship with the organization, disclose them to any entity that needs the NPIs to identify the prescribers in standard transactions. This addition to the NPI requirements would address the issue that pharmacies are encountering when the NPI of a prescribing health care provider needs to be included on a pharmacy claim, but the prescribing health care provider does not have, or has not disclosed an NPI. "c. ICD-10-CM and ICD-10-PCS. This rule proposes that the compliance date for ICD-10-CM and ICD-10-PCS be changed from October 1, 2013 to October 1, 2014\. We believe this change will give covered entities the additional time needed to synchronize system and business process preparation and changeover to the updated medical data code sets." HHS invites comments on this NPRM, to be received no later than 5 PM on Thursday, May 17, 2012\. Instructions for submitting comments are provided in the NPRM on page 22950. ### HHS Issues HIPAA NPRM for Unique Health Plan Identifier and One Year Delay for ICD-10 Code Set Compliance URL: https://hipaa.com/hhs-issues-hipaa-nprm-for-unique-health-plan-identifier-and-one-year-delay-for-icd-10-code-set-compliance/ Last updated: 2012-04-11T12:12:18.000Z **April 10, 2012**. Yesterday, the Office of the Secretary of the Department of Health and Human Services (HHS) promulgated a notice of proposed rule making (NPRM) entitled: [*Administrative Simplification: Adoption of a Standard for a Unique Health Plan Identifier; Addition to the National Provider Identifier Requirements; and a Change to the Compliance Date for ICD-10-CM and ICD-10-PCS Medical Data Code Sets*](http://www.ofr.gov/OFRUpload/OFRData/2012-08718%5FPI.pdf?ref=hipaa.com)*.* The NPRM will be published in the *Federal Register* on April 17, 2012. Here is the NPRM summary: "This proposed rule would implement section 1104 of the Patient Protection and Affordable Care Act (hereinafter referred to as the Affordable Care Act) by establishing new requirements for administrative transactions that would improve the utility of the existing Health Insurance Portability and Accountability Act of 1996 (HIPAA) transactions and reduce administrative burden and costs. It proposes the adoption of the standard for a national unique health plan identifier (HPID) and requirements or provisions for the implementation of the HPID. This rule also proposes the adoption of a data element that will serve as an other entity identifier (OEID), an identifier for entities that are not health plans, health care providers, or 'individuals,' that need to be identified in standard transactions. This proposed rule would also specify the circumstances under which an organization covered health care provider must require certain noncovered individual health care providers who are prescribers to obtain and disclose an NPI \[National Provider Identifier\]. Finally, this rule proposes to change the compliance date for the International Classification of Diseases, 10th Revision, Clinical Modification (ICD-10-CM) for diagnosis coding, including the Official ICD-10-CM Guidelines for Coding and Reporting, and the International Classification of Diseases, 10th Revision, Procedure Coding System (ICD-10-PCS ) for inpatient hospital procedure coding, including the Official ICD-10-PCS Guidelines for Coding and Reporting, from October 1, 2013 to October 1, 2014." Comments on the NPRM may be submitted to HHS up to 30 days from the April 17, 2012, *Federal Register* publication of the NPRM. HHS has indicated that ["\[w\]hen made final, the effective date of this regulation would be October 1, 2012."](http://www.cms.gov/apps/media/press/factsheet.asp?Counter=4332&intNumPerPage=10&checkDate=&checkKey=&srchType=1&numDays=3500&srchOpt=0&srchData=&keywordType=All&chkNewsType=6&intPage=&showAll=&pYear=&year=&desc=&cboOrder=date&ref=hipaa.com) ### Finally, HIPAA/HITECH Act Privacy, Security, Breach Notification, Enforcement Final Rules at OMB URL: https://hipaa.com/finally-hipaahitech-act-privacy-security-breach-notification-enforcement-final-rules-at-omb/ Last updated: 2012-03-25T00:00:26.000Z **March 24, 2012**. Today, the [Office of Information and Regulatory Affairs at the Office of Management and Budget](http://www.reginfo.gov/public/do/eoReviewSearch?ref=hipaa.com) (OMB) in the Executive Office of the President showed that it had received the much-delayed Department of Health and Human Services (HHS) Office for Civil Rights (OCR) Final Rules entitled: Modifications to the HIPAA Privacy, Security, Enforcement, and Breach Notification Rules ([RIN: 0945-AA03](http://www.reginfo.gov/public/do/eAgendaViewRule?pubId=201110&RIN=0945-AA03&ref=hipaa.com)). Following review by OMB, the rules will be published in the *Federal Register,* most likely in April if OMB's review is timely. The Abstract of the Rules reads: "The Department of Health and Human Services Office for Civil Rights will issue final rules to modify the HIPAA Privacy, Security, Enforcement, and Breach Notification Rules as necessary to implement the privacy, security, enforcement, and breach notification provisions of Subtitle D of the Health Information Technology for Economic and Clinical Health Act (Title XIII of the American Recovery and Reinvestment Act of 2009), and will modify the HIPAA Privacy Rule as required by section 105 of the Genetic Information Nondiscrimination Act \[GINA\] of 2008." For the provisions of the HITECH Act underpinning the modifications, see [Subtitle D (123 STAT. 258-279) ](http://www.gpo.gov/fdsys/pkg/PLAW-111publ5/pdf/PLAW-111publ5.pdf?ref=hipaa.com)and for the provisions underpinning [GINA, see 42 USC 1320d-9](http://www.gpo.gov/fdsys/search/citation2.result.USCODE.action?unitedStatesCode.year=2009&unitedStatesCode.title=42&unitedStatesCode.granuleClass=1&unitedStatesCode.sectionNumber=1320d-9&publication=USCODE&ref=hipaa.com). As we have reported in previous postings, OCR privacy and security audits are underway, and privacy and security breaches impacting 500 or more individuals, required to be publicly disclosed on [OCR's Web site](http://www.hhs.gov/ocr/privacy/hipaa/administrative/breachnotificationrule/breachtool.html?ref=hipaa.com), continue to grow. As of today, 409 breaches have impacted 19,168,745 individuals from September 22, 2009 through February 11, 2012\. About 18.5 percent of all of those breaches involve business associates, who will be required to implement the HIPAA Security Rule just as covered entities are required under HIPAA today. About 60 percent of all of those breaches involve electronic devices or media. Over 91 percent of theft and losses of electronic devices or media involve laptops or other portable electronic devices. Presumably, with compliance audits and significantly increased financial penalties for non-compliance, release now of the modified Final Rules will heighten attention by covered entities to achieve privacy and security compliance and to avoid a privacy or security breach by encrypting protected health information (PHI) on laptops and other portable electronic devices (e.g., smart phones and tablets). HIPAA.com will have a series of postings on these Final Rules beginning when they are published in the *Federal Register*. ### BCBST Pays $1.5 Million to HHS to Settle Potential HIPAA Privacy and Security Violations URL: https://hipaa.com/bcbst-pays-1-5-million-to-hhs-to-settle-potential-hipaa-privacy-and-security-violations/ Last updated: 2012-03-15T23:50:09.000Z On March 13, 2012, Blue Cross Blue Shield of Tennessee (BCBST) agreed to a payment of $1.5 million to the Department of Health and Human Services (HHS) and to a *corrective action plan* as part of a [Resolution Agreement](http://www.hhs.gov/ocr/privacy/hipaa/enforcement/examples/bcbstagrmnt.html?ref=hipaa.com) with HHS for potential violation of Health Insurance Portability and Accountability Act (HIPAA) Privacy and Security Rule violations. According to a [HHS Press Release](http://www.hhs.gov/news/press/2012pres/03/20120313a.html?ref=hipaa.com) of the same date, "the enforcement action \[by HHS' Office for Civil Rights (OCR)\] is the first resulting from a breach report required by the Health Information Technology for Economic and Clinical Health (HITECH) Act Breach Notification Rule." According to the HHS Press Release: "The investigation followed a notice submitted by BCBST to HHS reporting that 57 unencrypted computer hard drives were stolen from a leased facility in Tennessee. The drives contained the protected health information (PHI) of over 1 million individuals, including member names, social security numbers, diagnosis codes, dates of birth, and health plan identification numbers. OCR's investigation indicated BCBST failed to implement appropriate administrative safeguards to adequately protect information remaining at the leased facility by not performing the required security evaluation in response to operational changes. In addition, the investigation showed a failure to implement appropriate physical safeguards by not having adequate facility access controls; both of these safeguards are required by the HIPAA Security Rule. "'This settlement sends an important message that OCR expects health plans and health care providers to have in place a carefully designed, delivered, and monitored HIPAA compliance program,' said OCR Director Leon Rodriguez. 'The [HITECH \[Act\] Breach Notification Rule](http://edocket.access.gpo.gov/2009/pdf/E9-20169.pdf?ref=hipaa.com) is an important enforcement tool and OCR will continue to vigorously protect patients' right to private and secure health information.'" In Appendix A (Corrective Action Plan) to the Resolution Agreement, pay particular attention to the provisions of Section VI (Corrective Action Obligations): A. Policies and Procedures B. Distribution and Updating of Policies and Procedures C. Minimum Content of the Policies and Procedures and Reportable Events D. Training E. Monitoring The content of these provisions provides excellent guidance on procedures underpinning compliance efforts and consequences of non-compliance. 20120315 ### ONC Publishes Stage 2 EHR Technology Certification Criteria NPRM URL: https://hipaa.com/onc-publishes-stage-2-ehr-technology-certification-criteria-nprm/ Last updated: 2012-03-09T15:05:05.000Z On March 7, 2012, the Office of the National Coordinator for Health Information Technology (ONC) of the Department of Health and Human Services (HHS) published in the **Federal Register** its notice of proposed rule making (NPRM) entitled [*Health Information Technology: Standards, Implementation Specifications, and Certification Criteria for Electronic Health Record* \[EHR\] ](http://www.gpo.gov/fdsys/pkg/FR-2012-03-07/pdf/2012-4430.pdf?ref=hipaa.com)[*Technology, 2014 Edition; Revisions to the Permanent Certification Program for Health Information Technology*](http://www.gpo.gov/fdsys/pkg/FR-2012-03-07/pdf/2012-4430.pdf?ref=hipaa.com)\[pp. 13832-13885\]. Comments to HHS may be made until 5 PM on May 7, 2012. The summary of the NPRM is included here: "Under section 3004 of the Public Health Service Act, the Secretary of Health and Human Services is proposing to revise the initial set of standards, implementation specifications, and certification criteria adopted in an interim final rule published on January 13, 2010, and a subsequent [final rule that was published on July 28, 2010](http://edocket.access.gpo.gov/2010/pdf/2010-17210.pdf?ref=hipaa.com), as well as to adopt new standards, implementation specifications, and certification criteria. The proposed new and revised certification criteria would establish the technical capabilities and specify the related standards and implementation specifications that Certified Electronic Health Record (EHR) Technology would need to include to, at a minimum, support the achievement of meaningful use by eligible professionals \[EPs\], eligible hospitals, and critical access hospitals \[CAHs\] under the Medicare and Medicaid EHR Incentive Programs beginning with the EHR reporting periods in fiscal year and calendar year 2014\. This notice of proposed rule making also proposes revisions to the permanent certification program for health information technology, which includes changing the program's name." \[p. 13832\] The NPRM also provides an *Overview of the 2014 Edition EHR Certification Criteria*, an excerpt of which is provided here: "We propose to adopt certification criteria that will support the proposed changes to the EHR Incentive Programs, including the new and revised objectives and measures for Stages 1 and 2 of MU \[meaningful use\] proposed by CMS \[see preceding HIPAA.com posting\]. The certification criteria we propose for adoption would also enhance care coordination, patient engagement, and the security, safety, and efficacy of EHR technology. For clarity, we refer to the certification criteria proposed for adoption as the 2014 Edition EHR certification criteria and the currently adopted certification criteria as the 2011 Edition EHR certification criteria...." \[p.13833\] HIPAA.com has focused especially on privacy and security issues related to safeguarding protected health information (PHI). We commend the reader's attention to the content in two sections of the NPRM: **45 CFR 170.210(e)**: Standards for health information technology to protect electronic health information created, maintained, and exchanged--(e) *Record actions related to electronic health information, audit log status, and encryption of end-user devices*. \[p. 13880\] **45 CFR 170.314(d)**: 2014 Edition electronic health record certification criteria--*(d) Privacy and security*: (1) *Authentication, access control, and authorization.* (2) *Auditable events and tamper-resistance.* (3) *Audit report(s).* (4) *Amendments.* (5) *Automatic log-off.* (6) *Emergency access.* (7) *Encryption of data at rest.* (8) *Integrity.* (9) *Optional--accounting of disclosures.* \[p. 13883\] ### CMS Publishes Stage 2 Meaningful Use Incentive Program NPRM URL: https://hipaa.com/cms-publishes-stage-2-meaningful-use-incentive-program-nprm/ Last updated: 2012-03-08T15:45:31.000Z On March 7, 2012, the Centers for Medicare & Medicaid Services (CMS) published in the *Federal Register* its 132-page notice of proposed rule making (NPRM): [Medicare and Medicaid Programs; Electronic Health Record Incentive Program--Stage 2](http://www.gpo.gov/fdsys/pkg/FR-2012-03-07/pdf/2012-4443.pdf?ref=hipaa.com). Comments to the Department of Health and Human Services (HHS) may be made until 5 PM on May 7, 2012. The summary of the NPRM is included here: "This proposed rule would specify the Stage 2 criteria that eligible professionals (EPs), eligible hospitals, and critical access hospitals (CAHs) must meet in order to qualify for Medicare and/or Medicaid electronic health record (EHR) incentive payments. In addition, it would specify payment adjustments under Medicare for covered professional services and hospital services provided by EPs, eligible hospitals, and CAHs failing to demonstrate meaningful use of certified EHR technology and other program participation requirements. This proposed rule would also revise certain Stage 1 criteria, as well as criteria that apply regardless of Stage, as finalized in the final rule titled [Medicare and Medicaid Programs; Electronic Health Record Incentive Program](http://edocket.access.gpo.gov/2010/pdf/2010-17207.pdf?ref=hipaa.com) published on July 28, 2010 in the **Federal Register**. The provisions included in the Medicaid section of this proposed rule (which relate to calculations of patient volume and hospital eligibility) would take effect shortly after finalization of this rule, not subject to the proposed 1 year delay for Stage 2 of meaningful use of certified EHR technology. Changes to Stage 1 of meaningful use would take effect for 2013, but most would be optional until 2014." \[p.13698\] The NPRM also summarizes *Stage 2 Meaningful Use Objectives and Measures*: "In the Stage 1 final rule we outlined Stage 1 criteria, we finalized a separate set of core objectives and menu objectives for both EPs and eligible hospitals and CAHs. EPs and hospitals must meet or qualify for an exclusion to all of the core objectives and 5 out of the 10 menu measures in order to qualify for an EHR incentive payment. In this proposed rule, we propose to maintain the same core-menu structure for the program for Stage 2\. We propose that EPs must meet or qualify for an exclusion to 17 core objectives and 3 of 5 menu objectives. We propose that eligible hospitals and CAHs must meet or qualify for an exclusion to 16 core objectives and 2 of 4 menu objectives. Nearly all of the Stage 1 core and menu objectives would be retained for Stage 2\. The 'exchange of key clinical information' core objective from Stage 1 would be re-evaluated in favor of a more robust 'transitions of care' core objective in Stage 2, and the 'Provide patients with an electronic copy of their health information' objective would be removed because it would be replaced by an 'electronic/online access' core objective. There are also multiple Stage 1 objectives that would be combined into more unified Stage 2 objectives, with a subsequent rise in the measure threshold that providers must achieve for each objective that has been retained from Stage 1." \[p. 13700\] HIPAA.com has focused especially on privacy and security issues related to safeguarding protected health information (PHI). Both Stage 1 and proposed Stage 2 retain as unchanged the 42 CFR 495.6 "protection" core objective: "Protect electronic health information created or maintained by the Certified EHR Technology through the implementation of appropriate technical capabilities." \[pp. 13819 for EPs and 13821 for eligible hospitals and CAHs\] However, the corresponding measures for EPs and for eligible hospitals and CAHs have been amended under the Stage 2 proposal, with the proposed amendment underlined below and combined for EPs and hospitals: "Conduct or review a security risk analysis in accordance with the requirements under 45 CFR 164.308(a)(1) \[security management process *standard*\], including addressing the encryption/security of data at rest in accordance with requirements under 45 CFR 164.312(as)(2)(iv) and 45 CFR 164.306(d)(3) , and implement security updates as necessary and correct identified security deficiencies as part of the EP's or of the eligible hospital's or CAH's risk management process." The Stage 2 NPRM provides an explanation for the proposed amendment: "This measure is the same as in Stage 1 except that we specifically address the encryption/security of data that is stored in Certified EHR Technology (data at rest). Dure to the number of breaches reported to HHS involving lost or stolen devices, the HIT Policy Committee recommended specifically highlighting the importance of an entity's reviewing its encryption practices as part of its risk analysis. We agree that this is an area of security that appears to need specific focus. Recent HHS analysis of reported breaches indicates that almost 40 percent of large breaches involve lost or stolen devices. Had these devices been encrypted, their data would have been secured. It is for these reasons that we specifically call out this element of the requirements under 45 CFR 164.308(a)(1) for the meaningful use measure. We do not propose to change the HIPAA Security Rule requirements, or require any more than would be required under HIPAA. We only emphasize the importance of an EP or hospital including in its security risk analysis an assessment of the reasonableness and appropriateness of encrypting electronic protected health information as a means of securing it, and where it is not reasonable and appropriate, the adoption of an equivalent alternative measure. "We propose this measure because the implementation of Certified EHR Technology has privacy and security implications under 45 CFR 164.308(a)(1). A review must be conducted for each EHR reporting period and any security updates and deficiencies that are identified should be included in the provider's risk management process and implemented or corrected as dictated by that process." \[pp. 13716-13717\] The importance of this focus on encryption if illustrated, as noted above, by the latest data on large breaches of 500 or more impacted individuals, as made publicly available on the [HHS Office for Civil Rights (OCR) Web page](http://www.hhs.gov/ocr/privacy/hipaa/administrative/breachnotificationrule/breachtool.html?ref=hipaa.com) as required by the HITECH Act: As of March 8, 2012, 400 breaches have impacted 19,137,957 individuals since publication began on September 22, 2009, covering the period from that date through January 17, 2012\. Approximately 3 out of 4 breaches involve electronic devices and of those, 60% are laptops or other portable electronic devices, of which 91% involve theft or loss. Clearly, the amended focus on encryption and securing PHI in this NPRM is warranted. Also warranted to help stem the large number of privacy and security breaches is the release of the delayed Final HIPAA/HITECH Act Privacy, Security, Breach Notification, and Enforcement \[Omnibus\] Rule, which the January 20, 2012, White House release of the [semi-annual regulatory agenda](http://www.reginfo.gov/public/do/eAgendaMain?ref=hipaa.com) for HHS indicates is scheduled for this month. Hopefully, its release is imminent and not further delayed. ### IFR for HIPAA EFT Standard to be Published in Federal Register January 10, 2012 URL: https://hipaa.com/ifr-for-hipaa-eft-standard-to-be-published-in-federal-register-january-10-2012/ Last updated: 2012-01-05T18:49:56.000Z HIPAA.com discussed in its preceding posting this Interim Final Rule (IFR) for "adoption of standards and operating rules for Electronic Funds Transfers (EFT) and operating rules for remittance advice...", as required by the Patient Protection and Affordable Care Act of 2010 ([Public Law 111-148](http://www.gpo.gov/fdsys/pkg/PLAW-111publ148/pdf/PLAW-111publ148.pdf?ref=hipaa.com)). \[124 STAT. 153\] The Office of Management and Budget (OMB) completed its [regulatory review](http://www.reginfo.gov/public/do/eAgendaViewRule?pubId=201104&RIN=0938-AQ11&ref=hipaa.com) on January 3, 2012, and the IFR is available for [pre-publication review](http://www.ofr.gov/OFRUpload/OFRData/2012-00132%5FPI.pdf?ref=hipaa.com) prior to January 10, 2012, when it will be published in the *Federal Register*. The title of the IFR is: *Administrative Simplification: Adoption of Standards for Health Care Electronic Funds Transfers (EFTs) and Remittance Advice*. The Summary in the pre-publication version states: "This interim final rule with comment period implements parts of section 1104 of the Affordable Care Act which requires adoption of a standard for electronic funds transfers (EFT). It defines EFT and explains how the adopted standards support and facilitate health care EFT transmissions." These standards relate to Administrative Simplification transactions under the Health Insurance Portability and Accountability Act of 1996 (HIPAA). Comments must be received by the Department of Health and Human Services (HHS) within 60 days of the publication date of the IFR, with instructions for submitting comments included in the front material of the IFR. The compliance date for the IFR is January 1, 2014. ### IFR for EFT at OMB URL: https://hipaa.com/ifr-for-eft-at-omb/ Last updated: 2011-12-16T16:43:18.000Z The Centers for Medicare & Medicaid Services (CMS) of the Department of Health and Human Services (HHS) has sent to the Office of Management and Budget (OMB) its Interim Final Rule (IFR) for "adoption of standards and operating rules for Electronic Funds Transfers (EFT) and operating rules for remittance advice...." Following the December 15 [receipt](http://www.reginfo.gov/public/do/eoReviewSearch;jsessionid=9f8e89cb30d6629880f6e52c48fba32eda59be7d2899.e34ObxiKbN0Sci0Lch8Ma3eKa30Re6fznA5Pp7ftolbGmkTy?ref=hipaa.com) and subsequent review of the IFR by OMB, the IFR is expected to be published in the *Federal Register* before January 1, 2012, as required by the Affordable Care Act of 2010 ([Public Law 111-148](http://www.gpo.gov/fdsys/pkg/PLAW-111publ148/pdf/PLAW-111publ148.pdf?ref=hipaa.com)). \[124 STAT. 153\] The legal authority for the IFR is Section 1104 (Administrative Simplification) of the Affordable Care Act. Section 1104 amends the Purpose of Administrative Simplification, as indicated in bold here: "To improve efficiency and effectiveness of the health care system, by encouraging the development of a health information system through the establishment of **uniform** standards and requirements for the electronic transmission of certain health information **and to reduce the clerical burden on patients, health care providers, and health plans**." \[124 STAT.146\] Section 1104 also requires that a new Administrative Simplification Electronic Funds Transfers Standard and Operating Rule be adopted on an effective date "not later than January 1, 2012, in a manner ensuring that such standard is effective not later than January 1, 2014," which may be "on an interim final basis." \[124 STAT. 153 and 149, respectively\] The compliance date for health plans is "not later than the effective date of the applicable standard or operating rule," which would be in this case December 31, 2013\. \[124 STAT. 150\] ### CMS Initiates 90-Day Enforcement Discretion for 5010 Compliance URL: https://hipaa.com/cms-initiates-90-day-enforcement-discretion-for-5010-compliance/ Last updated: 2026-10-24T21:32:55.000Z January 1, 2012, is the date for covered entities to achieve compliance with ASC X12 Version 5010, NCPDP Telecom D.0, and NCPDP Medicaid Subrogation 3.0 [transaction standards](http://www.cms.gov/Versions5010andD0?ref=hipaa.com). Covered entities include healthcare providers, health plans, and healthcare clearinghouses. Small health plans have until January 1, 2013, to comply with the NCPDP Medicaid Subrogation 3.0 standard. The Center for Medicare & Medicaid Services (CMS) Office of E-Health Standards and Services (OESS) is responsible for enforcement of compliance with electronic transaction standards. CMS [announced](http://www.cms.gov/ICD10/Downloads/CMSStatement5010EnforcementDiscretion111711.pdf?ref=hipaa.com) on November 17, 2011, that "\[w\]hile enforcement action will not be taken \[from January 1-March 31, 2012\], OESS will continue to accept complaints associated with compliance with Version 5010, NCPDP D.0 and NCPDP 3.0 transaction standards during the 90-day period.... If requested by OESS, covered entities that are the subject of complaints (known as 'filed-against entities') **must produce evidence of either compliance or a good faith effort to become compliant** with the new HIPAA \[version\] standards during the 90-day period." \[emphasis added\] CMS further stated: "OESS made the decision for a discretionary enforcement period based on industry feedback revealing that, with only about 45 days remaining before the January 1, 2012 compliance date, **testing between some covered entities and their trading partners has not yet reached a threshold whereby a majority of covered entities would be able to be in compliance by January 1**. \[emphasis added\] Feedback indicates that the number of submitters, the volume of transactions, and other testing data used as indicators of the industry's readiness to comply with the new standards have been low across some industry sectors. OESS has also received reports that many covered entities are still awaiting software upgrades." CMS also allowed a *near last minute compliance contingency period* in July 2003, just prior to the October 16, 2003, compliance date for the current version of HIPAA transaction standards. This allowance of a *contingency period* is counter to the discussion in the [5010 Final Rule](https://hipaa.com/content/files/2026/10/e9-740.pdf), given the degree of readiness as evidenced in the preceding paragraph, but understandable as many covered entities rely on ***outside*** vendors to provide software updates. At some point, and certainly not as long as the first contingency period, CMS will provide an announcement similar to what it issued on [August 4, 2005](http://www.zolldata.com/uploadedFiles/ZOLL%5FData%5FManagement/Products/CMSHIPAAContingencyDiscontinued.pdf?ref=hipaa.com): after a date certain, CMS "\[would\] not process incoming non-HIPAA-compliant electronic Medicare Claims." Nevertheless, covered entities (and their business associates) should not believe that the Office for Civil Rights (OCR), responsible for HIPAA privacy and security enforcement, would provide a similar *near last minute compliance contingency period* for the forthcoming [Omnibus HIPAA/HITECH Act Privacy, Security, Breach Notification, and Enforcement Rules](http://www.reginfo.gov/public/do/eAgendaViewRule?pubId=201104&RIN=0991-AB80&ref=hipaa.com), which OCR has indicated on several occasions would be published in the *Federal Register* by yearend 2011, with compliance expected 240 days after publication. We have discussed these Rules in recent HIPAA.com posts. Unlike the CMS-enforced transaction standards, the OCR-enforced privacy and security standards for safeguarding protected health information are **inside** responsibilities of management and Privacy and Security Officials of covered entities and their business associates that know their operational workflows best and can identify threats and vulnerabilities to electronic systems containing protected health information. The common element is that ultimately compliance is the obligation of the covered entity, and achieving timely compliance with transaction standards in early 2012 and privacy and security standards later in 2012 should be a strategic focus. ### OCR Announces November 2011 Start of Privacy and Security Compliance Audits URL: https://hipaa.com/ocr-announces-november-2011-start-of-privacy-and-security-compliance-audits/ Last updated: 2011-11-09T17:26:48.000Z The U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR) is responsible for privacy and security enforcement under Health Insurance Portability and Accountability Act ([HIPAA](http://www.hhs.gov/ocr/privacy/hipaa/administrative/index.html?ref=hipaa.com)) and Health Information Technology for Economic and Clinical Health (HITECH) Act provisions. OCR has announced that it is initiating *compliance audits* beginning this month, as authorized by the [HITECH Act](http://www.hhs.gov/ocr/privacy/hipaa/understanding/coveredentities/hitechact.pdf?ref=hipaa.com). This action precedes the imminent release of the [Final HIPAA/HITECH Act Privacy, Security, Breach Notification, and Enforcement Rules](http://www.reginfo.gov/public/do/eAgendaViewRule?pubId=201104&RIN=0991-AB80&ref=hipaa.com), expected before the end of 2011, and will strengthen [enforcement](http://www.hhs.gov/ocr/privacy/hipaa/enforcement/process/howocrenforces.html?ref=hipaa.com) and accountability for compliance with existing and forthcoming Rule modifications. To avoid the consequences of potential penalties for non-compliance, covered entities and business associates must now pay immediate attention to conducting a new or reviewing an existing [risk assessment](http://www.nist.gov/healthcare/security/hipaasecurity.cfm?ref=hipaa.com) of threat and vulnerability to protected health information (PHI), mitigating identified risks through privacy and security safeguard [policies and procedures](http://www.hipaarms.com/?ref=hipaa.com), [training](http://ama.hipaaschool.com/?ref=hipaa.com) their workforce members to safeguard privacy and security of PHI, and documenting those actions in writing. OCR describes its audit procedures on its [Web site](http://www.hhs.gov/ocr/privacy/hipaa/enforcement/audit/index.html?ref=hipaa.com), including providing a [sample letter of notification of audit](http://www.hhs.gov/ocr/privacy/hipaa/enforcement/audit/sample-ocr%5Fnotification%5Fltr.pdf?ref=hipaa.com). We reproduce here for your information a selection of the information available on that site: **"Overview:** The American Recovery and Reinvestment Act of 2009, in Section 13411 of the HITECH Act, requires HHS to provide for periodic audits to ensure covered entities and business associates are complying with the HIPAA Privacy and Security Rules and Breach Notification standards. To implement this mandate, OCR is piloting a program to perform up to 150 audits of covered entities to assess privacy and security compliance. Audits conducted during the pilot phase will begin November 2011 and conclude by December 2012. **Program Objectives:** The audit program serves as a new part of OCR’s health information privacy and security compliance program. OCR will use the audit program to assess HIPAA compliance efforts by a range of covered entities. Audits present a new opportunity to examine mechanisms for compliance, identify best practices and discover risks and vulnerabilities that may not have come to light through OCR’s ongoing complaint investigations and compliance reviews. OCR will broadly share best practices gleaned through the audit process and guidance targeted to observed compliance challenges via this web site and other outreach portals. **When Will Audits Begin?** The pilot audit program is a three-step process. The first step entailed developing the audit protocols. Next, a limited number of audits will be conducted in an initial wave to test these protocols. **OCR expects the initial audits to begin in November 2011** \[emphasis added\].The results of the initial audits will inform how the rest of the audits will be conducted. The last step will include conducting the full range of audits using revised protocol materials. All audits in this pilot will be completed by the end of December, 2012. **Who Will Be Audited? Every covered entity and business associate is eligible for an audit** \[emphasis added\]. Selections in the initial round will be designed to provide a broad assessment of a complex and diverse health care industry. OCR is responsible for selection of the entities that will be audited. OCR will audit as wide a range of types and sizes of covered entities as possible; covered individual and organizational providers of health services, health plans of all sizes and functions, and health care clearinghouses may all be considered for an audit. We expect covered entities to provide the auditors their full cooperation and support and remind them of their cooperation obligations under the HIPAA Enforcement Rule. Business Associates will be included in future audits. **How Will the Audit Program Work?** The privacy and security performance audit process will include generally familiar audit mechanisms. Entities selected for an audit will be informed by OCR of their selection and asked to provide documentation of their privacy and security compliance efforts. In this pilot phase, **every audit will include a site visit and result in an audit report** \[emphasis added\]. During site visits, auditors will interview key personnel and observe processes and operations to help determine compliance. Following the site visit, auditors will develop and share with the entity a draft report; audit reports generally describe how the audit was conducted, what the findings were and what actions the covered entity is taking in response to those findings. Prior to finalizing the report, the covered entity will have the opportunity to discuss concerns and describe corrective actions implemented to address concerns identified. The final report submitted to OCR will incorporate the steps the entity has taken to resolve any compliance issues identified by the audit, as well as describe any best practices of the entity. **What is the General Timeline for an Audit?** When a covered entity is selected for an audit, OCR will notify the covered entity in writing. The OCR notification letter will introduce the audit contractor, explain the audit process and expectations in more detail, and describe initial document and information requests. It will also specify how and when to return the requested information to the auditor. **OCR expects covered entities and business associates who are the subject of the audit to provide requested information within 10 business days of the request for information** \[emphasis added\]. OCR expects to notify selected covered entities between 30 and 90 days prior to the anticipated onsite visit. Onsite visits may take between 3 and 10 business days depending upon the complexity of the organization and the auditor’s need to access materials and staff. After fieldwork is completed, the auditor will provide the covered entity with a draft final report; a covered entity will have 10 business days to review and provide written comments back to the auditor. The auditor will complete a final audit report within 30 business days after the covered entity’s response and submit it to OCR. **What Happens After an Audit?** Audits are primarily a compliance improvement activity. OCR will review the final reports, including the findings and actions taken by the audited entity to address findings. The aggregated results of the audits will enable OCR to better understand compliance efforts with particular aspects of the HIPAA Rules. Generally, OCR will use the audit reports to determine what types of technical assistance should be developed, and what types of corrective action are most effective. Should an audit report indicate a serious compliance issue, OCR may initiate a compliance review to address the problem. OCR will not post a listing of audited entities or the findings of an individual audit, which clearly identifies the audited entity. **How Will Consumers Be Affected?** The audit program represents one more avenue by which OCR ensures compliance with HIPAA protections of health information to the benefit of consumers. For example, the audit program may uncover reasons many health information breaches are occurring and help OCR create tools for covered entities to better protect individually identifiable health information. Concerns about compliance identified and corrected by an audit will serve to improve the privacy and security of health records. The technical assistance and best practices that OCR generates will also assist covered entities and business associates in improving their efforts to keep health records safe and secure. OCR continues to accept complaints from individuals and covered entities continue to have the obligation to accept complaints from persons about their HIPAA Rule activities.**"** You may wish to visit the OCR audit Web page to view graphical timelines that are discussed but not shown here. Again, HIPAA.com recommends that covered entities and business associates ensure that they are able to demonstrate compliance by having readily available documented evidence of: a current risk assessment; implemented administrative, physical, and technical safeguard policies and procedures for mitigating risk to protected health information (PHI); and completed training of workforce members (including management) on those safeguards. ### HITECH Act Breached Individuals Skyrocket in Latest OCR Web Site Posting URL: https://hipaa.com/hitech-act-breached-individuals-skyrocket-in-latest-ocr-web-site-posting/ Last updated: 2011-11-04T15:09:51.000Z Under the Health Information Technology for Economic and Clinical Health Act ([HITECH Act](http://www.hipaasurvivalguide.com/hitech-act-text.php?ref=hipaa.com)), enacted as part of the American Recovery and Reinvestment Act of 2009, covered entities are required to report to the Secretary of the U.S. Department of Health and Human Services (HHS) any privacy or security breach affecting 500 or more individuals within 60 days of discovery of the breach by the covered entity or its business associate. The HHS Office for Civil Rights (OCR), which is responsible for privacy and security enforcement under the Health Insurance Portability and Accountability Act (HIPAA) and HITECH Act provisions that strengthened privacy and security enforcement, is required to post those breaches on its [Web site](http://www.hhs.gov/ocr/privacy/hipaa/administrative/breachnotificationrule/breachtool.html?ref=hipaa.com). On November 4, 2011, OCR reported a total of 364 such breaches, up from 345 in its previous post in October. The 364 breaches have impacted 18,190,451 persons in breaches reported by covered entities from September 22, 2009—the day prior to the effective date of the Breach Notification Rule—to September 14, 2011\. The increase of 6,230,963 impacted individuals represents a skyrocketing jump of just over 52% from the 11,959,488 accounted for in the October post of 345 breaches. Two breaches accounted for most of that increase: TRICARE Management Activity (Virginia) loss of backup tapes on September 13, 2011, impacting 5,117,799 individuals; and The Nemours Foundation (Florida) loss of backup tapes on August 10, 2011, impacting 1,055,489 individuals. The TRICARE breach also involved a business associate. Overall, just under 20% of the reported breaches involve a business associate. As HIPAA.com has reported before from an analysis of the breach data on the OCR Web site, 3 of 4 breaches involve electronic devices and media and 1 in 4 involve hard copy media, such as paper records and x-ray films. Of the electronic breaches, approximately 3 of 5 involve mobile or portable devices or media, but they represent over 92% of reported theft or loss in electronic breaches. The growing number of individuals affected by privacy and security breaches heightens the need by OCR to issue the [Final Privacy, Security, Breach Notification, and Enforcement Rules](http://www.reginfo.gov/public/do/eAgendaViewRule?pubId=201104&RIN=0991-AB80&ref=hipaa.com) and strengthen enforcement and accountability through compliance audits and complaint and breach investigations to ensure compliance with those Rules. Covered entities and business associates must pay more attention to conducting [risk assessments](http://www.nist.gov/healthcare/security/hipaasecurity.cfm?ref=hipaa.com) and mitigating risks through [privacy and security safeguard policies and procedures](http://www.hipaarms.com/?ref=hipaa.com), and especially [training](http://ama.hipaaschool.com/?ref=hipaa.com) their workforce members to safeguard electronic, hardware, devices, and media containing protected health information (PHI). From HIPAA.com's previous postings on breaches, you know that remediating breaches is costly, not only financially, but also in time, potential damage to reputation and customer goodwill, and lost business. The [Ponemon Institute](http://www.ponemon.org/blog/post/cost-of-a-data-breach-climbs-higher?ref=hipaa.com), a privacy and information management research firm, in March 2011, announced results of the sixth annual *U.S. Cost of a Data Breach Study*. According to this study, based on survey data, breach incidents cost U.S. companies $214 per compromised customer record (2010 data). Looking just a OCR's publicly disclosed 365 breaches, affecting nearly 18.2 million individuals, potentially the cost is just under $3.9 billion for remediation. The [August 3, 2011, ](http://www.healthdatamanagement.com/news/protected-health-information-data-breach-42935-1.html?ref=hipaa.com)*[HDM Breaking News](http://www.healthdatamanagement.com/news/protected-health-information-data-breach-42935-1.html?ref=hipaa.com)* article mentions that "\[t\]he cost to reduce the risk to protected health information before a breach can be as low as 10 percent of the cost to remediate a medium-sized breach." As the old automotive oil filter [TV ad](http://www.youtube.com/watch?v=aq3wL8ZXjBU&ref=hipaa.com) stated, "you can pay me now or pay me later." Investment now in HIPAA/HITECH Act privacy and security safeguards to minimize risk to PHI is a cost-effective and wise investment, especially in *ENCRYPTING YOUR PHI* on mobile and portable electronic devices and media with a high likelihood of being lost or stolen. ### HHS Extends Life of Temporary EHR Technology Certification Program URL: https://hipaa.com/hhs-extends-life-of-temporary-ehr-technology-certification-program/ Last updated: 2011-11-03T19:31:39.000Z The Office of the National Coordinator for Health Information Technology (ONC) of the Department of Health and Human Services (HHS) published a [notice](http://www.gpo.gov/fdsys/pkg/FR-2011-11-03/pdf/2011-28492.pdf?ref=hipaa.com) in the Thursday, November 3, 2011, *Federal Register* that extends the life of the "[temporary certification program](http://edocket.access.gpo.gov/2010/pdf/2010-14999.pdf?ref=hipaa.com) for health information technology" beyond its expected sunset date of December 31, 2011, to at least summer 2012\. "We believe that the sunset of the temporary certification programs \[ONC-Authorized Testing and Certification Bodies (ATCBs)\] should be tied to the effective date of the final rule that we intend to issue in summer 2012, which is expected to adopt new and revised standards, implementation specifications, and certification criteria for EHR technology in support of the next stage \[Stage 2\] of meaningful use under the [Medicare and Medicaid EHR Incentive Programs](http://www.cms.gov/ehrincentiveprograms/?ref=hipaa.com). We believe aligning the sunset of the temporary certification program with the effective date of this forthcoming final rule would provide certainty to health care providers, EHR technology developers, and other stakeholders, while also ensuring a sufficient number of accredited testing laboratories and \[[permanent certification program](http://edocket.access.gpo.gov/2011/pdf/2010-33174.pdf?ref=hipaa.com)\] ONC-ACBs \[Authorized Certification Bodies\] exist to meet market demand." ONC will publish a subsequent notice if there are "any changes to our expected sunset date for the temporary certification program." \[20111103\] ### HITECH Act Privacy and Security Final Rules Needed Now URL: https://hipaa.com/hitech-act-privacy-and-security-final-rules-needed-now/ Last updated: 2011-10-25T14:51:43.000Z Since September 23, 2009, the enforcement arm of the Department of Health and Human Services (HHS), the Office for Civil Rights (OCR), has been required to publicly disclose [breaches](http://www.hhs.gov/ocr/privacy/hipaa/administrative/breachnotificationrule/breachtool.html?ref=hipaa.com) involving 500 or more individuals discovered and reported by covered entities and their business associates. As of October 25, 2011, OCR has reported 345 such breaches involving a total of 11,959,488 individuals. Not reflected yet in the OCR disclosed breaches are two involving 6.5 million individuals: a [Nemours breach](http://www.healthdatamanagement.com/news/breach-hospital-notification-hipaa-privacy-43398-1.html?ref=hipaa.com) of 1.6 million individuals and a [TRICARE breach](http://www.govinfosecurity.com/articles.php?art%5Fid=4105&ref=hipaa.com) involving 4.9 million individuals. Together, these two recently reported breaches represent 54.4% of the total number of individuals affected by the publicly disclosed breaches by OCR over the past 25 months. OCR has indicated on several occasions this year that the final Omnibus Privacy, Security, Breach Notification, and Enforcement Rules will be published in the *Federal Register* by the [end of 2011](http://www.healthcare-informatics.com/ME2/dirmod.asp?sid=9B6FFC446FF7486981EA3C0C3CCE4943&nm=Articles%2FNews&type=Publishing&mod=Publications%3A%3AArticle&mid=8F3A7027421841978F18BE895F87F791&tier=4&id=0917E61C732343FA9846D0A12B4DF7C2&ref=hipaa.com). Documentation from the Office of Information and Regulatory Affairs (Reginfo.gov) of the Office of Management and Budget (OMB) shows the timetable for *final action* indicated a [September 2011](http://www.reginfo.gov/public/do/eAgendaViewRule?pubId=201104&RIN=0991-AB80&ref=hipaa.com) date, which is now past. What is taking so long to get these Final Rules released and published in the *Federal Register*? Since its enactment, HIPAA Privacy and Security Rules were characterized as having lax enforcement and accountability, and low financial penalties for non-compliance. Such an environment leads to complacency. That environment changed with enactment of toughened enforcement requirements and significant increased penalties in the HITECH Act, which HIPAA.com has discussed in earlier posts. Enforcement examples include extension of privacy and security requirements to and direct federal regulation of business associates, random compliance audits in addition to complaint and breach investigations, civil enforcement by state attorneys general in federal court, individual liability for certain violations, breach notification requirements, and guidance on securing protected health information. Although only one of several enforcement agreements this year, HHS’ July 2011 costly and onerous [*Resolution Agreement/Corrective Action Plan*](http://www.hhs.gov/ocr/privacy/hipaa/enforcement/examples/UCLAHSracap.pdf?ref=hipaa.com)with UCLA Health System, which requires that policies and procedures for safeguarding protected health information are in place and that workforce members are trained on those safeguards, is indicative of the severity of consequences to come for non-compliance with full enablement of the Omnibus Final Rules. HIPAA.com recommends that you read the provisions of the *Corrective Action Plan* to understand the extent of the risk assessment, policy and procedure documentation, and workforce safeguard training requirements. It is time to get the enabling Final Rules published in the *Federal Register*. Perhaps then, and certainly after expected compliance with the Rules is required in 2012, covered entities and their business associates will sharpen focus on safeguarding protected health information that is created, stored, in motion, or disposed of, thereby lessening the likelihood and consequences of breaches and detection of non-compliance via audits and investigations. HIPAA.com directs your attention to two recent October 2011 articles in *Government Health IT* that will help covered entities and their business associates address compliance issues and handle breach investigations. The [first article](http://govhealthit.com/news/3-tips-surviving-ocr-breach-investigation?ref=hipaa.com) is entitled: "3 Tips for surviving an OCR breach investigation." Titles of these tips are: 1\. Be prepared before an incident occurs; 2\. Educate the investigator; and 3\. Ask for help. The [second article](http://www.govhealthit.com/news/9-steps-take-during-ocr-data-breach-investigation?ref=hipaa.com) is entitled: "9 steps to take during an OCR data breach investigation." Titles of these steps are: 1\. Learn your HIPAA status; 2\. Get HIPAA/HITECH complaint; 3\. Get help; 4\. Determine who is financially responsible; 5\. Aim for an 'informal resolution' in an OCR investigation; 6\. Create a defensible response strategy; 7\. Don't flunk the 'attitude test'; 8\. Make a clean finish; and 9\. Exceed OCR's expectations if a settlement is required. HIPAA.com recommends that you access these articles and consider the advice under each tip and step. HIPAA.com reiterates a concluding paragraph from its preceding post, entitled *Get Ready Now for Toughened HIPAA/HITECH Act Privacy and Security Rules and Enforcement, and Big Noncompliance Fines*: Again, if your organization has not already done so, it is time to start or review your *risk assessment*, with guidance available from the National Institute of Standards and Technology ( [NIST](http://www.nist.gov/healthcare/security/hipaasecurity.cfm?ref=hipaa.com) ). Then, prepare, document, and retain your required [policies and procedures](http://www.hipaarms.com/?ref=hipaa.com) for safeguarding protected health information based on risk assessment outcomes. Finally, train your workforce members (including management) on HIPAA/HITECH Act privacy, security, and breach notification requirements, with information on online privacy, security, and breach notification *awareness and understanding* training and testing available at hipaa.com’s sister entity, [HIPAA School](http://www.hipaaschool.com/?ref=hipaa.com) , or, if you are a member of the American Medical Association, at [AMA HIPAA School](http://ama.hipaaschool.com/?ref=hipaa.com) . ### Get Ready Now for Toughened HIPAA/HITECH Act Privacy and Security Rules and Enforcement, and Big Noncompliance Fines URL: https://hipaa.com/get-ready-now-for-toughened-hipaahitech-act-privacy-and-security-rules-and-enforcement-and-big-noncompliance-fines/ Last updated: 2011-08-17T12:41:47.000Z The Health Insurance Portability and Accountability Act of 1996 (HIPAA) was enacted on August 21, 1996, as [Public Law 104-191](http://www.hhs.gov/ocr/privacy/hipaa/administrative/statute/index.html?ref=hipaa.com). HIPAA Administrative Simplification provisions in Subtitle F, Title II included transactions and code sets, privacy, security, and unique identifiers. Except for several identifiers, the federal government promulgated enabling regulations under the Administrative Procedure Act. For example, the Privacy Rule required compliance by healthcare providers, healthcare clearinghouses, and health plans—C*overed Entities*—by April 14, 2003, and the Security Rule required compliance by April 20, 2005, with small health plans for each rule having an additional year in which to comply. On February 17, 2009, the Health Information Technology for Economic and Clinical Health Act ([HITECH Act](http://www.hipaasurvivalguide.com/hitech-act-text.php?ref=hipaa.com)) was enacted as part of the so-called stimulus package known as the American Recovery and Reinvestment Act (Public Law 111-5). Enhanced privacy and security provisions—including extension of requirements to Business Associates of Covered Entities, specification of breach notification requirements for *unsecured* protected health information, and substantially increased penalties for noncompliance—were included in the HITECH Act. These provisions have been encapsulated in notices of proposed rulemaking and interim final rules. The federal government has indicated that Final Rules for Privacy, Security, Breach Notification, and Enforcement will be published in the *Federal Register* simultaneously—no later than the end of 2011, and expected in September as noted by the[ Office of Information and Regulatory Affairs](http://www.reginfo.gov/public/do/eAgendaViewRule?pubid=201104&RIN=0991-AB80&ref=hipaa.com) at the Office of Management and Budget (OMB), with [*HDM Breaking News*](http://www.healthdatamanagement.com/news/hhs-rules-semi-annual-regulatory-agenda-42755-1.html?ref=hipaa.com) on July 7, 2011, reporting that the Office for Civil Rights (OCR) at the Department of Health and Human Services (HHS) “confirms that anticipated timetable.” If so, and with compliance required by Covered Entities and Business Associates for privacy and security changes 240 days following publication, compliance would be required most likely in May 2012\. Note, that as interim final rules, breach notification requirements and enforcement penalties, already require compliance and are effective, respectively. On Sunday, August 21, 2011, we say *HAPPY 15th ANNIVERSARY, HIPAA!* We also note that, up until passage of the HITECH Act, the Congress was penurious in providing enforcement funding, the federal government was lax in delivering meaningful enforcement, even given the resources it had, and penalties were trivial for HIPAA violations. See the June 2, 2011, HHS news release, [*Security Gaps May Threaten Electronic Health Records*](http://oig.hhs.gov/newsroom/news-releases/2011/security.asp?ref=hipaa.com), which provides links to two Office of Inspector General reports. A measure of the laxity is the public disclosure of breaches since September 23, 2009, when public disclosure was required by regulation under the HITECH Act on [OCR's Web site](http://www.hhs.gov/ocr/privacy/hipaa/administrative/breachnotificationrule/HealthInfoBreaches.csv?ref=hipaa.com). As of August 17, 2011, there have been almost 11.6 million individuals impacted by 300 breaches affecting a minimum of 500 individuals per breach. Approximately 3 out of 4 of these breaches involve electronic media, the rest hard copy such as paper or film, and about 18% involve a business associate of a covered entity. In addition, [*HDM Breaking News*](http://www.healthdatamanagement.com/news/protected-health-information-data-breach-42935-1.html?ref=hipaa.com)on August 3, 2011, reported OCR has acknowledged that from inception of public disclosure in September 2009 through mid-May 2011, there have been 31,000 breaches affecting fewer than 500 individuals per breach, which only have to be reported to HHS annually. As a result of federal enforcement laxity, a large number of covered entities have been dismissive of or just given lip service to the need to invest in securing protected health information, including conducting risk assessments, developing policies and procedures for safeguarding such information, and training their workforce members on implementing and practicing those safeguard procedures. This is evidenced by the incidence of stolen mobile and portable electronic devices containing protected health information **that are not encrypted**, as shown by an analysis of the publicly disclosed breaches on the OCR Web site, studies in the literature, and anecdotally. HIPAA.com recommends that if you are working for or represent a Covered Entity or Business Associate that you review examples of *Corrective Action Plans* in [HHS Resolution Agreements](http://www.hhs.gov/ocr/privacy/hipaa/enforcement/examples/index.html?ref=hipaa.com), such as the *Corrective Action Plans Between the United States Department of Health and Human Services and the General Hospital Corporation and Massachusetts General Physicians Organization, Inc (February 14, 2011),* and *Between the United States Department of Health and Human Services and the Regents of the University of California (July 6, 2011)*. These *Corrective Action Plans* will give you an appreciation of required measures and strict timelines that you likely will face following a breach, complaint investigation, or compliance audit where it is determined that your business is not in compliance with HIPAA Privacy, Security, or Breach Notification Rules. Below, we provide excerpts from provisions of the referenced *Corrective Action Plan* (CAP) for UCLA Health System that is part of the [Regents of the University of California Resolution Agreement](http://www.hhs.gov/ocr/privacy/hipaa/enforcement/examples/UCLAHSracap.pdf?ref=hipaa.com): “III. Term of CAP The period of compliance obligations … shall begin on the Effective Date \[July 6, 2011\] and end three (3) years from the date of OCR’s approval of the Monitor Plan…. V. Corrective Action Obligations - **Policies and Procedures** 1. …Shall review, revise and maintain, as necessary, existing policies and procedures and develop, implement and maintain, as necessary, written policies and procedures related to the Covered Conduct that comply with the Federal standards \[under the Privacy and Security Rules\]. 2. …Shall provide such Policies and Procedures, consistent with paragraph 1 above, to HHS within 60 days of the Effective Date for review and approval. Upon receiving any recommended changes to such Policies and Procedures from HHS, …shall have 60 days to revise such Policies and Procedures accordingly and provide the revised Policies and Procedures to HHS for review and approval. 3. …Shall implement such Policies and Procedures within 60 days of receipt of HHS’ approval. - **Distribution and Updating of Policies and Procedures** 1. …Shall distribute the Policies and Procedures in section A to all members of its workforce who have access to protected health information within 30 days of HHS approval … and to new members of the workforce who have access to protected health information within 30 days of their beginning of service. 2. …Shall require, at the time of distribution of such Policies and Procedures, a signed written or electronic initial compliance certification from all members of the workforce who have access to protected health information, stating that the workforce members have read, understand or know where to seek information about and will abide by such Policies and Procedures. Such written or electronic certification must be received \[by the Covered Entity\]… within 30 days of any workforce member’s receipt of the Privacy Policies and Procedures and if such certification is not received that workforce member shall not be permitted to perform any services for \[the Covered Entity\] that involves protected health information until and unless such certification is received. 3. …Shall assess, update, and revise, as necessary, the Policies and Procedures at least annually and more frequently if appropriate. …Shall provide such revised Policies and Procedures to HHS for review and approval…. Within 30 days of the effective date of any approved substantive revisions, \[the Covered Entity\] shall distribute such revised Policies and Procedures to all members of its workforce who have access to protected health information, and shall require and obtain new compliance certifications from all members of its workforce who have access to protected health information. - **Minimum Content of the Policies and Procedures and Reportable Events** The Policies and Procedures shall include but not be limited to: 1. Instructions and procedures (a) that address permissible and impermissible uses and disclosures of protected health information by various categories of workforce members and (b) that address security awareness standards, information access management standards, workstation use standards, authorization and/or supervision standards and workforce clearance procedures. 2. Application of appropriate sanctions against members of the Covered Entity’s workforce who fail to comply with Policies and Procedures provided for in \[paragraph 1\] above. 3. Protocols for training all members of the Covered Entity’s workforce who have access to protected health information to ensure that they know how to comply with the Policies and Procedures provided for in \[paragraph 1\] above. - **Training** 1. All members of the workforce who have access to protected health information shall receive specific training related to the Policies and Procedures within 90 days of the implementation of the Policies and Procedures or within 30 days of their beginning as a member of the workforce. 2. Each individual workforce member who is required to attend training shall certify, in writing or in electronic form, that he or she has received the required training. The training certification shall specify the date training was received. All course materials shall be retained…. 3. …Shall review the training annually, and, where appropriate, update the training to reflect changes in federal law or HHS guidance, any issues discovered during audits or reviews, and any other relevant developments. 4. …Shall prohibit any member of its workforce from using, disclosing, or disposing of protected health information, if that workforce member has not completed the requisite training required by \[paragraph 1\] above.” In addition to the provisions outlined above, the *Corrective Action Plan* also requires that \[the Covered Entity\] “shall designate an individual or entity to be a monitor to review \[the Covered Entity’s\] compliance with this CAP,” and outline duties of the monitor, documentation retention requirements, and reporting schedules to HHS regarding fulfillment of the compliance obligations under the CAP. From previous postings on hipaa.com, you know that remediating breaches is costly, not only in financial terms, but also in time and potential damage to reputation and customer goodwill. The [Ponemon Institute](http://www.ponemon.org/blog/post/cost-of-a-data-breach-climbs-higher?ref=hipaa.com), a privacy and information management research firm, in March 2011, announced results of the sixth annual *U.S. Cost of a Data Breach Study*. According to this study, based on survey data, breach incidents cost U.S. companies $214 per compromised customer record (2010 data). Looking just at OCR’s publicly disclosed 300 breaches, affecting nearly 11.6 million individuals, potentially the cost is just under $2.5 billion for remediation. The August 3, 2011, *HDM Breaking News* article referenced earlier also mentions that “\[t\]he cost to reduce the risk to protected health information before a breach can be as low as 10 percent of the cost to remediate a medium-sized breach.” As the old automative oil filter [TV ad](http://www.youtube.com/watch?v=aq3wL8ZXjBU&ref=hipaa.com) stated, "you can pay me now or pay me later." Investment now in HIPAA/HITECH Act privacy and security safeguards to minimize risk to protected health information is a cost-effective and wise investment, especially with toughened enforcement and significantly higher financial penalties for noncompliance just around the corner. Again, if your organization has not already done so, it is time to start or review your *risk assessment*, with guidance available from the National Institute of Standards and Technology ([NIST](http://www.nist.gov/healthcare/security/hipaasecurity.cfm?ref=hipaa.com)). Then, prepare, document, and retain your required [*policies and procedures*](http://www.hipaarms.com/?ref=hipaa.com) for safeguarding protected health information based on risk assessment outcomes. Finally, train your workforce members (including management) on HIPAA/HITECH Act privacy, security, and breach notification requirements, with information on online privacy, security, and breach notification *awareness and understanding* training and testing available at hipaa.com's sister entity, [HIPAA School](http://www.hipaaschool.com/?ref=hipaa.com), or, if you are a member of the American Medical Association, at [AMA HIPAA School](http://ama.hipaaschool.com/?ref=hipaa.com). Final privacy, security, breach notification, and enforcement rules will be out soon and the time to achieve compliance--240 days from publication in the *Federal Register*\--is short. We recommend that you start now. ### HHS Publishes HITECH Act Accounting of Disclosures NPRM URL: https://hipaa.com/hhs-publishes-hitech-act-accounting-of-disclosures-nprm/ Last updated: 2011-05-31T12:38:36.000Z The Department of Health and Human Services (HHS) Office for Civil Rights (OCR) has published in the May 31, 2011, *Federal Register* the Notice of Proposed Rule Making (NPRM) entitled *HIPAA Privacy Rule Accounting of Disclosures Under the Health Information Technology for Economic and Clinical Health Ac*t (76(104), pp. 31426-31449). This NPRM is available online in [pdf](http://www.gpo.gov/fdsys/pkg/FR-2011-05-31/pdf/2011-13297.pdf?ref=hipaa.com). Comments on the NPRM are requested to be submitted on or before August 1, 2011\. The Summary of the NPRM with abbreviations, as noted, on p. 31426, is: "HHS is issuing this NPRM to modify the HIPAA Privacy Rule's standard for accounting of disclosures of protected health information. The purpose of these modifications is, in part, to implement the statutory requirement under the HITECH Act to require covered entities and business associates to account for disclosures of protected health information to carry out treatment, payment, and health care operations if such disclosures are through an electronic health record. Pursuant to both the HITECH Act and its more general authority under HIPAA, the Department \[HHS\] proposes to expand the accounting provision to provide individuals with the right to receive an access report indicating who has accessed electronic protected health information in a designated record set. Under its more general authority under HIPAA, the Department also proposes changes to the existing accounting requirements to improve their workability and effectiveness." There are several points worth noting in the NPRM. First, HHS includes "a direct reference to business associates in the standard to make clear that the covered entity must include accounting information for all disclosures by the covered entity's business associates that create, receive, maintain, or transmit **designated record set** information." \[p. 31430, emphasis added\] Second, "\[c\]overed entities must provide individuals with notices of privacy practices that detail how the covered entity may use and disclose protected health information and individuals' rights with respect to their own health information. Beginning on January 1, 2013, individuals would have the right to receive a report of who accessed their electronic protected health information that covers a three-year period from the date of the request. Covered entities would have to revise their privacy notices to reflect this change." \[p. 31445\] HHS estimates that 669,000 health care providers would have to revise and reissue their notices of privacy practices. Next, HHS is "proposing that covered entities (including small health plans) and business associates comply with the modifications to the accounting of disclosures requirement beginning 180 days after the effective date of the final regulation (240 days after publication \[in the *Federal Register*\]). We are proposing that covered entities and business associates provide individuals with a right to an access report beginning January 1, 2013, for electronic designated record set systems acquired after January 1, 2009, and beginning January 1, 2014, for electronic designated record set systems acquired as of January 1, 2009\. " \[p. 31429\]. Finally, HHS expects to review comments and publish the Accounting of Disclosures Final Rule by the end of 2011, which means that compliance with the accounting of disclosures requirement would begin sometime during the summer of 2012\. \[20110531\] ### OMB Clears HITECH Act Accounting of Disclosures NPRM URL: https://hipaa.com/omb-clears-hitech-act-accounting-of-disclosures-nprm/ Last updated: 2011-05-26T12:06:09.000Z The Department of Health and Human Services (HHS) Office for Civil Rights (OCR), responsible for enforcement of the HIPAA Privacy, Security, and Breach Notification Rules, will issue a Notice of Proposed Rule Making (NPRM) to modify the HIPAA Privacy Rule as necessary to implement the accounting of disclosures provisions of Section 13405(c) of the Health Information Technology for Economic and Clinical Health Act (HITECH Act) (Title XIII of the American Recovery and Reinvestment Act of 2009--Public Law 111-5). Section 13405(c) is entitled: *Accounting of Certain Protected Health Information Disclosures Required if Covered Entity Uses Electronic Health Record.* The NPRM was submitted on February 9, 2011, by HHS to the Office of Management and Budget (OMB) for clearance under Executive Order (EO) 12866 Regulatory Review, and was cleared by OMB on May 23, 2011\. Publication of the NPRM will be in the *Federal Register*. The HITECH Act statutory language is available at 123 STAT.265-266. ### Over 10 Million Individuals Now Affected by Large Data Breaches, as Reported on OCR Web site URL: https://hipaa.com/over-10-million-individuals-now-affected-by-large-data-breaches-as-reported-on-ocr-web-site/ Last updated: 2011-04-13T13:00:04.000Z Under the Health Information Technology for Economic and Clinical Health Act (HITECH Act), enacted as part of the American Recovery and Reinvestment Act of 2009, covered entities are required to report to the Secretary of the U.S. Department of Health and Human Services (HHS) any privacy or security breach affecting 500 or more individuals within 60 days of discovery of the breach by the covered entity or its business associate. The HHS Office for Civil Rights (OCR), which is responsible for privacy and security enforcement under the Health Insurance Portability and Accountability Act (HIPAA) and HITECH Act provisions that strengthened privacy and security enforcement, is required to [post those breaches on its Web site](http://www.hipaa.com/2011/03/nearly-8-3-million-individuals-impacted-by-249-privacy-and-security-breaches-reported-by-hhs-more-training-on-safeguarding-phi-required/www.hhs.gov/ocr/privacy/hipaa/administrative/breachnotificationrule/breachtool.html?ref=hipaa.com). As of April 4, 2011, OCR reported a total of 256 breaches have impacted 10,202,051 persons in breaches reported by covered entities from September 22, 2009—the day prior to the effective date of the Breach Notification Rule—to February 8, 2011\. One of seven newly posted breaches on the Web site put the number of affected individuals over 10 million: California-based Health Net, Inc. reported a breach affecting 1.9 million individuals on January 21, 2011 from an "unknown" type of breach and "other " location of breached information. Health Net issued a news release pertaining to this reported incident on March 14, 2011, which is [available online](http://healthnet.tekgroup.com/article%5Fdisplay.cfm?article%5Fid=5529&ref=hipaa.com). In that news release, Health Net indicated that a business associate, IBM, had notified Health Net that "it could not locate several server drives." Health Net is continuing to investigate the whereabouts of those drives and is offering affected parties several risk mitigation monitoring and insurance remedies to potential misuse of personal health information (PHI) identifiers and resultant consequences. The growing number of individuals affected by privacy and security breaches heightens the need by OCR to strengthen enforcement, and for covered entities and business associates to increase attention paid to compliance with HIPAA/HITECH Act privacy and security rules, especially training of workforce members to safeguard electronic, hardware, devices, and media containing PHI. ### Nearly 8.3 Million Individuals Impacted by 249 Privacy and Security Breaches Reported by HHS; More Training on Safeguarding PHI Required URL: https://hipaa.com/nearly-8-3-million-individuals-impacted-by-249-privacy-and-security-breaches-reported-by-hhs-more-training-on-safeguarding-phi-required/ Last updated: 2011-03-22T12:47:00.000Z Under the Health Information Technology for Economic and Clinical Health Act (HITECH Act), enacted as part of the American Recovery and Reinvestment Act of 2009, covered entities are required to report to the Secretary of the U.S. Department of Health and Human Services (HHS) any privacy or security breach affecting 500 or more individuals within 60 days of discovery of the breach by the covered entity or its business associate. The HHS Office for Civil Rights (OCR), which is responsible for privacy and security enforcement under the Health Insurance Portability and Accountability Act (HIPAA) and HITECH Act provisions that strengthened privacy and security enforcement, is required to [post those breaches on its Web site](www.hhs.gov/ocr/privacy/hipaa/administrative/breachnotificationrule/breachtool.html). As of March 17, 2011, OCR had posted on its Web site 249 breaches that had impacted 8,289,236 individuals reported by covered entities. [\[1\]](#%5Fftn1) The dates of these breaches ranged from September 22, 2009—the day prior to the effective date of the Breach Notification Rule—to January 12, 2011\. Forty-eight cases reported by covered entities—19.3%--were breaches that involved a business associate. Excluding 12 breaches without identifying information, approximately 75% (177) of the total involved *electronic* protected health information (PHI) and 25% (58) *hard copy* formatted PHI. Several reported breaches involved electronic *and* hard copy formatted PHI. With regard to type of breach, there were 24 of 249 reported breaches without sufficient detail. Of the remainder, 139 breaches, or just about 62%, involved theft, and 37 breaches, or just over 16%, involved loss. Together, theft and loss accounted for 168 reported breaches, or just over 78% of the total number of breaches that impacted 500 or more individuals per incident. The remaining types of the most prevalent breaches included unauthorized access (38), hacking (22), and improper disposal (14). Twenty-five of reported breaches involved a combination of types. With regard to the 177 privacy and security breaches involving electronic PHI, 104, or approximately 59%, involved laptops and portable electronic devices (PEDs)—not otherwise identified. *All but 4 of these reported breaches of laptops and PEDs involved theft or loss.* These breaches should not be occurring! On August 24, 2009, HHS issued its Interim Final Rule on Breach Notification, which included *Guidance Specifying the Technologies and Methodologies that Render Protected Health Information Unusable, Unreadable, or Indecipherable to Unauthorized Individuals*. This Guidance identifies readily available safeguards—encryption processes and disposal methods—for securing PHI. It is either through indifference to or neglect of implementing encryption safeguards on portable and mobile electronic devices that unnecessary costs of breach notification are being incurred by covered entities and their business associates that breach *unsecured* electronic PHI. Those costs do not include costs borne by individuals impacted by breach, and costs related to loss of business and reputation and to required mitigation by the breaching party. Covered entities and business associates must take greater responsibility to safeguard PHI, starting with more emphasis on training their workforce members who work with PHI.[\[2\]](#%5Fftn2) The HITECH Act increased financial penalties for noncompliance from $100 for a single violation to $50,000, and the maximum for a repeat of a single violation in a calendar year from $25,000 to $1.5 million. In addition, the HITECH Act provided for compliance audits[\[3\]](#%5Fftn3) in addition to complaint investigations. As a result, the likelihood of discovery of noncompliance and the financial consequences of such discovery—especially of *willful neglect-not corrected*—are raised considerably now under the Breach Notification Interim Final Rule for covered entities and business associates, and will be enhanced even further with simultaneous release of final HITECH Act privacy, security, and breach notification rules in 2011[\[4\]](#%5Fftn4) that extend privacy and security obligations to business associates of covered entities and to sub-contractors of business associates. Indicative of the forthcoming tightening of HIPAA and HITECH Act privacy and security enforcement is the commentary of OCR Director Georgina Verdugo in the News Release pertaining to the Resolution Agreement whereby Massachusetts General Hospital agreed to pay $1 million to settle Potential HIPAA Privacy Rule violations.[\[5\]](#%5Fftn5) Note the following commentary: “’We hope the health care industry will take a close look at this agreement and recognize that OCR is serious about HIPAA enforcement. It is a covered entity’s responsibility to protect its patients’ health information.’ … “’To avoid enforcement penalties, covered entities must ensure they are always in compliance with the HIPAA Privacy and Security Rules.’ ... ‘A robust compliance program includes employee **training**, vigilant implementation of policies and procedures, regular internal audits, and a prompt action plan to respond to incidents.’” \[emphasis added\] Ed Jones \[20110318\] [\[1\]](#%5Fftnref) As of the end of 2010, OCR had received more than 14,000 reports of smaller breach incidents (fewer than 500 impacted individuals). See “Federal Audits Still in Development,” *Healthcare Info Security*, February 22, 2011, which is available online [here](www.healthcareinfosecurity.com/articles.php?art%5Fid=3373). [\[2\]](#%5Fftnref) For example, “one-third of recently surveyed physician practices and 14 percent of surveyed hospitals do not conduct a regular security risk analysis of their electronic health information.” See “Survey Details the Security Landscape,” *HDM Breaking News*, November 5, 2010\. The risk analysis is the foundation of preparing safeguard policies and procedures and initiating a meaningful training program for workforce members on "awareness and understanding" of and abiding by those policies and procedures. [\[3\]](#%5Fftnref) “OCR, which hired the consulting firm Booz Allen Hamilton to help design the auditing program, ‘is still working through what will give us the most bang for the buck,’ Greene said. For example, it’s still weighing whether to audit a random sample of healthcare organizations or ‘going wider,’ he said.” Statement of Adam Greene, senior health IT and privacy advisor in OCR, on February 21, 2011\. See “Federal Audits Still in Development,” *Healthcare Info Security*, February 22, 2011, which is available online [here](www.healthcareinfosecurity.com/articles.php?art%5Fid=3373). [\[4\]](#%5Fftnref) Statement of Adam Greene, senior health IT and privacy advisor in OCR, on February 21, 2011\. See Greg Gillespie, “OCR Plans to Tighten Up HITECH Privacy, Security, Breach Regs,” *HDM Breaking News*, February 21, 2011, which is available online [here](www.healthdatamanagement.com/news/hitech-rule-privacy-security-breach-41985-1.html). [\[5\]](#%5Fftnref) See HHS, “Massachusetts General Hospital Settles Potential HIPAA Violations,” news release, February 24, 2011, which is available online [here](www.hhs.gov/news/press/2011pres/02/20110224b.html). ### Permanent HIT Certification Final Rule Published by ONC in Federal Register URL: https://hipaa.com/permanent-hit-certification-final-rule-published-by-onc-in-federal-register/ Last updated: 2011-01-11T17:18:15.000Z January 7, 2011\. The Department of Health and Human Services (HHS) Office of the National Coordinator for Health Information Technology (ONC) published today in the Federal Register the final rule for Establishment of the Permanent Certification Program for Health Information Technology (HIT), [available online](http://edocket.access.gpo.gov/2011/pdf/2010-33174.pdf?ref=hipaa.com). This regulation is effective on February 7, 2011\. According to [the January 3, 2011, HHS News Release](www.hhs.gov/news/press/2011pres/01/20110103a.html), "\[t\]he temporary certification program, established through a final rule published on June 24, 2010, will continue in effect until it sunsets on December 31, 2011, or at a later date when the processes necessary for the permanent certification program to operate are completed. ONC expects to stand-up the programmatic activities necessary to implement the permanent certification program throughout 2011." The summary of the rule follows: "This final rule establishes a permanent certification program for the purpose of certifying health information technology (HIT). This final rule is issued pursuant to the authority granted to the National Coordinator for Health Information Technology (the National Coordinator) by section 3001(c)(5) of the Public Health Service Act (PHSA), as added by the Health Information Technology for Economic and Clinical Health (HITECH) Act. The permanent certification program will eventually replace the temporary certification program that was previously established by a final rule \[published in the Federal Register on June 24, 2010, and [available online](http://edocket.access.gpo.gov/2010/pdf/2010-14999.pdf?ref=hipaa.com). The National Coordinator will use the permanent certification program to authorize organizations to certify electronic health record (EHR) technology, such as Complete EHRs and/or EHR Modules. The permanent certification program could also be expanded to include the certification of other types of HIT." Again referring to the HHS News Release referenced above, " \[t\]he permanent certification program provides new features that will enhance the certification of health information technology, including increasing the comprehensiveness, transparency, reliability, and efficiency of the current processes used for the certification of health information technology. Meaningful use of 'Certified EHR Technology' is a core requirement for eligible health care providers who seek to qualify to receive incentive payments under the Medicare and Medicaid Electronic Health Record Incentive Programs as authorized by the \[HITECH Act\]." Registration for eligible providers to receive incentive payments began on January 3, 2011, and *Health Data Management* reported on January 6, 2011, that two states--Kentucky and Oklahoma--had already begun issuance of incentive checks \[www.healthdatamanagement.com\]. For additional and updated information on EHR Certification and Meaningful Use, visit [ONC's Health IT Web site](http://healthit.hhs.gov/?ref=hipaa.com) and the [Centers for Medicare & Medicaid Services (CMS) Web site](http://cms.gov/ehrincentiveprograms?ref=hipaa.com). \[20110107\] ### Healthcare Providers Receive FTC Red Flags Exemption from Congress URL: https://hipaa.com/healthcare-providers-receive-ftc-red-flags-exemption-from-congress/ Last updated: 2010-12-14T14:12:21.000Z HIPAA.com has covered the provisions of the Federal Trade Commission (FTC) Red Flags Rule in earlier postings. Congressional action now exempts healthcare providers from compliance with the provisions of the Red Flags Rule. On Tuesday, December 7, the House by voice vote joined the Senate in passage of S.3987, the Red Flag Program Clarification Act of 2010\. On November 30, 2010, the Senate passed this legislation by unanimous consent. The bill has been cleared to the White House for signature. The following information from the Library of Congress summarizes S 3987 (see http://thomas.loc.gov): "Amends the Fair Credit Reporting Act, with respect to federal agency (red flag) guidelines regarding identity theft and the users of consumer reports, to define creditor to mean one that regularly and in the ordinary course of business: (1) obtains or uses consumer reports, directly or indirectly, in connection with a credit transaction; (2) furnishes information to certain consumer reporting agencies in connection with a credit transaction; or (3) advances funds to or on behalf of a person, based on the person's obligation to repay the funds or on repayment from specific property pledged by or on the person's behalf. "Includes in the definition any other type of creditor as the federal agency (banking agency, National Credit Union Administration, or the Federal Trade Commission) having authority over that creditor may determine appropriate, if the creditor offers or maintains accounts subject to a reasonably foreseeable risk of identity theft. "Excludes from the definition of creditor, however, any creditor that advances funds on behalf of a person fro expenses incidental to a service the creditor provides to that person." Note: Healthcare providers as Covered Entities under HIPAA Administrative Simplification, while exempt from FTC Red Flag identity theft detection and protection provisions under S 3987, are **not** exempt from HIPAA and HITECH Act privacy and security rule obligations to safeguard patient identity data elements that are protected health information (PHI) identifiers. ### 200 Breaches Impacting Almost 5.9 Million Individuals, with Theft and Loss of Laptops and PEDs Major Cause URL: https://hipaa.com/200-breaches-impacting-almost-5-9-million-individuals-with-theft-and-loss-of-laptops-and-peds-major-cause/ Last updated: 2010-12-06T14:00:02.000Z December 2, 2010.M Under the Health Information Technology for Economic and Clinical Health Act (HITECH Act), enacted as part of the American Recovery and Reinvestment Act of 2009, covered entities are required to report to the Secretary of the Department of Health and Human Services (HHS) any breach affecting 500 or more individuals within 60 days of discovery of the breach by the covered entity or its business associate. The HHS Office for Civil Rights (OCR), which is responsible for HIPAA privacy and security enforcement, is required to post these HIPAA privacy or security breaches on [its Web site](http://www.hhs.gov/ocr/privacy/hipaa/administrative/breachnotificationrule/breachtool.html?ref=hipaa.com) (please note that this URL is a change from the initial site locator, and presents the breach information in a different format than that on the initial site.) As of today's posting by OCR on its Website, there were 200 breaches involving 5,887,170 individuals that had been reported by covered entities. The dates of these breaches ranged from September 22, 2009 to October 17, 2010\. Thirty-nine of the reported breaches, or 20%, involved business associates. Excluding 10 reported breaches without sufficient detail, 141, or approximately 3 out of 4 reported breaches, involved electronic protected health information (PHI) and 51, or approximately 1 out of 4 reported breaches, involved hard copy formatted PHI. Several reported breaches involved breaches of both electronic and hard copy formatted PHI. With regard to type of breach, there were 23 of the 200 reported breaches without sufficient detail. Of the remaining 177 reported breaches, 112, or just over 63%, involved theft and 31, or over 17%, involved loss. Together, theft and loss, or 143 reported breaches, accounted for over 80% of reported breaches involving 500 or more individuals. Several of these reported breaches also indicated a combination of causes. Here we focus on breaches of electronic PHI. Of the 141 reported breaches involving electronic PHI, 86, or 61%, involved laptops and portable electronic devices (PEDs), not otherwise identified. All but 3 of these reported breaches of laptops and portable electronic devices involved theft or loss. These breaches should not be occurring. On August 24, 2010, HHS issued its Interim Final Rule on Breach Notification, which included [Guidance Specifying the Technologies and Methodologies that Render Protected Health Information Unusable, Unreadable, or Indecipherable to Unauthorized Individuals](http://www.hhs.gov/ocr/privacy/hipaa/administrative/breachnotificationrule/brguidance.htm?ref=hipaa.com). This guidance outlines valid encryption processes for securing PHI. It is either through indifference to or neglect of implementing these encryption safeguards on portable and mobile electronic devices that unnecessary costs of breach notification are being incurred by covered entities and business associates that breach unsecured PHI. That does not include the costs borne by individuals impacted by breach, or costs related to loss of business and reputation by the breaching party. In addition to covered entities and business associates taking greater responsibility to safeguard PHI, OCR also must take a greater role in enforcement, namely, put more emphasis on privacy and security compliance and training of workforce members, and increase HITECH Act authorized compliance audits and imposition of substantially increased HITECH Act financial penalties for noncompliance with HIPAA Privacy and Security Rule provisions, especially for willful neglect. Finally, as a reminder, the OCR Website only includes breaches affecting 500 or more individuals. Breaches of fewer than 500 affected individuals must be reported to OCR annually, so the number of totally affected individuals may be substantially higher than that already reported. \[20101202\] ### HHS Pulls Breach Notification Final Rule URL: https://hipaa.com/hhs-pulls-breach-notification-file-rule/ Last updated: 2010-07-30T15:40:54.000Z The *HIPAA Administrative Simplification; Notification in the Case of Breach* Final Rule (Regulation Identifier Number (RIN) 0991-AB56) has been at the Office of Management and Budget (OMB) since May 14, 2010, for Executive Order (EO) 12866 review and approval prior to publication in the *Federal Register*. On July 28, 2010, HHS "withdrew" this Final Rule, with the following explanation: "The Interim Final Rule for Breach Notification for Unsecured Protected Health Information, issued pursuant to the Health Information Technology for Economic and Clinical Health (HITECH) Act, was published in the Federal Register on August 24, 2009, and became effective on September 23, 2009\. During the 60-day public comment period on the Interim Final Rule, HHS received approximately 120 comments. HHS reviewed the public comment on the interim rule and developed a final rule, which was submitted to the Office of Management and Budget (OMB) for Executive Order 12866 regulatory review on May 14, 2010\. At this time, however, HHS is withdrawing the breach notification final rule from OMB review to allow for further consideration, given the Department’s experience to date in administering the regulations. This is a complex issue and the Administration is committed to ensuring that individuals’ health information is secured to the extent possible to avoid unauthorized uses and disclosures, and that individuals are appropriately notified when incidents do occur. We intend to publish a final rule in the Federal Register in the coming months." You may follow developments with this Final Rule at the [Department of Health and Human Services (HHS) Office for Civil Rights (OCR) Web site](http://www.hhs.gov/ocr/privacy/hipaa/administrative/breachnotificationrule?ref=hipaa.com), and HIPAA.com will bring you updates as well. Stay tuned! \[20100730\] ### EHR Incentive and Certification Criteria Final Rules Published in Federal Register URL: https://hipaa.com/ehr-incentive-and-certification-criteria-final-rules-published-in-federal-register/ Last updated: 2010-07-28T16:41:10.000Z The EHR Incentive and Certification final rules were published in the Federal Register this morning, July 28, 2010\. HIPAA.com provides the title, summary, effective date, and URL for each below. **Department of Health and Human Services, Centers for Medicare & Medicaid Services, "42 CFR Parts 412, 413, 422, and 495; Medicare and Medicaid Programs; Electronic Health Record Incentive Program; Final Rule, *Federal Register*, 75(144), Wednesday, July 28, 2010, pp. 44313-44588.** **Summary**: This final rule implements the provisions of the American Recovery and Reinvestment Act of 2009 (ARRA)(Public Law 111-5) that provide incentive payments to eligible professionals (EPs), eligible hospitals and critical access hospitals (CAHs) participating in Medicare and Medicaid programs that adopt and successfully demonstrate meaningful use of certified electronic health record (EHR) technology. This final rule specifies--the initial criteria EPs, eligible hospitals, and CAHs must meet in order to qualify for an incentive payment; calculation of the incentive payment amounts; payment adjustments under Medicare for covered professional services and inpatient hospital services provided by EPs, eligible hospitals and CAHs failing to demonstrate meaningful use of certified EHR technology; and other program participation requirements. Also, the Office of the National Coordinator for Health Information Technology (ONC) will be issuing a closely related final rule that specifies the Secretary's adoption of an initial set of standards, implementation specifications, and certification criteria for electronic health records. ONC has also issued a separate final rule on the establishment of certification programs for health information technology. \[p.44314\] **Effective Date**: September 27, 2010 **URL**: [http://edocket.access.gpo.gov/2010/pdf/2010-17207.pdf](http://edocket.access.gpo.gov/2010/pdf/2010-17207.pdf?ref=hipaa.com). **Department of Health and Human Services, Office of the Secretary, "45 CFR Part 170; Health Information Technology: Initial Set of Standards, Implementation Specifications, and Certification Criteria for Electronic Health Record Technology; Final Rule**," ***Federal Register*** , 75(144), Wednesday, July 28, 2010, pp. 44589-44654. Summary: The Department of Health and Human Services (HHS) is issuing this final rule to complete the adoption of an initial set of standards, implementation specifications, and certification criteria, and to more closely align such standards, implementation specifications, and certification criteria with final meaningful use Stage 1 objectives and measures. Adopted certification criteria establish the required capabilities and specify the related standards and implementation specifications that certified electronic health record (EHR) technology will need to include to, at a minimum, support the achievement of meaningful use Stage 1 eligible professionals, eligible hospitals, and/or critical access hospitals (hereafter, references to 'eligible hospitals' in this final rule shall mean 'eligible hospitals and/or critical access hospitals') under the Medicare and Medicaid EHR Incentive Programs. Complete EHRs and EHR Modules will be tested and certified according to adopted certification criteria to ensure that they have properly implemented adopted standards and implementations specifications and otherwise comply with the adopted certification criteria. \[p. 44590\] Effective Date: August 27, 2010 **URL**: [http://edocket.access.gpo.gov/2010/pdf/2010-17210.pdf](http://edocket.access.gpo.gov/2010/pdf/2010-17210.pdf?ref=hipaa.com). These final rules follow on the June 24, 2010, publication in the *Federal Register* of ONC's final rule: *Establishment of the Temporary Certification Program for Health Information Technology*, with an effective date the same as the publication date. HIPAA.com did a post on the *Federal Register's* prepublication release of this rule on June 18, 2010\. \[20100728\] ### OMB Completes Review of Final Rules for EHR Incentive Program and for Initial Certification Criteria URL: https://hipaa.com/omb-completes-review-of-final-rules-for-ehr-incentive-program-and-for-initial-certification-criteria/ Last updated: 2010-07-12T13:51:26.000Z On Friday, July 9, 2010, the Office of Management and Budget (OMB) completed review of the two Final Rules: *Health Information Technology: Initial Set of Standards, Implementation Specifications, and Certification Criteria for Electronic Health Record* (RIN: 0991-AB58) and *Electronic Health Record (EHR) Incentive Program* (RIN: 0938-AP78). RIN means Regulatory Identification Number, used to track a regulatory action through its development. These rules are on a fast track, follow on the heels of the June 24 Final Rule: *Establishment of the Temporary Certification Program for Health Information Technology* (75 *Federal Register* 36157-36209), and are expected to be available for prepublication inspection at the *Federal Register* imminently. For additional information and updates, visit the Centers for Medicare & Medicaid Services (CMS) Official Web Site for Medicare and Medicaid EHR Incentive programs at: www.cms.gov/ehrincentiveprograms/. (20100710) ### OCR Reports 107 Breaches Affecting Over 4 Million Individuals (II) URL: https://hipaa.com/ocr-reports-107-breaches-affecting-over-4-million-individuals-ii/ Last updated: 2010-07-09T13:00:10.000Z The Office for Civil Rights (OCR) regularly updates its Web site listing of breaches affecting 500 or more individuals. As of July 2, 2010, there were 107 breaches listed that were reported to have occurred between September 22, 2009 and June 11, 2010\. Individuals affected by these publicly listed breaches totaled 4,086,980\. Six of the 107 breaches, or 5.6% of the total, affected 3,353,627 individuals, or 82% of the total. This is the second of three postings that analyzes the data from these 107 breaches. This posting (II) covers paper breaches. The first posting (I) covered electronic breaches, and the final posting (III) looks at the prevalence of business associate involvement. Public listing of such breaches is required by the Health Information Technology for Economic and Clinical Health Act (HITECH Act) that was enacted as part of the American Recovery and Reinvestment Act of 2009\. The breach list has been on the OCR Web site since February 23, 2010, the day after OCR began enforcement of breach notification for breaches that occurred on or after February 22\. Excluding seven breaches that were not identified as to location, 25% involved breaches of protected health information (PHI) in hard copy (paper)form and 75% in various electronic forms. Of the 25 identified hard copy (paper) breaches, the largest category was "other," which means that OCR either needs to require more detailed information on "what happened" of covered entities reporting breaches or to provide greater specificity regarding the category: Type of Breach, if covered entities provide such information. Of the hard copy (paper) breaches providing information in that category, six involved theft, five unauthorized access, four improper disposal, four loss, and one incorrect mailing. Included in those totals are three compound types reported by covered entities: one theft/loss, one theft/unauthorized access, and one improper disposal/loss. The OCR Web site that lists breaches is at: [hhs.gov](http://www.hhs.gov/ocr/privacy/hipaa/administrative/breachnotificationrule/postedbreaches.html?ref=hipaa.com). ### HIPAA Privacy, Security, Enforcement Rule Modifications NPRM at Federal Register URL: https://hipaa.com/hipaa-privacy-security-enforcement-rule-modifications-nprm-at-federal-register/ Last updated: 2010-07-08T15:40:28.000Z This morning, July 8, 2010, HHS' *Modifications to the HIPAA Privacy, Security, and Enforcement Rules under the Health Information Technology for Economic and Clinical Health Act* Notice of Proposed Rulemaking (NPRM) was posted at the *Federal Register* for public access prior to publication. It will be published on Wednesday, July 14, 2010\. The 234 page NPRM can be accessed in portable document format (pdf) online at: http://www.ofr.gov/OFRUpload/OFRData/2010-16718\_PI.pdf. There will be a 60-day comment period relating to the content of the NPRM. HIPAA.com will provide a synopsis of the NPRM in a series of postings following publication in the *Federal Register*. ### Final Rules for EHR Incentives and Certification Criteria at OMB for Review URL: https://hipaa.com/final-rules-for-ehr-incentives-and-certification-criteria-at-omb-for-review/ Last updated: 2010-07-08T15:00:03.000Z The Office of Management and Budget (OMB) received in early July for Executive Order (EO) 12866 Regulatory Planning and Review two Final Rules relating to electronic health record (EHR) incentives and certification criteria required under the Health Information Technology for Economic and Clinical Health Act (HITECH Act) that was enacted on February 17, 2009 as part of the American Recovery and Reinvestment Act of 2009. On Friday, July 2, 2010, OMB received from the Office of the Secretary at the Department of Health and Human Services (HHS) for review *Health Information Technology: Initial Set of Standards, Implementation Specifications, and Certification Criteria for Electronic Health Record Technology; Final Rule*. The Interim Final Rule was issued on January 13, 2010, was effective February 12, 2010, and the public comment period ended on March 15, 2010\. From the Abstract: "The certification criteria adopted in this initial set establish the technical capabilities and related standards that certified electronic health record (EHR) technology will need to include in support of the Medicare and Medicaid EHR Incentive Programs." On Monday, July 5, 2010, OMB received from HHS' Center for Medicare & Medicaid Services (CMS) for review *Electronic Health Record (EHR) Incentive Program; Final Rule.* The Notice of Proposed Rulemaking (NPRM) was issued on January 13, 2010 (75 *Federal Register* 1843), and the public comment period ended on March 15, 2010\. From the Abstract: "The Medicare and Medicaid Health IT provisions in the American Recovery and Reinvestment Act of 2009 promote the adoption and meaningful use of certified electronic health records (EHRs). The Recovery Act authorized incentive payments for eligible professionals (EPs) and hospitals participating in Medicare and Medicaid for becoming meaningful users of certified EHRs. The law established maximum annual incentive amounts and includes Medicare penalties for failing to meaningfully use EHRs beginning in 2015, for professionals and hospitals that fail to adopt certified EHRs." This rule outlines statutory deadlines for the programs: January 1, 2011: Date can start incentive payments to EPs (Medicare) October 1, 2010: Date can start incentive payments to hospitals (Medicare) The rule "\[e\]stablishes policies and procedures required before the incentive program can begin. Additionally, supplemental payments are available in 2011 and 2012\. If eligible professionals and hospitals are not meaningful Electronic Health Record users by 2015, there will be a Medicare payment adjustment imposed." These two rules go together. Because of upcoming deadlines, and the information contained therein relates to the Final Rule published in the *Federal Register* on June 24, 2010: *Establishment of the Temporary Certification Program for Health Information Technology; Final Rule* (75 *Federal Register* 36157), it is likely that OMB will expedite review of the two referenced final rules and publication in the *Federal Register* will occur shortly thereafter. (20100706) ### OMB Completes Review of HIPAA/HITECH Act Privacy, Security, Enforcement Rule Modifications NPRM URL: https://hipaa.com/omb-completes-review-of-hipaahitech-act-privacy-security-enforcement-rule-modifications-nprm/ Last updated: 2010-07-07T14:00:18.000Z On July 1, 2010, the Office of Management and Budget (OMB) completed review of the Notice of Proposed Rulemaking (NPRM) entitled: *Modifications to the HIPAA Privacy, Security, and Enforcement Rules Under the Health Information Technology for Economic and Clinical Health Act* \[HITECH Act\](RIN: 0991-AB57). The NPRM was received at OMB for review on April 12, 2010\. It likely will be published in the *Federal Register* imminently. Legal authority for the NPRM is in Sections 13400 to 13410 of Subtitle D (Privacy) of the HITECH Act, which was enacted as part of the American Recovery and Reinvestment Act of 2009 (Public Law 111-5), enacted on February 17, 2009\. Those sections cover: 13400: Definitions 13401: Application of Security Provisions and Penalties to Business Associates of Covered Entities; Annual Guidance on Security Provisions 13402: Notification in the Case of Breach 13403: Education on Health Information Privacy 13404: Application of Privacy Provisions and Penalties to Business Associates of Covered Entities 13405: Restrictions on Certain Disclosures and Sales of Health Information; Accounting of Certain Protected Health Information Disclosures; Access to Certain Information in Electronic Format 13406: Conditions on Certain Contacts as Part of Health Care Operations 13407: Temporary Breach Notification Requirement for Vendors of Personal Health Records and Other Non-HIPAA Covered Entities 13408: Business Associate Contracts Required for Certain Entities 13409: Clarification of Application of Wrongful Disclosures Criminal Penalties 13410: Improved Enforcement These sections appear in Subtitle D (Privacy) on pp. 258-276 of Public Law 111-5, which is available for download on hipaa.com. The NPRM represents enabling rules for referenced statutory provisions from within some or all of those sections. The Abstract of the NPRM is: "The Department of Health and Human Services Office for Civil Rights will issue rules to modify the HIPAA Privacy, Security, and Enforcement Rules as necessary to implement the privacy, security, and certain enforcement provisions of subtitle D of the \[HITECH Act\](Title XIII of the American Recovery and Reinvestment Act of 2009)." In addition to the NPRM discussed above, OMB still has under review the Final Rule entitled: *HIPAA Administrative Simplification; Notification in the Case of Breach* (RIN: 0991-AB56), which would replace the Interim Final Rule that was published in the *Federal Register* on August 24, 2009 (74 *Federal Register* 42739-42770). The Abstract of the Final Rule is: "The Department will issue final rules for HIPAA covered entities and business associates with respect to breach notification of unsecured protected health information as required by section 13402 of the \[HITECH Act\](Title XIII of the American Recovery and Reinvestment Act of 2009)." (20100705) ### OCR Reports 107 Breaches Affecting Over 4 Million Individuals (I) URL: https://hipaa.com/ocr-reports-107-breaches-affecting-over-4-million-individuals-i/ Last updated: 2010-07-06T13:43:55.000Z As of the July 4th holiday weekend, the Office for Civil Rights (OCR) has updated again its Web site listing of breaches affecting 500 or more individuals. As of July 2, 2010, there were 107 breaches listed that were reported to have occurred between September 22, 2009 and June 11, 2010\. Individuals affected by these publicly listed breaches totaled 4,086,980\. Six of the 107 breaches, or 5.6% of the total, affected 3,353,627 individuals, or 82% of the total. This is the first of three postings that analyzes the data from these 107 breaches. This posting (I) covers electronic breaches, the next posting (II) covers hard copy (paper) breaches, and the final posting (III) looks at the prevalence of business associate involvement. Public listing of such breaches is required by the Health Information Technology for Economic and Clinical Health Act (HITECH Act) that was enacted as part of the American Recovery and Reinvestment Act of 2009\. The breach list has been on the OCR Web site since February 23, 2010, the day after OCR began enforcement of breach notification for breaches that occurred on or after February 22\. Excluding seven breaches that were not identified as to location, 25% involved breaches of protected health information (PHI) in hard copy (paper) form and 75% in various electronic forms. Of the electronic breaches, which included several in multiple electronic forms, 34 involved laptops, 15 desktops, 11 portable devices, 9 servers, and the remaining 11 miscellaneous forms (2 hard disks, 2 computers (not otherwise identified), 2 backup tapes, 2 electronic medical records (EMRs), 2 other (not identified), and 1 CD). Of the 75 electronic breaches, 58, or 77%, involved theft, and 11, or 15%, involved unauthorized access, with 7 of those 11 also reported in association with theft. There were six reported losses, or 8%, with 2 of those 6 also reported in association with theft. There were four reported hacking incidents, or 5%, with 1 of those 4 also reported in association with unauthorized access. Finally, there were 6, or 8%, defined as other, with 1 of those 6 also reported in association with theft. Of the 34 breaches involving a laptop, 32, or 94% involved a theft, and the remaining 2 breaches, or 6%, involved a loss. Of the 11 breaches involving a portable device, 10, or 91%, involved a theft, with one, or 9%, a loss. Whether a theft or loss, the evidence from the growing number of publicly reported breaches is that portable computers and devices **must** be encrypted to secure protected health information, in accordance with the August 24, 2009, *Guidance Specifying the Technologies and Methodologies that Render Protected Health Information Unusable, Unreadable, or Indecipherable to Unauthorized Individuals* (74 *Federal Register* 42742-42743) in order to avoid the growing costs to breaching entities of complying with provisions of the breach notification rule, reputational harms to those entities, and financial and inconvenience harms to affected individuals. \[20100702\] ### ONC Releases Final Rule for Temporary HIT Certification Program URL: https://hipaa.com/onc-releases-final-rule-for-temporary-hit-certification-program/ Last updated: 2010-06-18T18:35:39.000Z On Friday afternoon, June 18, the Office of the National Coordinator for Health Information Technology (ONC) of the Department of Health and Human Services (HHS) released the final rule: *Establishment of the Temporary Certification Program for Health Information Technology*. The final rule can be viewed in portable document format (pdf) online at: [http://www.federalreigster.gov/...](http://www.federalreigster.gov/OFRUpload/OFRData/2010-14999%5FPI.pdf?ref=hipaa.com). The final rule will be published in the Federal Register, most likely next week, and will be effective upon date of publication. The summary of the final rule is reproduced here: "This final rule establishes a temporary certification program for the purposes of testing and certifying health information technology. This final rule is established under the authority granted to the National Coordinator for Health Information Technology (the National Coordinator) by section 3001(c)(5) of the Public Health Service Act (PHSA), as added by the Health Information Technology for Economic and Clinical Health (HITECH) Act. The National Coordinator will utilize the temporary certification program to authorize organizations to test and certify Complete Electronic Health Records (EHRs) and/or EHR Modules, thereby making Certified EHR Technology available prior to the date on which health care providers seeking incentive payments available under the Medicare and Medicaid Incentive Programs may begin demonstrating meaningful use of Certified EHR Technology." The Medicare incentive program mentioned in the summary is expected to start in January 2011 and the Medicaid incentive program may start as early as the beginning of the fourth quarter of 2010, when the new federal fiscal year (FY 2011) starts. (20100618) ### Final Rule on EHR Certification Programs Imminent URL: https://hipaa.com/final-rule-on-ehr-certification-programs-imminent/ Last updated: 2010-06-16T13:36:45.000Z The Office of Management and Budget (OMB) completed its review of the *Proposed Establishment of Certification Programs for Health Information Technology* final rule on June 14, 2010, so publication in the Federal Register is imminent. This final rule explains the proposed establishment of certification programs for voluntary certification of health information technology, as specified in section 3001(c)(5) of the HITECH Act, which is available on the hipaa.com site. This final rule is a follow-on to the proposed rule of the same title that was published in the Federal Register on March 10, 2010 (75 *Federal Register* 11327-11373), the summary of which appears below. "Under the authority granted to the National Coordinator for Health Information Technology (the National Coordinator) by section 3001(c)(5) of the Public Health Service Act (PHSA) as added by the Health Information Technology for Economic and Clinical Health (HITECH) Act, this rule proposes the establishment of two certification programs for purposes of testing and certifying health information technology. While two certification programs are described in this proposed rule, we anticipate issuing separate final rules for each of the programs. **The first proposal would establish a temporary certification program whereby the National Coordinator would authorize organizations to test and certify Complete EHRs and/or EHR Modules, thereby assuring the availability of Certified EHR Technology prior to the date on which health care providers seeking the incentive payments available under the Medicare and Medicaid EHR Incentives Program may begin demonstrating meaningful use of Certified EHR Technology.** The second proposal would establish a permanent certification program to replace the temporary certification program. The permanent certification program would separate the responsibilities for performing testing and certification, introduce accreditation requirements, establish requirements for certification bodies authorized by the National Coordinator related to the surveillance of Certified EHR Technology, and would include the potential for certification bodies authorized by the National Coordinator to certify other types of health information technology besides Complete EHRs and EHR Modules." (75 *Federal Register* 11328) \[emphasis added\] As the incentive programs for Medicare begin in 2011 and for Medicaid perhaps as early as the beginning of FY 2011 in October 2010, it is likely that the final rule relates to the temporary certification program as described in the bolded portion of the summary above. (20100616) ### Reported Breaches of 500 or More Individuals up to 93 and Affecting Over 2.5 Million Individuals; Enforcement and Penalties URL: https://hipaa.com/reported-breaches-of-500-or-more-individuals-up-to-93-and-affecting-over-2-5-million-individuals-enforcement-and-penalties/ Last updated: 2010-06-07T13:50:24.000Z As of Friday, June 4, 2010, 93 breaches affecting 500 or more individuals have been reported on [the Office for Civil Rights (OCR) Web site](http://www.hhs.gov/ocr/privacy/hipaa/administrative/breachnotificationrule/postedbreaches.html?ref=hipaa.com). The total number affected has gone beyond 2-1/2 million individuals today, and stands at 2,565,352 individuals. Of the 87 breaches involving breach of hard copy or electronic protected health information, 26% involve hard copy or paper records and 74% records on electronic media or devices. Overall, 71% of the 93 breaches involve theft or loss of records, many of which might have been avoided by appropriate securing of hard copy records and electronic media and devices. Below we remind readers of the Department of Health and Human Services (HHS) enforcement efforts for violations of the HIPAA Privacy and Security rules, and the increased penalty structure for violations of those rules and the HITECH Act Breach Notification Rule. On October 30, 2009, HHS published in the Federal Register the Interim Final Rule (IFR): HIPAA Administrative Simplification: Enforcement.\[1\] This IFR strengthened HIPAA enforcement of February 17, 2009-enacted HITECH Act penalty revisions, which were effective for violations beginning on February 18, 2009\. The enforcement IFR was effective on November 30, 2009\. This IFR followed by several months HHS Secretary Kathleen Sebelius’ delegation of enforcement of the HIPAA Security Rule to the Office for Civil Rights (OCR)\[2\], which had HIPAA Privacy Rule enforcement responsibilities since the April 14, 2003, compliance date for the Privacy Rule. OCR’s unified enforcement of the HIPAA Privacy Rule, HIPAA Security Rule, and the Breach Notification Rule and higher penalties increase the likelihood and severity of consequences of noncompliance with those rules, especially with the advent of compliance audits in addition of complaint investigations. Before the February 17, 2009-enacted HITECH Act penalty revisions, civil penalties for HIPAA violations were $1000 for each violation or $25,000 for all violations of the same provision in a calendar year period. Under the HITECH Act, penalties are substantially increased and have been divided into four tiers, with a maximum of $1.5 million for all violations of an identical provision in a calendar year. The tiered Penalties now range as follows, for each violation: - $100-$50,000 if the covered entity did not know an, by exercising reasonable diligence, would not have known, that it violated such provision. - $1,000-$50,000 if the violation was due to reasonable cause and not to willful neglect. - $10,000-$50,000 if the violation was due to willful neglect and was corrected “during the 30-day period beginning on the first date the covered entity liable for the penalty knew, or, by exercising reasonable diligence, would have known that the violation occurred.”\[3\] - $50,000 or more if the violation was due to willful neglect and was not corrected as required. In announcing strengthened enforcement, OCR Director Georgina Verdugo said: “The Department’s implementation of these HITECH Act enforcement provisions will strengthen the HIPAA protections and rights related to an individual’s health information…. This strengthened penalty scheme will encourage health care providers, health plans and other health care entities required to comply with HIPAA to ensure that their compliance programs are effectively designed to prevent, detect and quickly correct violations of the HIPAA rules… Such heightened vigilance will give consumers greater confidence in the privacy and security of their health information and in the industry’s use of health information technology.”\[4\] Currently, there is at OMB for review as a Notice of Proposed Rulemaking (NPRM): Modifications to the HIPAA, Privacy, Security, and Enforcement Rules Under the Health Information Technology for Economic and Clinical Health Act.\[5\] According to the Abstract: “The Department of Health and Human Services Office for Civil Rights will issue rules to modify the HIPAA Privacy, Security, and Enforcement Rules as necessary to implement the privacy, security, and certain enforcement provisions of subtitle D \[Privacy\] of the \[HITECH Act\].” After clearance at OMB, the NPRM will be published in the Federal Register. Be alert to NPRM modifications to privacy, security, and enforcement requirements, and the likelihood of relative quick—by HIPAA time standards—compliance dates for each through follow-on interim final rules. Please visit [the OCR Enforcement Web site](http://www.hhs.gov/ocr/privacy/hipaa/enforcement/index.html?ref=hipaa.com) for additional information now and updated information in the future. --- \[1\] Department of Health and Human Services, Office of the Secretary, “45 CFR Part 160, HIPAA Administrative Simplification: Enforcement; Interim Final Rule,” Federal Register, v.74, n.209, October 30, 2009, pages 56123-56131\. Citations to this document are in the format: 74 FR page(s). This document is available online at: www.hhs.gov/ocr/privacy/hipaa/administrative/enforcementrule/enfifr.pdf. \[2\] OCR also is responsible for enforcement of the HITECH Act Breach Notification Rule. The delegation of enforcement of the HIPAA Security Rule was from the Centers for Medicare & Medicaid Services (CMS), which retains enforcement authority for the HIPAA Transaction and Code Set and Identifiers Rules. See Department of Health and Human Services, Office of the Secretary, “Office for Civil Rights; Delegation of Authority,” Federal Register, v.74, n.148, August 4, 2009, page 38630\. This document is available online at: www.hhs.gov/ocr/privacy/hipaa/administrative/securityrule/srdelegation.pdf. \[3\] 74 Federal Register 56131. \[4\] Department of Health and Human Services, “HHS Strengthens HIPAA Enforcement, “ news release, October 30, 2009, which is available online at: http://www.hhs.gov/news/press/2009pres/10/20091030a.html. \[5\] This document, Regulation Identifier Number (RIN) 0991- AB57, was received at OMB on April 12, 2010, and attributes of this NPRM, but not its content, are available online at: http://www.reginfo.gov/public/do/eAgendaViewRule?pubId=201004&RIN=0991-AB57. ### FTC Delays Enforcement of FTC Red Flags Rule Fifth Time URL: https://hipaa.com/ftc-delays-enforcement-of-ftc-red-flags-rule-fifth-time/ Last updated: 2010-06-03T13:50:33.000Z The original FTC Red Flags Rule compliance date deadline was extended three times from the original date of November 1, 2008, with an expected compliance date of November 1, 2009\. Just prior to that date, the FTC extended for the fourth time the deadline for compliance to June 1, 2010\. On May 28, 2010, the June 1, 2010, compliance date was extended a fifth time to December 31, 2010[\[1\]](#%5Fftn1): “At the request of several Members of Congress, the Federal Trade Commission is further delaying enforcement of the ‘Red Flags’ Rule through December 31, 2010, while Congress considers legislation that would affect the scope of entities covered by the Rule. Today’s announcement and the release of an Enforcement Policy Statement do not affect other federal agencies’ enforcement of the original November 1, 2008 deadline for institutions subject to their oversight to be in compliance…. “The Commission urges Congress to act quickly to pass legislation that will resolve any questions as to which entities are covered by the Rule and obviate the need for further enforcement delays. If Congress passes legislation limiting the scope of the Red Flags Rule with an effective date earlier than December 31, 2010, the Commission will begin enforcement as of that effective date.” The issue regarding the delays in FTC enforcement relates to “scope of entities covered by the Rule,” as indicated in the FTC news release. Congress is taking action[\[2\]](#%5Fftn2): “House lawmakers in October \[2009\] passed H.R. 3763[\[3\]](#%5Fftn3), which would exclude from the Red Flags guidelines meaning of ‘creditor’ any healthcare, accounting, or legal practice with 20 or fewer employees, as well as any other business which the FTC determines knows all its customers or clients individually; only performs services in or around the residences of its customers; or hasn’t experienced incidents of ID theft, and identity theft is rare for businesses of that type. An identical bill, S.3416 was introduced in the Senate on May 25 \[2010\].” A lawsuit was filed in federal court on May 21, 2010, to accomplish a similar objective of narrowing scope of entities covered by the Rule. “\[T\]he American Medical Association, American Osteopathic Association and the Medical Society of the District of Columbia filed a lawsuit in federal court challenging the decision to classify physicians as ‘creditors’ because they allow patients to defer payments. The medical groups also said the implementation of the Red Flags Rule could threaten doctor-patient relationships and negatively affect patient care (Sorrel, *American Medical News*, 5/31).”[\[4\]](#%5Fftn4) Please visit the FTC Red Flags Rule Web site: [http://www.ftc.gov/redflagsrule](http://www.ftc.gov/redflagsrule?ref=hipaa.com) or the American Medical Association (AMA) Web site: [http://www.ama-assn.org/ama/no-index/physician-resources/red-flags-rule.shtml](http://www.ama-assn.org/ama/no-index/physician-resources/red-flags-rule.shtml?ref=hipaa.com) for additional information. (20100603) --- [\[1\]](#%5Fftnref) Federal Trade Commission, “FTC Extends Enforcement Deadline for Identity Theft Red Flags Rules,” news release, May 28, 2010, which is available online at: [http://www.ftc.gov/opa/2010/05/redflags.shtm](http://www.ftc.gov/opa/2010/05/redflags.shtm?ref=hipaa.com). [\[2\]](#%5Fftnref) Melissa Klein Aguilar, “Another Delay for FTC Red Flags Enforcement,” in *Compliance Week*, June 1, 2010, which is available online at: [http://www.complianceweek.com/blog/aguilar/2010/06/01/once-again-ftc-delays-red-flags-enforcement/](http://www.complianceweek.com/blog/aguilar/2010/06/01/once-again-ftc-delays-red-flags-enforcement/?ref=hipaa.com). [\[3\]](#%5Fftnref) The House passed H.R. 3763 by a vote of 400-0. [\[4\]](#%5Fftnref) California HealthCare Foundation, “FTC Delays Enforcement of ‘Red Flags Rule’ Until End of 2010,” **iHealth*Beat*, June 1, 2010, which is available online at: [http://www.ihealthbeat.org/articles/2010/6/1/ftc-delays-enforcement-of-red-flags-rule-until-end-of-2010.aspx](http://www.ihealthbeat.org/articles/2010/6/1/ftc-delays-enforcement-of-red-flags-rule-until-end-of-2010.aspx?ref=hipaa.com). ### OCR Stepping Up HIPAA Security Enforcement URL: https://hipaa.com/ocr-stepping-up-hipaa-security-enforcement/ Last updated: 2010-05-13T14:00:42.000Z Health Data Management (HDM) reported today, May 12, that the Office for Civil Rights (OCR) of the Department of Health and Human Services (HHS) is going to strengthen HIPAA Security Rule enforcement, based on statements made on Tuesday, May 11 by the OCR Deputy Director for Privacy, Susan McAndrew, at the Safeguarding Health Information conference in Washington, DC, co-sponsored by OCR and the National Institute of Standards and Technology (NIST). "To boost enforcement of the security rule, OCR has added investigators in 10 regional offices, McAndrew notes," as reported by Joe Goedert in the HDM article, "OCR Boosting Security Enforcement," which is [available online](http://bit.ly/cy6giu?ref=hipaa.com). This report comes several days after OCR's release last Friday of its Draft Security Rule Guidance on Risk Analysis, the first in a series of guidances on security, that hipaa.com posted earlier today, and precedes the likely release later this month of the Notice of Proposed Rulemaking (NPRM): *Modifications to the HIPAA Privacy, Security, and Enforcement Rules Under the Health Information Technology for Economic and Clinical Health Act*, which is currently at the Office of Management and Budget (OMB) for review prior to publication in the Federal Register. In addition, the renewed emphasis on HIPAA Security Rule compliance may be due in part to the growing number of posted "Breaches Affecting 500 or More Individuals" on the [OCR Web site](http://bit.ly/aD1b7M?ref=hipaa.com). As of May 6, 2010, OCR had listed on this site 77 covered entities that had experienced such breaches, with the total number of affected individuals 2,430,167\. Of the total listed breaches, 63 involved covered entities only and 14, 0r 18%, involved a business associate in some manner. Of the 72 reported breaches identifying whether paper or electronic protected health information (PHI) was involved, 18, or 25% involved paper and 54, or 75%, involved electronic media. Forty-five of those 54 breaches, or just over 83%, were instances of theft or loss, most often laptop or other portable devices, highlighting the need for encrypting PHI to *secure* it on those electronic media according to NIST-validated standards identified in the August 24, 2009, HHS Guidance. That Guidance was discussed in earlier hipaa.com postings and is available on this site . With increased enforcement comes the need for greater attention paid to HIPAA Privacy and Security Rule compliance and training. hipaa.com will announce new online HIPAA privacy and security training initiatives later this month. You may register on hipaa.com to be notified of the training announcement. ### OCR Issues Draft Guidance on Security Risk Analysis URL: https://hipaa.com/ocr-issues-draft-guidance-on-security-risk-analysis/ Last updated: 2010-05-12T13:46:42.000Z The Office for Civil Rights (OCR) of the Department of Health and Human Services (HHS) issued on May 7, 2010, Security Rule Draft Guidance on Risk Analysis. This is the first in a “series of guidance documents \[that\] will assist organizations in identifying and implementing the most effective and appropriate administrative, physical, and technical safeguards to protect the confidentiality, integrity, and availability of electronic protected health information. The materials will be updated annually, as appropriate.” This eight-page document is [available online](http://www.hhs.gov/ocr/privacy/hipaa/administrative/securityrule/radraftguidance.pdf?ref=hipaa.com). The Draft Guidance on Risk makes the following key points: “The Security Rule does not prescribe a specific risk analysis methodology, recognizing that methods will vary dependent on the size, complexity, and capabilities of the organization. Instead, the Rule identifies risk analysis as the foundational element in the process of achieving compliance, and it establishes several objectives that any methodology adopted must achieve…. “The risk analysis process should be ongoing. In order for an entity to update and document its security measures ‘as needed,’ which the Rule requires, it should conduct continuous risk analysis to identify when updates are needed…. “Risk analysis is the first step in an organization’s Security Rule compliance efforts. Risk analysis is an ongoing process that should provide the organization with a detailed understanding of the risks to the confidentiality, integrity, and availability of e-PHI.” OCR requests public comment on the Draft Guidance on Risk Analysis, which can be sent to [OCRPrivacy@hhs.gov](mailto:OCRPrivacy@hhs.gov). ### Prison Time for Privacy Breach of PHI; OCR Breach List Continues to Grow; More Training Needed URL: https://hipaa.com/prison-time-for-privacy-breach-of-phi-ocr-breach-list-continues-to-grow-more-training-needed/ Last updated: 2010-04-30T14:00:56.000Z Health Data Management reported in its April 29, 2010, online *HDM Daily* that "\[a\] former researcher at the UCLA School of Medicine has been sentenced to four months in federal prison for violations of the HIPAA privacy rule." You may access and read the article by Joseph Goedert, "[Prison for HIPAA Privacy Violater](http://www.healthdatamanagement.com/news/hipaa%5Fprivacy-violation-conviction-breach-40202-1.html?ref=hipaa.com)". On the same day, April 29, the Office for Civil Rights (OCR) of the Department of Health and Human Services (HHS) reported on its Web site 67 entities reporting "Breaches Affecting 500 or More Individuals" over the period September 22, 2009 to March 19, 2010\. That is up from the 36 that OCR listed on its initial posting of the list on February 23, 2010\. The current list is [available on the OCR Web site](http://www.hhs.gov/ocr/privacy/hipaa/administrative/breachnotificationrule/postedbreaches.html?ref=hipaa.com). Clearly, more "awareness and understanding" training on security safeguards and privacy controls regarding use and disclosure of protected health information (PHI) is necessary. Such training is required under the HIPAA Privacy and Security Rules and includes training regarding the new HITECH Act Breach Notification Rule requirements. HIPAA.com will have announcements about such training in May, offerred through HIPAA School. You may register on the hipaa.com site for email notification of further details about HIPAA School training, and for postings provided on hipaa.com. (20100429) ### HHS' ONC Releases Proposed Rule for Temporary and Permanent HIT Certification Programs URL: https://hipaa.com/hhs-onc-releases-proposed-rule-for-temporary-and-permanent-hit-certification-programs/ Last updated: 2010-03-22T14:29:49.000Z On Wednesday, March 10, 2010, the Office of the National Coordinator for Health Information Technology (ONC) of the Department of Health and Human Services (HHS) published in the *Federal Register* the Proposed Rule (NPRM) for *Proposed Establishment of Certification Programs for Health Information Technology*. \[75 *Federal Register* 11327-11373\] We present the summary of the NPRM. "SUMMARY. Under the authority granted to the National Coordinator for Health Information Technology (the National Coordinator) by section 3001(c)(5) of the Public Health Service Act (PHSA) as added by the Health Information Technology for Economic and Clinical Health (HITECH ) Act, this rule proposes the establishment of two certification programs for purposes of testing and certifying health information technology. While two certification programs are described in this proposed rule, we anticipate issuing separate final rules for each of the programs. The first proposal would establish a temporary certification program whereby the National Coordinator would authorize organizations to test and certify Complete EHRs and/or EHR Modules, thereby assuring the availability of Certified EHR Technology prior to the date on which health care providers seeking the incentive payments available under the Medicare and Medicaid EHR Incentives Program may begin demonstrating meaningful use of Certified EHR Technology. The second proposal would establish a permanent certification program to replace the temporary certification program. The permanent certification program would separate the responsibilities for performing testing and certification, introduce accreditation requirements, establish requirements for certification bodies authorized by the National Coordinator related to the surveillance of Certified EHR Technology, and would include the potential for certification bodies authorized by the national Coordinator to certify other types of health information technology besides Complete EHRs and EHR Modules." The Office of the National Coordinator for Health Information Technology requests written or electronic comments on the *temporary certification program* for receipt no later than 5 PM on April 9, 2010, and written or electronic comments on the *permanent certification program* no later than 5 PM on May 10, 2010\. Detailed instructions for submitting comments can be found on page 11328 of the NPRM referenced above. ### OCR Identifies 36 Entities with Breaches Affecting 500 or More Individuals URL: https://hipaa.com/ocr-identifies-36-entities-with-breaches-affecting-500-or-more-individuals/ Last updated: 2010-03-04T21:14:52.000Z On Monday, February 22, 2010, the federal government, through the Office for Civil Rights (OCR) of the Department of Health and Human Services (HHS), began enforcing the Breach Notification Rule for breaches occurring on or after that date. The Breach Notification for Unsecured Protected Health Information; Interim Final Rule, was published in the Federal Register on Monday, August 24, 2009 \[74 FR 42739-42770\] and was effective September 23, 2009\. Since September 22, 2009, 36 breaches of privacy or security of protected health information (PHI) affecting 500 or more individuals have been reported to OCR. The total number of individuals affected was 1,073,657, with two of the breaches involving 359,000 (FL) and 500,000 (TN), as reported. Seven of the 36 reported breaches involved business associates of covered entities, totaling 118,062, or about 11% of affected individuals. Twenty-nine of the 36 breaches involved theft (22), unauthorized access (2), or a combination of theft and unauthorized access (5). Twenty-nine also involved electronic devices or electronic media. For more information, see the OCR Press Release [here](http://www.hhs.gov/ocr/privacy/hipaa/administrative/breachnotificationrule/postedbreaches.html?ref=hipaa.com). ### Today, February 17, Business Associates Must be in Compliance with HIPAA Security Rule URL: https://hipaa.com/today-february-17-business-associates-must-be-in-compliance-with-hipaa-security-rule/ Last updated: 2010-02-17T17:01:43.000Z Today, Wednesday, February 17, 2010, Business Associates of Covered Entities must be able to demonstrate that they are in compliance with administrative, physical, and technical safeguards of the HIPAA Security Rule, as required by the HITECH Act, enacted one year ago today as part of the American Recovery and Reinvestment Act of 2009\. In addition, Business Associate Agreements must be rewritten or amended to specifically require a Business Associate's compliance with the Security Rule as part of its "satisfactory assurances." Financial penalties for noncompliance discovered during a compliance audit or complaint investigation could be severe, especially for willful neglect. Here are the appropriate authorities: Section 13401 of Part 1 (Improved Privacy Provisions and Security Provisions) of Subtitle D (Privacy) of the HITECH Act (pp. 260): Application of Security Provisions and Penalties to Business Associates of Covered Entities (a) **Application of Security Provisions**. Sections 164.308 \[Administrative Safeguards\], 164.310 \[Physical Safeguards\], 164.312 \[Technical Safeguards\], and 164.316 \[Policies and Procedures and Documentation Requirements\] of title 45, Code of Federal Regulations, shall apply to a business associate of a covered entity in the same manner that such sections apply to the covered entity. The additional requirements of this title that related to security and that are made applicable with respect to covered entities shall also be applicable to such a business associate and shall be incorporated into the business associate agreement between the business associate and the covered entity. \[42 USC 17931\] (b) **Application of Civil and Criminal Penalties**. In the case of a business associate that violates any security provision specified in subsection (a), sections 1176 and 1177 of the Social Security Act (42 U.S.C. 1320d-5, 1320d-6) shall apply to the business associate with respect to such violation in the same manner such sections apply to a covered entity that violates such security provisions. \[42 USC 17931\] NOTE: Effective the day after of enactment of the HITECH Act (February 18, 2009), financial penalties were substantially increased for noncompliance with HIPAA standards, which cover policies, procedures, actions, assessments, and documentation requirements discovered during a compliance audit or complaint investigation. Section 13423 of Part 2 (Relationship to Other Laws; Regulatory References; Effective Date; Reports) of Subtitle D (Privacy) of the HITECH Act (pp. 276): Effective Date Except as otherwise specifically provided, the provisions of part 1 shall take effect on the date that is 12 months after the date of the enactment of this title. \[42 USC 17953\] Today marks the beginning of direct federal regulation of business associates' compliance with the HIPAA Security Rule. \[02/17/10\] ### New HIPAA/HITECH Act Rules Require Compliance in February URL: https://hipaa.com/new-hipaahitech-act-rules-require-compliance-in-february/ Last updated: 2010-02-03T23:45:35.000Z Three new HIPAA/HITECH Act rules go into effect this month: Two weeks from today, on Wednesday, February 17, 2010, Business Associates of Covered Entities must comply with the HIPAA Security Rule. For the first time Business Associates will be regulated by the federal government. Section 13401 of Subtitle D (Privacy) of the HITECH Act (42 USC 17931) states that "\[t\]he additional requirements of this title that related to security and that are made applicable with respect to Covered Entities shall also be applicable to such a Business Associate and shall be incorporated into the business associate agreement between the business associate and the covered entity." \[Public Law 111-5, p.260\] In addition, penalties that apply to Covered Entities also will apply to Business Associates for noncompliance with the provisions of the Security Rule. The next day, Thursday, February 18, 2010, a new restriction on disclosure of protected health information goes into effect that impacts Covered Entity health care providers. According to Section 13405 of Subtitle D of the HITECH Act (42 USC 17935), a health care provider must honor a patient request to restrict disclosure of protected health information to a health plan for purposes other than carrying out treatment (namely, payment or health care operations) if the patient pays the health care provider out of pocket in full. Finally, on Monday, February 22, 2010, enforcement of the Breach Notification Rule goes into effect for "failure to provide the required notifications for breaches" of unsecured protected health information discovered on or after the February 22 date. \[74 *Federal Register* 42757, August 24, 2009\]. The Breach Notification Rule applies to Covered Entities and Business Associates, provides obligations for each regarding compilation and reporting of information pertaining to a breach by either party, and requires "incorporation \[of those obligations\] into the Business Associate Agreement between the Business Associate and the Covered Entity." \[42 USC 17934\] \[02/03/2010\] ### Clock Running Down on Business Associate Compliance with HIPAA Security Rule Required by HITECH Act URL: https://hipaa.com/clock-running-down-on-business-associate-compliance-with-hipaa-security-rule-required-by-hitech-act/ Last updated: 2010-01-19T15:29:25.000Z Less than one month to go: Business Associates must comply with the HIPAA Security Rule no later than Wednesday, February 17, 2010\. Here are relevant provisions from the American Recovery and Reinvestment Act, Public Law 111-5, which included HITECH Act Subtitle D: Privacy. 42 USC 17931 (PART 1--IMPROVED PRIVACY PROVISIONS AND SECURITY PROVISIONS, Section 13401: Application of Security Provisions and Penalties to Business Associates of Covered Entities; Annual Guidance on Security Provisions). (a) APPLICATION OF SECURITY PROVISIONS.--Sections 164.308 (Administrative Safeguards), 164.310 (Physical Safeguards), 164.312 (Technical Safeguards), and 164.316 (Policies and Procedures and Documentation Requirements) of title 45, Code of Federal Regulations, shall apply to a business associate of a covered entity in the same manner that such sections apply to a covered entity. The additional requirements of this title that relate to security and that are applicable with respect to covered entities shall also be applicable to such a business associate and shall be incorporated into the business associate agreement between the business associate and the covered entity. (b) APPLICATION OF CIVIL AND CRIMINAL PENALTIES.--In the case of a business associate that violates any security provision specified in subsection (a) \[above\], sections 1176 \[General Penalty for Failure to Comply with Requirements and Standards\] and 1177 \[Wrongful Disclosure of Individually Identifiable Health Information\] of the Social Security Act shall apply to the business associate with respect to such violation in the same manner such sections apply to a covered entity that violates such security provision.... 42 USC 17953 (Section 13423: EFFECTIVE DATE. Except as otherwise specifically provided, the provisions of part 1 shall take effect on the data that is 12 months after the date of the enactment of this title \[which was February 17, 2009\]. If you are a covered entity, make sure that your business associates are aware to the upcoming Security Rule safeguards, policies and procedures, and documentation compliance provisions by February 17, 2010, and that your business associate agreement reflects this obligation. \[01/18/2010\] ### HHS Publishes Proposed Rule for Electronic Health Record Incentive Program URL: https://hipaa.com/hhs-publishes-proposed-rule-for-electronic-health-record-incentive-program/ Last updated: 2010-01-13T22:35:24.000Z HHS published today in the Federal Register: "Medicare and Medicaid Programs--Electronic Health Record Incentive Program; Proposed Rule." 75 FR 1844-2011\. Comments on this Notice of Proposed Rulemaking (NPRM) may be submitted to HHS no later than March 15, 2010\. Here is the Summary from the NPRM: "This proposed rule would implement the provisions of the American Recovery and Reinvestment Act of 2009 (ARRA)(Public Law 111-5) that provide incentive payments to eligible professionals (EPs) and eligible hospitals participating in Medicare and Medicaid programs that adopt and meaningfully use certified electronic health record (EHR) technology. The proposed rule would specify the initial criteria an EP and eligible hospital must meet in order to qualify for the incentive payment; calculation of the incentive payment amounts; payment adjustments under Medicare for covered professional services and inpatient hospital services provided by EPs and eligible hospitals failing to meaningfully use certified EHR technology; and other program participation requirements. Also, as required by ARRA, the Office of the National Coordinator for Health Information Technology (ONC) will be issuing a closely related interim final rule \[75 FR 2013-2047\] that specifies the Secretary's adoption of an initial set of standards, implementation specifications, and certification criteria for electronic health records. ONC will also be issuing a notice of proposed rulemaking on the process for organizations to conduct the certification of EHR technology." \[01/13/10\] This NPRM is available online [here](http://edocket.access.gpo.gov/2010/pdf/E9-31217.pdf?ref=hipaa.com). ### HHS Publishes EHR Standards, Implementation Specifications and Certification Criteria IFR URL: https://hipaa.com/hhs-publishes-ehr-standards-implementation-specifications-and-certification-criteria-ifr/ Last updated: 2010-01-13T22:32:57.000Z HHS published today in the Federal Register: "Health Information Technology: Initial Set of Standards, Implementation Specifications, and Certification Criteria for Electronic Health Record Technology" 75 FR 2013-2047\. This Interim Final Rule (IFR) is effective February 2, 2010\. Comments on the IFR may be submitted to HHS no later than March 15, 2010\. Here is the Summary from the IFR: "The Department of Health and Human Services (HHS) is issuing this interim final rule with a request for comments to adopt an initial set of standards, implementation specifications, and certification criteria, as required by section 3004(b)(1) of the Public Health Service Act. This interim final rule represents the first step in an incremental approach to adopting standards, implementation specifications, and certification criteria to enhance the interoperability, functionality, utility, and security of health information technology and to support its meaningful use. The certification criteria adopted in this initial set establish the capabilities and related standards that certified electronic health record (EHR) technology will need to include in order to, at a minimum, support the achievement of the proposed meaningful use Stage 1 (beginning in 2011) by eligible professionals and eligible hospitals under the Medicare and Medicaid EHR Incentive Programs." This IFR is a consequence of HITECH Act provisions that were enacted on February 17, 2009, as part of the American Recovery and Reinvestment ACT. \[01/13/10\] The IFR is available online [here](http://edocket.access.gpo.gov/2010/pdf/E9-31216.pdf?ref=hipaa.com). ### Exploring HIPAA and HITECH Act Definitions: Part 16 URL: https://hipaa.com/exploring-hipaa-and-hitech-act-definitions-part-16/ Last updated: 2009-12-28T16:00:58.000Z From now through early December, HIPAA.com is providing a run through of HIPAA transaction & code set, privacy, and security definitions, along with relevant HITECH Act definitions pertaining to breach notification, securing of protected health information, and electronic health record (EHR) standards development and adoption. These definitions are key to understanding the referenced HIPAA and HITECH Act enabling regulations that are effective now and that will require compliance by covered entities and business associates now or in the months ahead, as indicated in HIPAA.com’s timeline. Each posting will contain three definitions, with a date reference to the Federal Register, Code of Federal Regulations (CFR), or statute, as appropriate. *Exploring HIPAA and HITECH Act Definitions: Parts 11-15*, include definitions from: American Recovery and Reinvestment Act of 2009 (February 17, 2009, pp.258-259), Health Information Technology for Economic and Clinical Health Act, Title XIII—Health Information Technology, Subtitle D—Privacy, Section 13400—Definitions. ***Treatment*** Has the meaning given such term in section 164.501 of title 45, Code of Federal Regulations \[CFR\]: “The provision, coordination, or management of health care and related services by one or more health care providers, including the coordination or management of health care by a health care provider with a third party; consultation between health care providers relating to a patient; or the referral of a patient for health care from one health care provider to another.” ***Use*** Has the meaning given such term in section 160.103 of title 45, Code of Federal Regulations \[CFR\]: “With respect to individually identifiable health information, the sharing, employment, application, utilization, examination, or analysis of such information within an entity that maintains such information.” ***Vendor of Personal Health Records*** An entity, other than a covered entity (as defined), that offers or maintains a personal health record. ### Exploring HIPAA and HITECH Act Definitions: Part 15 URL: https://hipaa.com/exploring-hipaa-and-hitech-act-definitions-part-15/ Last updated: 2009-12-23T14:00:41.000Z From now through December, HIPAA.com is providing a run through of HIPAA transaction & code set, privacy, and security definitions, along with relevant HITECH Act definitions pertaining to breach notification, securing of protected health information, and electronic health record (EHR) standards development and adoption. These definitions are key to understanding the referenced HIPAA and HITECH Act enabling regulations that are effective now and that will require compliance by covered entities and business associates now or in the months ahead, as indicated in HIPAA.com’s timeline. Each posting will contain three definitions, with a date reference to the Federal Register, Code of Federal Regulations (CFR), or statute, as appropriate. *Exploring HIPAA and HITECH Act Definitions: Parts 11-15*, include definitions from: American Recovery and Reinvestment Act of 2009 (February 17, 2009, pp.258-259), Health Information Technology for Economic and Clinical Health Act, Title XIII—Health Information Technology, Subtitle D—Privacy, Section 13400—Definitions. ***Secretary*** Secretary of \[U.S. Department of\] Health and Human Services. ***Security*** Has the meaning given such term in section 164.304 of title 45, Code of Federal Regulations \[CFR\]. “*Security* or *Security measures* encompass all of the administrative, physical, and technical safeguards in an information system.” ***State*** Each of the several States, the District of Columbia, Puerto Rico, the Virgin Islands, Guam, American Samoa, and the Northern Mariana Islands. ### Exploring HIPAA and HITECH Act Definitions: Part 14 URL: https://hipaa.com/exploring-hipaa-and-hitech-act-definitions-part-14/ Last updated: 2009-12-21T19:30:48.000Z From now through December, HIPAA.com is providing a run through of HIPAA transaction & code set, privacy, and security definitions, along with relevant HITECH Act definitions pertaining to breach notification, securing of protected health information, and electronic health record (EHR) standards development and adoption. These definitions are key to understanding the referenced HIPAA and HITECH Act enabling regulations that are effective now and that will require compliance by covered entities and business associates now or in the months ahead, as indicated in HIPAA.com’s timeline. Each posting will contain three definitions, with a date reference to the Federal Register, Code of Federal Regulations (CFR), or statute, as appropriate. *Exploring HIPAA and HITECH Act Definitions: Parts 11-15*, include definitions from: American Recovery and Reinvestment Act of 2009 (February 17, 2009, pp.258-259), Health Information Technology for Economic and Clinical Health Act, Title XIII—Health Information Technology, Subtitle D—Privacy, Section 13400—Definitions. ***Payment*** Has the meaning given such term in section 164.501 of title 45, Code of Federal Regulations \[CFR\]: “(1) The activities undertaken by: (i) A health plan to obtain premiums or to determine or fulfill its responsibility for coverage and provision of benefits under the health plan; or (ii) A health care provider or health plan to obtain or provide reimbursement for the provision of health care; and (2) The activities in paragraph (1) of this definition relate to the individual to whom health care is provided and include, but are not limited to: (i) Determinations of eligibility or coverage (including coordination of benefits or the determination of cost sharing amounts), and adjudication or subrogation of health benefit claims; (ii) Risk adjusting amounts due based on enrollee health status and demographic characteristics; (iii) Billing, claims management, collection activities, obtaining payment under a contract for reinsurance (including stop-loss insurance and excess of loss insurance), and related health care data processing; (iv) Review of health care services with respect to medical necessity, coverage under a health plan, appropriateness of care, or justification of charges; (v) Utilization review activities, including precertification and preauthorization of services, concurrent and retrospective review of services; and (vi) Disclosure to consumer reporting agencies of any of the following protected health information relating to collection of premiums or reimbursement: (A) Name and Address; (B) Date of birth’ (C) Social Security number; (D) Payment history; (E) Account number; and (F) Name and address of the health care provider and/or health plan.” ***Personal Health Record*** An electronic record of PHR identifiable health information (as defined in section 13407(f)(2)\[1\] on an individual that can be drawn from multiple sources and that is managed, shared, and controlled by or primarily for the individual. ***Protected Health Information*** Has the meaning given such term in section 160.103 of title 45, Code of Federal Regulations \[CFR\]: “Individually identifiable health information: (1) Except as provided in paragraph (2) of this definition, that is: (i) Transmitted by electronic media; (ii) Maintained in electronic media; or (iii) Transmitted or maintained in any other form or medium. (2) *Protected health information* excludes individually identifiable health information in: (i) Education records covered by the Family Educational Rights and Privacy Act, as amended, 20 U.S.C. 1232g; (ii) Records described at 20 U.S.C. 1232g(a)(4)(B)(iv); and (iii) Employment records held by a covered entity in its role as employer.” \[1\] *PHR Identifiable Health Information* “means individually identifiable health information, as defined in section 1171(6) of the Social Security Act (42 U.S.C. 1320d(6)), and includes, with respect to an individual, information—(A) that is provided or on behalf of the individual; and (B) that identifies the individual or with respect to which there is a reasonable basis to believe that the information can be used to identify the individual.” \[*HITECH Act*, p.156\] ### ONC's Dr. Blumenthal Announces SHARP Program Funding Availability URL: https://hipaa.com/oncs-dr-blumenthal-announces-sharp-program-funding-availability/ Last updated: 2009-12-21T16:47:55.000Z Please read the following announcement released on December 18, 2009: **A Message from Dr. David Blumenthal, National Coordinator for Health Information Technology** Today the Obama administration announced the availability of $60 million in Recovery Act funds to support the development of the [Strategic Health IT Advanced Research Projects (SHARP)](http://links.govdelivery.com/track?type=click&enid=bWFpbGluZ2lkPTY2NzQxMCZtZXNzYWdlaWQ9UFJELUJVTC02Njc0MTAmZGF0YWJhc2VpZD0xMDAxJnNlcmlhbD0xMjE1NjMzNDUyJmVtYWlsaWQ9c2NodXBzQGFvbC5jb20mdXNlcmlkPXNjaHVwc0Bhb2wuY29tJmV4dHJhPSYmJg==&&&100&&&http://healthit.hhs.gov/portal/server.pt?open=512&objID=1436&parentname=CommunityPage&parentid=8&mode=2&in%5Fhi%5Fuserid=11113&cached=true&ref=hipaa.com) program. SHARP awards will fund research focused on identifying technology solutions to address well-documented problems impeding broad adoption of health information technology (health IT). By helping to overcome key challenges, the research will also accelerate progress towards achieving nationwide meaningful use of health IT. As we continue this unprecedented effort towards meaningful use and seamless, secure information exchange, we also must acknowledge that there remains a gap between the promise of health IT and the realization of its full benefits. To achieve the goal of a transformed health care delivery system, it’s critical that we close this gap by enabling a robust research infrastructure that can focus on areas where “breakthrough” advances are needed to help clear obstacles to adoption. Under the SHARP program, four awardees will receive funding to develop multidisciplinary research projects that will identify such breakthrough solutions. SHARP program awardees will create research programs that draw from many areas of expertise. They will focus on issues of central interest to all health IT stakeholders, fostering considerable discussion and debate. If for example, SHARP research helped identify new methods to create tools that will, through their incorporation into deployed technology, enhance data security, then public trust in the electronic maintenance and exchange of health information would be reinforced and strengthened – which would in turn help encourage broader adoption. Areas requiring this innovative research approach that will be tackled by the SHARP awardees include the security of health IT, patient-centered cognitive support, application and network platform architectures, and the secondary use of EHR data as a way of measuring and improving quality of care. Another important aspect of the SHARP program is that the research projects will bring together key stakeholders – researchers, patient groups, health care providers, and others – to work with one another to transform health IT research into applications. This collaborative approach allows us to consider the many voices of health IT stakeholders, and work together towards common goals. With our eyes on the vision of patient-centered, quality health care we can focus research on innovative, pragmatic, and realistic solutions, which can then be implemented across the nation. I truly look forward to seeing the innovative research that emerges from this program. I know that this research will provide critical insights that will bring us closer every day to a better, more efficient health care delivery system, enabled by health IT and empowered by the seamless and secure exchange of electronic health information. Sincerely, **David Blumenthal, M.D., M.P.P.** National Coordinator for Health Information Technology U.S. Department of Health & Human Services ### Exploring HIPAA and HITECH Act Definitions: Part 13 URL: https://hipaa.com/exploring-hipaa-and-hitech-act-definitions-part-13/ Last updated: 2009-12-17T13:00:04.000Z From now through December, HIPAA.com is providing a run through of HIPAA transaction & code set, privacy, and security definitions, along with relevant HITECH Act definitions pertaining to breach notification, securing of protected health information, and electronic health record (EHR) standards development and adoption. These definitions are key to understanding the referenced HIPAA and HITECH Act enabling regulations that are effective now and that will require compliance by covered entities and business associates now or in the months ahead, as indicated in HIPAA.com’s timeline. Each posting will contain three definitions, with a date reference to the Federal Register, Code of Federal Regulations (CFR), or statute, as appropriate. *Exploring HIPAA and HITECH Act Definitions: Parts 11-15*, include definitions from: American Recovery and Reinvestment Act of 2009 (February 17, 2009, pp.258-259), Health Information Technology for Economic and Clinical Health Act, Title XIII—Health Information Technology, Subtitle D—Privacy, Section 13400—Definitions. ***Health Care Provider*** Has the meaning given such term in section 160.103 of title 45, Code of Federal Regulations \[CFR\]: “A provider of services (as defined in section 1861(u) of the \[Social Security\] Act, 42 U.S.C. 1395x(u)), a provider of medial or health services (as defined in section 1861(s) of the \[Social Security\] Act, 42 U.S.C. 1395x(s), and any other person or organization who furnishes, bills, or is paid for health care in the normal course of business.” ***Health Plan*** Has the meaning given such term in section 160.103 of title 45, Code of Federal Regulations \[CFR\]: “*Health plan* means an individual or group plan that provides, or pays the cost of, medical care (as defined in section 2791(a)(2) of the PHS \[Public Health Service\] Act, 42 U.S.C. 300gg-91(a)(2). (1) *Health plan* includes the following, singly or in combination: (i) A group health plan, as defined in this section. (ii) A health insurance issuer, as defined in this section. (iii) An HMO, as defined in this section. (iv) Part A or Part B of the Medicare program under title XVIII of the Act. (v) The Medicaid program under title XIX of the Act, 42 U.S.C. 1396, *et.seq*. (vi) An issuer of a Medicare supplemental policy (as defined in section 1882(g)(1) of the Act, 42 U.S.C. 1395ss(g)(1)). (vii) An issuer of a long-term care policy, excluding a nursing home fixed-indemnity policy. (viii) An employee welfare benefit plan or any other arrangement that is established or maintained for the purpose of offering or providing health benefits to the employees of two or more employers. (ix) The health care program for active military personnel under title 10 of the United States Code. (x) The veterans health care program under 38 U.S.C. chapter 17. (xi) The Civilian Health and Medical Program of the Uniformed Services (CHAMPUS) (as defined in 10 U.S.C. 1072(4)). (xii) The Indian Health Service program under the Indian Health Care Improvement Act, 25 U.S.C. 1601, *et.seq*. (xiii) The Federal Employees Health Benefits Program under 5 U.S.C. 8902, *et.seq*. (xiv) An approved State child health plan under title XXI of the Act, providing benefits for child health assistance that meet the requirements of section 2103 of the Act, 42 U.S.C. 1397, *et.seq*. (xv) The Medicare+Choice program under Part C of title XVIII of the Act, 42 U.S.C. 1395w-21 through 1395w-28. (xvi) A high risk pool that is a mechanism established under State law to provide health insurance coverage or comparable coverage to eligible individuals. (xvii) Any other individual or group plan, or combination of individual or group plans, that provides or pays for the cost of medical care (as defined in section 2791(a)(2) of the PHS Act, 42 U.S.C. 300gg-91(a)(2)). (2) *Health Plan* excludes: (i) Any policy, plan, or program to the extent that it provides, or pays for the cost of, excepted benefits that are listed in section 2791(c)(1) of the PHS Act, 42 U.S.C. 300gg-91(c)(1); and (ii) A government-funded program (other than one listed in paragraph (1)(i)-(xvi) of this definition): A. Whose principal purpose is other than providing, or paying the cost of, health care; or B. Whose principal activity is: (1) The direct provision of health care to persons; or (2) The making of grants to fund the direct provision of health care to persons." ***National Coordinator*** The head of the Office of the national Coordinator for Health Information Technology established under section 3001(a) of the Public Health Service Act, as added by section 13101. ### Exploring HIPAA and HITECH Act Definitions: Part 12 URL: https://hipaa.com/exploring-hipaa-and-hitech-act-definitions-part-12/ Last updated: 2009-12-15T16:00:53.000Z From now through December, HIPAA.com is providing a run through of HIPAA transaction & code set, privacy, and security definitions, along with relevant HITECH Act definitions pertaining to breach notification, securing of protected health information, and electronic health record (EHR) standards development and adoption. These definitions are key to understanding the referenced HIPAA and HITECH Act enabling regulations that are effective now and that will require compliance by covered entities and business associates now or in the months ahead, as indicated in HIPAA.com’s timeline. Each posting will contain three definitions, with a date reference to the Federal Register, Code of Federal Regulations (CFR), or statute, as appropriate. *Exploring HIPAA and HITECH Act Definitions: Parts 11-15*, include definitions from: American Recovery and Reinvestment Act of 2009 (February 17, 2009, pp.258-259), Health Information Technology for Economic and Clinical Health Act, Title XIII—Health Information Technology, Subtitle D—Privacy, Section 13400—Definitions. ***Disclose*** The terms ‘disclose’ and ‘disclosure’ have the meaning given the term ‘disclosure’ in section 160.103 of title 45, Code of Federal Regulations \[CFR\]: “The release, transfer, provision of, access to, or divulging in any other manner of information outside the entity holding the information.” ***Electronic Health Record*** An electronic record of health-related information on an individual that is created, gathered, managed, and consulted by authorized health care clinicians and staff. ***Health Care Operations*** Has the meaning given such term in section 164.501 of title 45, Code of Federal Regulations \[CFR\]: “Health care operations means any of the following activities of the covered entity to the extent that the activities are related to covered functions: (1) Conducting quality assessment and improvement activities, including outcomes evaluation and development of clinical guidelines, provided that the obtaining of generalizable knowledge is not the primary purpose of any studies resulting from such activities; population-based activities relating to improving health or reducing health care costs, protocol development, case management and care coordination, contacting of health care providers and patients with information about treatment alternatives; and related functions that do not include treatment; (2) Reviewing the competence or qualifications of health care professionals, evaluating practitioner and provider performance, health plan performance, conducting training programs in which students, trainees, or practitioners in areas of health care learn under supervision to practice or improve their skills as health care providers, training of non-health care professionals, accreditation, certification, licensing, or credentialing activities. (3) Underwriting, premium rating, and other activities relating to the creation, renewal or replacement of a contract of health insurance or health benefits, and ceding, securing, or placing a contract for reinsurance of risk relating to claims for health care (including stop-loss insurance and excess of loss insurance), provided that the requirements of § 164.514(g)\[1\] are met, if applicable; (4) Conducting or arranging for medical review, legal services, and auditing functions, including fraud and abuse detection and compliance programs; (5) Business planning and development, such as conducting cost-management and planning-related analyses related to managing and operating the entity, including formulary development and administration, development or improvement of methods of payment or coverage policies; and (6) Business management and general administrative activities of the entity, including, but not limited to: (i) Management activities relating to implementation of and compliance with requirements of this subchapter; (ii) Customer service, including the provision of data analyses for policy holders, plan sponsors, or other customers, provided that protected health information is not disclosed to such policy holder, plan sponsor, or customer; (iii) Resolution of internal grievances; (iv) The sale, transfer, merger, or consolidation of all or part of the covered entity with another covered entity, or an entity that following such activity will become a covered entity and due diligence related to such activity; and (v) Consistent with the applicable requirements of § 164.514,\[2\] creating de-identified health information or a limited data set, and fundraising for the benefit of the covered entity.” \[1\] “(g) *Standard: Uses and disclosures for underwriting and related purposes*. If a health plan receives protected health information for the purpose of underwriting, premium rating, or other activities relating to the creation, renewal, or replacement of a contract of health insurance or health benefits, and if such health insurance or health benefits are not placed with the health plan, such health plan may not use of disclose such protected health information for any other purpose, except, as may be required by law.” \[2\] “Other requirements relating to uses and disclosures of protected health information.” ### Exploring HIPAA and HITECH Act Definitions: Part 11 URL: https://hipaa.com/exploring-hipaa-and-hitech-act-definitions-part-11/ Last updated: 2009-12-08T15:10:56.000Z From now through November, HIPAA.com is providing a run through of HIPAA transaction & code set, privacy, and security definitions, along with relevant HITECH Act definitions pertaining to breach notification, securing of protected health information, and electronic health record (EHR) standards development and adoption. These definitions are key to understanding the referenced HIPAA and HITECH Act enabling regulations that are effective now and that will require compliance by covered entities and business associates now or in the months ahead, as indicated in HIPAA.com’s timeline. Each posting will contain three definitions, with a date reference to the Federal Register, Code of Federal Regulations (CFR), or statute, as appropriate. *Exploring HIPAA and HITECH Act Definitions: Parts 11-15*, include definitions from: American Recovery and Reinvestment Act of 2009 (February 17, 2009, pp.258-259), Health Information Technology for Economic and Clinical Health Act, Title XIII—Health Information Technology, Subtitle D—Privacy, Section 13400—Definitions. ***Breach*** (A) In General—The term ‘breach’ means the unauthorized acquisition, access, use, or disclosure of protected health information which compromises the security or privacy of such information, except where an unauthorized person to whom such information is disclosed would not reasonably have been able to retain such information. (B) Exceptions—The term ‘breach’ does not include— 1. Any unintentional acquisition, access, or use of protected health information by an employee or individual acting under the authority of a covered entity or business associate if— 1. Such acquisition, access, or use was made in good faith and within the course and scope of the employment or other professional relationship of such employee or individual, respectively, with the covered entity or business associate; and 2. Such information is not further acquired, accessed, used, or disclosed by an person; or 2. Any inadvertent disclosure from an individual who is otherwise authorized to access protected health information at a facility operated by a covered entity or business associate to another similarly situated individual at same facility; and 3. Any such information received as a result of such disclosure is not further acquired, accessed, used, or disclosed without authorization by any person. \[Note: The definition of '*breach*' in the enabling regulation is different in several respects from the statutory definition above, including introduction of consideration of risk of harm to the individual: *Breach* means the acquisition, access, use, or disclosure of protected health information in a manner not permitted under subpart E \[Privacy of Individually Identifiable Health Information\] of this part \[45 CFR 164: Security and Privacy\] which compromises the security or privacy of the protected health information. (1)(i) For purposes of this definition, *compromises the security or privacy of the protected health information* means poses a significant risk of financial, reputational, or other harm to the individual. (ii) A use or disclosure of protected health information that does not include the identifiers listed at § 164.514(e)(2) \[Implementation Specification for the *Limited Data Set* standard\], date of birth, and zip code does not compromise the security or privacy of the protected health information. (2) Breach excludes: (i) Any unintentional acquisition, access, or use of protected health information by a workforce member or person acting under the authority of a covered entity or business associate, if such acquisition, access, or use was made in good faith and within the scope of authority and does not result in further use or disclosure in a manner not permitted under subpart E of this part. (ii) Any inadvertent disclosure by a person who is authorized to access protected health information at a covered entity or business associate to another person authorized to access protected health information at the same covered entity or business associate, or organized health care arrangement in which the covered entity participates, and the information received as a result of such disclosure is not further used or disclosed in a manner not permitted under subpart E of this part. (iii) A disclosure of protected health information where a covered entity or business associate has a good faith belief that an unauthorized person to whom the disclosure was made would not reasonably have been able to retain such information. See Department of Health and Human Services, Office of the Secretary, "45 CFR Parts 160 and 164--Breach Notification for Unsecured Protected Health Information; Interim Final Rule," Federal Register , v. 74, n. 162, August 24, 2009, pp.42767-42768.\] ***Business Associate*** Has the meaning given such term in section 160.103 of title 45, Code of Federal Regulations \[CFR\]: “(1) Except as provided in paragraph (2) of this definition, *business associate* means, with respect to a covered entity, a person who: 1. On behalf of such covered entity or of an organized health care arrangement (as defined in § 164.501 of this subchapter) in which the covered entity participates, but other than in the capacity of a member of the workforce of such covered entity or arrangement, performs, or assists in the performance of: 1. A function or activity involving the use or disclosure of individually identifiable health information, including claims processing or administration, data analysis, processing or administration, utilization review, quality assurance, billing, benefit management, practice management, and repricing; or 2. Any other function or activity regulated by this subchapter; or 3. Provides, other than in the capacity of a member of the workforce of such covered entity, legal, actuarial, accounting, consulting, data aggregation (as defined in § 164.501 of this subchapter), management, administrative, accreditation, or financial services to or for such covered entity, or to or for an organized health care arrangement in which the covered entity participates, where the provision of the service involves the disclosure of individually identifiable health information from such covered entity or arrangement, or from another business associate of such covered entity or arrangement, to the person. (2) A covered entity participating in an organized health care arrangement that performs a function or activity as described by paragraph (1)(i) of this definition for or on behalf of such organized health care arrangement, or that provides a service as described in paragraph (1)(ii) of this definition to or for such organized health care arrangement, does not, simply through the performance of such function or activity or the provision of such service, become a business associate of other covered entities participating in such organized health care arrangement. (3) A covered entity may be a business associate of another covered entity.” ***Covered Entity*** Has the meaning given such term in section 160.103 of title 45, Code of Federal Regulations \[CFR\]: “(1) A health plan. (2) A health care clearinghouse. (3) A health care provider who transmits any health information in electronic form in connection with a transaction covered by this subchapter.” ### Six Primary Goals of the HITECH Breach Notification Requirement URL: https://hipaa.com/six-primary-goals-of-the-hitech-breach-notification-requirement/ Last updated: 2026-10-24T21:32:57.000Z The first part of the HITECH Act is called "Improved Privacy Provisions and Security Provisions". Section 13402 is the section that starts the discussion of privacy and security and is titled "Notification in case of breach". This section accomplishes the following: 1. Identifies who this section applies to: Covered Entities and Business Associates. 2. Defines the time frame as to when breaches should be reported to individuals, and depending on severity, mass media, and the Department of Health and Human Services (HHS). 3. The type of information that must appear in the notification letters. 4. Definition of Unsecured Protected Health Information. Note that the HITECH Act delegated the final definition to the HHS vis a vis a "guidance". The [guidance](https://hipaa.com/content/files/2026/10/federal%5Fregister%5Fvol%5F74.pdf) was issued on 4/27/2009 in the Federal Register. 5. Requires HHS to report to Congress no later than 12 months after the date of enactment the nature of the breaches that occurred. 6. Time period of when the final regulations go into effect. Section 13402 of the HITECH Act sets a very important precedent and provides notice to the healthcare industry that the Federal government is serious about securing health records. Another purpose of the HITECH Act is to incentivize healthcare providers to move from paper to electronic records. Confidence in the security of those electronic records is crucial to the adoption of electronic health records and in general, is good public policy. It should be noted that Congress essentially delegated the details of how the breach notification law is to be executed (know as a rule) to HHS. In August, 2009 HHS issued [the interim final](https://hipaa.com/content/files/2026/10/interim%5Ffinal%5Fruling.pdf) rule on breach notification and the rule went into effect in September, 2009\. However, enforcement will not officially start until February, 2010, although HHS reserves the right to enforce the rules prior to February, 2010 as it sees fit. ### Exploring HIPAA and HITECH Act Definitions: Part 10 URL: https://hipaa.com/exploring-hipaa-and-hitech-act-definitions-part-10/ Last updated: 2009-11-25T16:30:34.000Z From now through November, HIPAA.com is providing a run through of HIPAA transaction & code set, privacy, and security definitions, along with relevant HITECH Act definitions pertaining to breach notification, securing of protected health information, and electronic health record (EHR) standards development and adoption. These definitions are key to understanding the referenced HIPAA and HITECH Act enabling regulations that are effective now and that will require compliance by covered entities and business associates now or in the months ahead, as indicated in HIPAA.com’s timeline. In this posting we highlight the last two definitions from the following HITECH Act section: *Exploring HIPAA and HITECH Act Definitions: Parts 6-10*, include definitions from: American Recovery and Reinvestment Act of 2009 (February 17, 2009, pp.228-229), Health Information Technology for Economic and Clinical Health Act, Title XIII—Health Information Technology, Subtitle A—Promotion of Health Information Technology, Section 13101—ONCHIT \[Office of the National Coordinator for Health Information Technology\]; Standards Development and Adoption, Title XXX—Health Information Technology and Quality, Section 3000—Definitions (also designated as 42 USC 300jj). ***Qualified Electronic Health Record*** An electronic record of health-related information on an individual that— (A) Includes patient demographic and clinical health information, such as medical history and problem lists; and (B) Has the capacity— 1. To provide clinical decision support; 2. To support physician order entry; 3. To capture and query information relevant to health care quality; and 4. To exchange electronic health information with, and integrate such information from other sources. ***State*** Each of the several states, the District of Columbia, Puerto Rico, the Virgin Islands, Guam, American Samoa, and the Northern Mariana Islands. ### Exploring HIPAA and HITECH Act Definitions: Part 9 URL: https://hipaa.com/exploring-hipaa-and-hitech-act-definitions-part-9/ Last updated: 2009-11-23T19:00:29.000Z From now through November, HIPAA.com is providing a run through of HIPAA transaction & code set, privacy, and security definitions, along with relevant HITECH Act definitions pertaining to breach notification, securing of protected health information, and electronic health record (EHR) standards development and adoption. These definitions are key to understanding the referenced HIPAA and HITECH Act enabling regulations that are effective now and that will require compliance by covered entities and business associates now or in the months ahead, as indicated in HIPAA.com’s timeline. Each posting will contain three definitions, with a date reference to the Federal Register, Code of Federal Regulations (CFR), or statute, as appropriate. *Exploring HIPAA and HITECH Act Definitions: Parts 6-10*, include definitions from: American Recovery and Reinvestment Act of 2009 (February 17, 2009, pp.228-229), Health Information Technology for Economic and Clinical Health Act, Title XIII—Health Information Technology, Subtitle A—Promotion of Health Information Technology, Section 13101—ONCHIT \[Office of the National Coordinator for Health Information Technology\]; Standards Development and Adoption, Title XXX—Health Information Technology and Quality, Section 3000—Definitions (also designated as 42 USC 300jj). ***Laboratory*** Has the meaning given such term in section 353(a). ***National Coordinator*** The head of the Office of the National Coordinator for Health Information Technology established under section 3001(a). ***Pharmacist*** Has the meaning given such term in section 804(2) of the Federal Food, Drug, and Cosmetic Act. ### Exploring HIPAA and HITECH Act Definitions: Part 8 URL: https://hipaa.com/exploring-hipaa-and-hitech-act-definitions-part-8/ Last updated: 2009-11-19T16:30:56.000Z From now through November, HIPAA.com is providing a run through of HIPAA transaction & code set, privacy, and security definitions, along with relevant HITECH Act definitions pertaining to breach notification, securing of protected health information, and electronic health record (EHR) standards development and adoption. These definitions are key to understanding the referenced HIPAA and HITECH Act enabling regulations that are effective now and that will require compliance by covered entities and business associates now or in the months ahead, as indicated in HIPAA.com’s timeline. Each posting will contain three definitions, with a date reference to the Federal Register, Code of Federal Regulations (CFR), or statute, as appropriate. *Exploring HIPAA and HITECH Act Definitions: Parts 6-10*, include definitions from: American Recovery and Reinvestment Act of 2009 (February 17, 2009, pp.228-229), Health Information Technology for Economic and Clinical Health Act, Title XIII—Health Information Technology, Subtitle A—Promotion of Health Information Technology, Section 13101—ONCHIT \[Office of the National Coordinator for Health Information Technology\]; Standards Development and Adoption, Title XXX—Health Information Technology and Quality, Section 3000—Definitions (also designated as 42 USC 300jj). ***HIT Policy Committee*** Such Committee established under section 3002(a).\[1\] ***HIT Standards Committee*** Such Committee established under section 3003(a).\[2\] ***Individually Identifiable Health Information*** Has the meaning given such term in section 1171(6) of the Social Security Act: “Any information, including demographic information collected from an individual, that— (A) Is created or received by a health care provider, health plan, employer, or health care clearinghouse; and (B) Relates to the past, present, or future physical or mental health or condition of an individual, the provision of health care to an individual, or the past, present, or future payment for the provision of health care to an individual, and— 1. Identifies the individual; or 2. With respect to which there is a reasonable basis to believe that the information can be used to identify the individual.” \[1\] *HIT Policy Committee (Establishment)*. \[2\] *HIT Standards Committee (Establishment)*. ### Exploring HIPAA and HITECH Act Definitions: Part 7 URL: https://hipaa.com/exploring-hipaa-and-hitech-act-definitions-part-7/ Last updated: 2009-11-17T18:08:40.000Z From now through November, HIPAA.com is providing a run through of HIPAA transaction & code set, privacy, and security definitions, along with relevant HITECH Act definitions pertaining to breach notification, securing of protected health information, and electronic health record (EHR) standards development and adoption. These definitions are key to understanding the referenced HIPAA and HITECH Act enabling regulations that are effective now and that will require compliance by covered entities and business associates now or in the months ahead, as indicated in HIPAA.com’s timeline. Each posting will contain three definitions, with a date reference to the Federal Register, Code of Federal Regulations (CFR), or statute, as appropriate. *Exploring HIPAA and HITECH Act Definitions: Parts 6-10*, include definitions from: American Recovery and Reinvestment Act of 2009 (February 17, 2009, pp.228-229), Health Information Technology for Economic and Clinical Health Act, Title XIII—Health Information Technology, Subtitle A—Promotion of Health Information Technology, Section 13101—ONCHIT \[Office of the National Coordinator for Health Information Technology\]; Standards Development and Adoption, Title XXX—Health Information Technology and Quality, Section 3000—Definitions (also designated as 42 USC 300jj). ***Health Information*** Has the meaning given such term in section 1171(4) of the Social Security Act: “Any information, whether oral or recorded in any form or medium, that— (A) is created or received by a health care provider, health plan, public health authority, employer, life insurer, school or university, or health care clearinghouse; and (B) relates to the past, present, or future physical or mental health or condition of an individual, the provision of health care to an individual, or the past, present, or future payment for the provision of health care to an individual.” ***Health Information Technology*** Hardware, software, integrated technologies or related licenses, intellectual property, upgrades, or packaged solutions sold as services that are designed for or support the use by health care entities or patients for the electronic creation, maintenance, access, or exchange of health information. ***Health Plan*** Has the meaning given such term in section 1171(5) of the Social Security Act: “An individual or group plan that provides, or pays the cost of, medical care (as such term is defined in section 2791 of the Public Health Service Act.) Such term includes the following, and any combination thereof: (A) A group health plan (as defined in section 2791(a) of the Public Health Service Act), but only if the plan— 1. Has 50 or more participants (as defined in section 3(7) of the Employee Retirement Income Security Act of 1974); or 2. Is administered by an entity other than the employer who established and maintains the plan. (B) A health insurance issuer (as defined in section 2791(b) of the Public Health Service Act). (C) A health maintenance organization (as defined in section 2791(b) of the Public Health Service Act). (D) Part A, B, or C of the Medicare program under title XVIII. (E) The Medicaid program under title XIX. (F) A Medicare supplemental policy (as defined in section 1882(g)(1)). (G) A long-term care policy, including a nursing home fixed indemnity policy (unless the Secretary \[of HHS\] determines that such a policy does not provide sufficiently comprehensive coverage of a benefit so that the policy should be treated as a health plan). (H) An employee welfare benefit plan or any other arrangement which is established or maintained for the purpose of offering or providing health benefits to the employees of 2 or more employers. (I) The health care program for active military personnel under title 10, United States Code. (J) The veterans health care program under chapter 17 of title 38, United States Code. (K) The Civilian Health and Medical Program of the Uniformed Services (CHAMPUS), as defined in section 1072(4) of title 10, United States Code. (L) The Indian health service program under the Indian Health Care Improvement Act (25 U.S.C. 1601 et seq.). (M) The Federal Employees Health Benefit Plan under chapter 89 of title 5, United State Code.” ### HITECH and HIPAA Training: Time to Double Down URL: https://hipaa.com/hitech-and-hipaa-training-time-to-double-down/ Last updated: 2009-11-13T16:12:56.000Z As the healthcare industry continues to digest profound HITECH changes to HIPAA Privacy and Security rules, two observations already are apparent and indisputable for covered entities and their business associates. First, time and resources spent on a workforce that is well-trained on the Privacy and Security rules will be an investment of exponential value. Second, enforcement of those same rules will make negligent and uncorrected errors very costly. A well-trained workforce makes fewer mistakes, and identifies and fixes those that it makes. A workforce that violates the rules because it does not know them or does not care to know them makes an inviting target for HITECH’s new enforcement initiatives. The lesson seems clear: train on HITECH and re-train on existing HIPAA rules--or pay some new and onerous penalties for workforce mistakes. Here are three hard truths about the HITECH amendments. First, after HITECH, penalties for each violation of HIPAA can now exceed civil penalties for violating the anti-kickback statute. Second, HITECH mandates much more enforcement by HHS, including compliance audits, and allows enforcement by state Attorneys General. Third, under the recently adopted breach notification rules, covered entities are required to submit annually logs of protected health information (PHI) breaches to the Secretary of HHS. Because by definition each of those reported “breaches” involves a violation of the Privacy Rule, covered entities also will be informing the Secretary of their Privacy Rule violations. You won’t have to worry about possible whistleblowers; you are the whistleblower. One major piece of good news in HITECH is that Congress provided that unless a violation is caused by willful neglect, penalties for the violation may be avoided by taking corrective action within 30 days. This is where training comes in, and where training pays off. A vigorous training program enables the workforce of a covered entity to identify violations quickly because the workforce knows what are proper PHI uses and disclosures and what are not. For example, if workforce members do not understand the concept of “minimum necessary”, they will not know that sending an entire medical record to a third party payer is highly likely to violate the Privacy Rule. If workforce members know what is the “minimum necessary” disclosure, they will either avoid an improper disclosure or move to correct it within the thirty-day corrective action grace period. As with so many other areas of HIPAA, HITECH introduces many new concepts. New regulations have been published on unsecured breaches and more regulations are coming on privacy, security, and enforcement. Making these rules comprehensible to your workforce members (including management) and applicable to your environment requires training—and some re-training on the existing HIPAA Privacy and Security rules and how they all fit together. ### Exploring HIPAA and HITECH Act Definitions: Part 6 URL: https://hipaa.com/exploring-hipaa-and-hitech-act-definitions-part-6/ Last updated: 2009-11-12T15:08:31.000Z From now through November, HIPAA.com is providing a run through of HIPAA transaction & code set, privacy, and security definitions, along with relevant HITECH Act definitions pertaining to breach notification, securing of protected health information, and electronic health record (EHR) standards development and adoption. These definitions are key to understanding the referenced HIPAA and HITECH Act enabling regulations that are effective now and that will required compliance by covered entities and business associates now or in the months ahead, as indicated in HIPAA.com’s timeline. Each posting will contain three definitions, with a date reference to the Federal Register, Code of Federal Regulations (CFR), or statute, as appropriate. *Exploring HIPAA and HITECH Act Definitions: Parts 6-10*, include definitions from: American Recovery and Reinvestment Act of 2009 (February 17, 2009, pp.228-229), Health Information Technology for Economic and Clinical Health Act, Title XIII—Health Information Technology, Subtitle A—Promotion of Health Information Technology, Section 13101—ONCHIT \[Office of the National Coordinator for Health Information Technology\]; Standards Development and Adoption, Title XXX—Health Information Technology and Quality, Section 3000—Definitions (also designated as 42 USC 300jj). *Certified EHR Technology* A qualified electronic health record \[EHR\] that is certified pursuant to section 3001(c)(5)\[1\] as meeting standards adopted under section 3004\[2\] that are applicable to the type of record involved (as determined by the Secretary \[of HHS\], such as an ambulatory electronic health record for office-based physicians or an inpatient hospital electronic health record for hospitals). *Enterprise Integration* The electronic linkage of health care providers, health plans, the government, and other interested parties, to enable the electronic exchange and use of health information among all the components in the health care infrastructure in accordance with applicable law, and such term includes related application protocols and other related standards. *Health Care Provider* Includes a hospital, skilled nursing facility, nursing facility, home health entity or other long term care facility, health care clinic, community mental health center (as defined in section 1913(b)(1), renal dialysis facility, blood center, ambulatory surgical center described in section 1833(i) of the Social Security Act, emergency medical services provider, Federally qualified health center, group practice, a pharmacist, a pharmacy, a laboratory, a physician (as defined in section 1861(r) of the Social Security Act), a practitioner (as described in section 1842(b)(18)(C) of the Social Security Act), a provider operated by, or under contract with, the Indian Health Service or by an Indian tribe (as defined in the Indian Self-Determination and Education Assistance Act), tribal organization, or urban Indian organization (as defined in section 4 of the Indian Health Care Improvement Act), a rural health clinic, a covered entity under section 340B, and ambulatory surgical center described in section 1833(i) of the Social Security Act, a therapist (as defined in section 1848(k)(3)(B)(iii) of the Social Security Act, and any other category of health care facility, entity, practitioner, or clinician determined appropriate by the Secretary \[of HHS\]. \[1\] ONCHIT (Duties of the National Coordinator (*Certification))*. \[2\] *Process for Adoption of Endorsed Recommendations; Adoption of Initial Set of Standards, Implementation Specifications, and Certification Criteria*. ### House Passes Health Care Reform Bill: H.R. 3962, as Amended URL: https://hipaa.com/house-passes-health-care-reform-bill-h-r-3962-as-amended/ Last updated: 2009-11-09T15:04:11.000Z On Saturday night, November 7, 2009, the U.S. House of Representatives passed H.R. 3962, the Affordable Health Care for America Act. The vote was 220 in favor, 215 against. The roll call for the vote is available online at the [US House Office of the Clerk website](http://clerk.house.gov/evs/2009/roll887.xml?ref=hipaa.com). H.R. 3962 as introduced in the House on October 29, 2009, following Committee action, available [here](http://thomas.loc.gov/cgi-bin/query/z?c111:H.R.3962&ref=hipaa.com). A chronology of all Congressional actions on this bill is available [here](http://thomas.loc.gov/cgi-bin/bdquery/z?d111:HR03962:@@@S&ref=hipaa.com). Finally, various sources of information pertaining to HR 3962, including Committee reports, are available [here](http://thomas.loc.gov/cgi-bin/bdquery/z?d111:HR3962:/&ref=hipaa.com). Action now moves to the Senate on Health Care Reform, which may be later this year or early in 2010\. H.R. 3962, as amended, passed in the House, and referred to the Senate, will be available on the last listed site above, and will be posted on HIPAA.com for download, when it is available. ### Exploring HIPAA and HITECH Act Definitions: Part 5 URL: https://hipaa.com/exploring-hipaa-and-hitech-act-definitions-part-5/ Last updated: 2009-11-04T17:00:14.000Z From now through November, HIPAA.com is providing a run through of HIPAA transaction & code set, privacy, and security definitions, along with relevant HITECH Act definitions pertaining to breach notification and securing of protected health information. These definitions are key to understanding the referenced HIPAA and HITECH Act enabling regulations that are effective now and that will require compliance by covered entities and business associates now or in the months ahead, as indicated in HIPAA.com’s timeline. Each posting will contain three definitions, with a date reference to the Federal Register and citation to the Code of Federal Regulations (CFR). We begin the first series of postings with definitions from "**Health Insurance Reform; Modifications to the Health Insurance Portability and Accountability Act (HIPAA); Final Rules,"** Federal Register **, January 16, 2009\. 45 CFR 162, Administrative Requirements: 162.103, Definitions.** ***Maximum Defined Data Set*** All of the required data elements for a particular standard based on a specific implementation specification. ***Segment*** A group of related data elements in a transaction. ***Standard Transaction*** A transaction that complies with an applicable standard adopted under this part \[162\]. ### HHS Strengthens HIPAA Enforcement URL: https://hipaa.com/hhs-strengthens-hipaa-enforcement/ Last updated: 2026-10-24T21:32:58.000Z On Friday, October 30, 2009, HHS published in the *Federal Register* its Interim Final Rule that strengthens HIPAA enforcement under HITECH Act civil penalty revisions enacted as part of the American Recovery and Reinvestment Act on February 17, 2009\. "These HITECH Act revisions significantly increase the penalty amounts the Secretary \[of HHS\] may impose for violations of the HIPAA rules and encourage prompt corrective action," according to the HHS press release. The Interim Final Rule is effective as federal policy on November 30, 2009, and HHS requests comments by December 29, 2009. With the definition of 'breach' in the HITECH Act moving privacy and security violations under one requirement requiring remediation, and notification if protected health information is 'unsecured', HHS, on July 27, 2009, moved HIPAA Security Rule enforcement from the Centers for Medicare & Medicaid Services (CMS) to HHS' Office of Civil Rights (OCR), which has been responsible for enforcement of the HIPAA Privacy Rule since compliance was required in April 2003, and now also enforces HITECH Act 'breach notification' requirements. Unified enforcement and higher penalties put a higher price on covered entities--and business associates after February 17, 2010--not being compliant with privacy and security rules pertaining to safeguarding of protected health information. Prior to the HITECH Act revisions, civil penalties for HIPAA violations were "$100 for each violation or $25,000 for all identical violations of the same provision" in a year's period. Now, penalties are tiered in four levels, with a maximum penalty of $1.5 million for all violations of an identical provision in each tier. By tier, the penalties range for each violation from $100-$50,000 for "Did Not Know"; $1,000-$50,000 for "Reasonable Cause"; $10,000-$50,000 for "Willful Neglect--Corrected"; and $50,000 for "Willful Neglect--Not Corrected". According to the OCR Director, Georgina Verdugo, "'The Department's implementation of these HITECH Act enforcement provisions will strengthen the HIPAA protections and rights related to an individual's health information.... This strengthened penalty scheme will encourage health care providers, health plans and other health care entities required to comply with HIPAA to ensure that their compliance programs are effectively designed to prevent, detect and quickly correct violations of the HIPAA rules.'" More information is available in the HHS October 30, 2009 press release, available at [http://www.hhs.gov/news/press/2009pres/10/20091030a.html](http://www.hhs.gov/news/press/2009pres/10/20091030a.html?ref=hipaa.com), and in the October 30, 2009, Interim Final Rule, available [here](https://hipaa.com/content/files/2026/10/e9-26203.pdf). ### Exploring HIPAA and HITECH Act Definitions: Part 4 URL: https://hipaa.com/exploring-hipaa-and-hitech-act-definitions-part-4/ Last updated: 2009-11-02T13:30:29.000Z From now through November, HIPAA.com is providing a run through of HIPAA transaction & code set, privacy, and security definitions, along with relevant HITECH Act definitions pertaining to breach notification and securing of protected health information. These definitions are key to understanding the referenced HIPAA and HITECH Act enabling regulations that are effective now and that will require compliance by covered entities and business associates now or in the months ahead, as indicated in HIPAA.com’s timeline. Each posting will contain three definitions, with a date reference to the Federal Register and citation to the Code of Federal Regulations (CFR). We begin the first series of postings with definitions from "**Health Insurance Reform; Modifications to the Health Insurance Portability and Accountability Act (HIPAA); Final Rules,"** Federal Register **, January 16, 2009\. 45 CFR 162, Administrative Requirements: 162.103, Definitions.** ***Format*** Those data elements that provide or control the enveloping or hierarchical structure, or assist in identifying data content of, a transaction. ***HCPSS*** Health \[Care Financing Administration\] Common Procedure Coding System.\[1\] ***Maintain or Maintenance*** Activities necessary to support the use of a standard adopted by the Secretary \[of HHS\], including technical corrections to an implementation specification, and enhancements or expansion of a code set. This term excludes the activities related to the adoption of a new standard or implementation specification, or modification to an adopted standard or implementation specification. \[1\] Health Care Financing Administration, or HCFA, was the predecessor name for Centers for Medicare & Medicaid Services, or CMS. ### How Data Validation Will Make Your Life Easier URL: https://hipaa.com/how-data-validation-will-make-your-life-easier/ Last updated: 2009-10-30T14:00:24.000Z As a clinician, you want to know if data being entered into the system is accurate, clean, correct and useful. Data validation often called "validation rules" or "check routines" are built into systems such as EHR systems. These rules check for correctness, meaningfulness, and security of data. For example, the system would automatically disallow or question a user trying to enter eligibility results into the patient's address field. Validation rules may be automated because the software company uses a data dictionary, or data may be checked by an explicit application program validation logic. To participate in quality reporting, such as meaningful use, PQRI or ePrescribing reimbursement incentive programs, you want to know if the data extracted from the system will be accurate and relevant. HIPAA’s Security Rule is as much about good business practices as it is about securing confidential patient information. Data integrity, one of the pillars of HIPAA’s Security Rule, contains overarching security themes that pose layered questions, such as, how does the system’s functionality allow you to know who has been in the system, what did the user do with the content after he or she accessed it, or did the system block a potential intruder who did not use the correct user ID and password? When evaluating an EHR system, you want to ask how data validation functionalities work. So during the EHR due diligence, I would ask, "How does your EHR software enable the practitioner to generate quality measurement reports, (suggest you hold up the Meaningful Use Matrix), and how do we validate the data going into the system is accurate and placed in the correct fields?" As an EHR project manager, I request a data validation report on the third and fifth day of Go-Live week so that we can quickly catch and retrain data entry errors. ### Exploring HIPAA and HITECH Act Definitions: Part 3 URL: https://hipaa.com/exploring-hipaa-and-hitech-act-definitions-part-3/ Last updated: 2009-10-29T14:00:16.000Z From now through November, HIPAA.com is providing a run through of HIPAA transaction & code set, privacy, and security definitions, along with relevant HITECH Act definitions pertaining to breach notification and securing of protected health information. These definitions are key to understanding the referenced HIPAA and HITECH Act enabling regulations that are effective now and that will require compliance by covered entities and business associates now or in the months ahead, as indicated in HIPAA.com’s timeline. Each posting will contain three definitions, with a date reference to the Federal Register and citation to the Code of Federal Regulations (CFR). We begin the first series of postings with definitions from "**Health Insurance Reform; Modifications to the Health Insurance Portability and Accountability Act (HIPAA); Final Rules,"** Federal Register **, January 16, 2009\. 45 CFR 162, Administrative Requirements: 162.103, Definitions.** ***Descriptor*** The text defining a code. ***Designated Standard Maintenance Organization (DSMO)*** An organization designated by the Secretary \[of HHS\] under 45 CFR 162.910(a). ***Direct Data Entry*** The direct entry of data (for example, using dumb terminals or web browsers) that is immediately transmitted into a health plan’s computer. ### Exploring HIPAA and HITECH Act Definitions: Part 2 URL: https://hipaa.com/exploring-hipaa-and-hitech-act-definitions-part-2/ Last updated: 2009-10-27T13:17:55.000Z From now through November, HIPAA.com is providing a run through of HIPAA transaction & code set, privacy, and security definitions, along with relevant HITECH Act definitions pertaining to breach notification and securing of protected health information. These definitions are key to understanding the referenced HIPAA and HITECH Act enabling regulations that are effective now and that will require compliance by covered entities and business associates now or in the months ahead, as indicated in HIPAA.com’s timeline. Each posting will contain three definitions, with a date reference to the Federal Register and citation to the Code of Federal Regulations (CFR). We begin the first series of postings with definitions from "**Health Insurance Reform; Modifications to the Health Insurance Portability and Accountability Act (HIPAA); Final Rules,"** Federal Register **, January 16, 2009\. 45 CFR 162, Administrative Requirements: 162.103, Definitions.** ***Data Content*** All the data elements and code sets inherent to a transaction, and not related to the format of the transaction. Data elements that are related to the format are not data content. ***Data Element*** The smallest named unit of information in a transaction. ***Data Set*** A semantically meaningful unit of information exchanged between two parties to a transaction. ### Exploring HIPAA and HITECH Act Definitions: Part 1 URL: https://hipaa.com/exploring-hipaa-and-hitech-act-definitions-part-1/ Last updated: 2009-10-23T14:12:33.000Z From now through November, HIPAA.com is providing a run through of HIPAA transaction & code set, privacy, and security definitions, along with relevant HITECH Act definitions pertaining to breach notification and securing of protected health information. These definitions are key to understanding the referenced HIPAA and HITECH Act enabling regulations that are effective now and that will require compliance by covered entities and business associates now or in the months ahead, as indicated in HIPAA.com’s timeline. Each posting will contain three definitions, with a date reference to the Federal Register and citation to the Code of Federal Regulations (CFR). We begin the first series of postings with definitions from "**Health Insurance Reform; Modifications to the Health Insurance Portability and Accountability Act (HIPAA); Final Rules,"** Federal Register **, January 16, 2009\. 45 CFR 162, Administrative Requirements: 162.103, Definitions.** ***Code Set*** Any set of codes used to encode data elements, such as tables of terms, medical concepts, medical diagnostic codes, or medical procedure codes. A code set includes the codes and the descriptors of the codes. ***Code Set Maintaining Organization*** An organization that creates and maintains the code sets adopted by the Secretary \[of HHS\] for use in the transactions for which standards are adopted in this part \[162\]. ***Data Condition*** The rule that describes the circumstances under which a covered entity must use a particular data element or segment. ### Vendors and Physicians Partners in Meaningful Use? URL: https://hipaa.com/vendors-and-physicians-partners-in-meaningful-use/ Last updated: 2009-10-22T12:45:18.000Z The secure exchange of health information is dependent on both the practice and EHR vendors facilitating the secure electronic transactions and extracting data for reporting quality measures. Even early adopters of EHR systems must ask vendors if they will be ready for meaningful use reporting. The vendor's response will impact cost, implementation timeline, workflow processes, reporting, and patient safety. A sampling of questions to ask include: 1. Of my current health information exchange partners (labs, hospitals, pharmacies, imaging centers) where have you already built bi-direction interfaces with your EHR system? 2. Does your system send e-prescribing alerts based on the content in the patient’s medication history? 3. Does your system identify whether the drug is on the patient’s formulary? 4. Does your system gather data on our computer-generated orders? 5. Does your system generate a clinical summary? 6. Does your system capture billing codes and push them into our PM system? 7. Does your system identify patients with personal health records? 8. Does your system ensure data validation so I know my workforce is entering information worth reporting? The physician's responsibility is to ensure that the practice/organization has met more stringent HIPAA privacy and security safeguards and that the infrastructure, including encryption is in place to support secure exchange. Vendors cannot prepare policies and procedures for physicians; they'll have their hands full building their own as covered entities. Meaningful use reporting is dependent on both physician and vendor meeting their responsibilities. ### Word of the Day: Pay-for-Performance URL: https://hipaa.com/word-of-the-day-pay-for-performance/ Last updated: 2009-10-16T17:00:30.000Z **Pay-for-Performance**: The use of incentives to encourage and reinforce the delivery of evidence-based practices in the health care system transformation that promote better outcomes as efficiently as possible. ### Word of the Day: Interoperability URL: https://hipaa.com/word-of-the-day-interoperability/ Last updated: 2009-10-15T14:15:38.000Z **Interoperability**: The ability to exchange and use information (usually in a large heterogeneous network made up of several local area networks). Interoperable systems reflect the ability of software and hardware on multiple machines from multiple vendors to communicate. ### Word of the Day: Electronic Media URL: https://hipaa.com/word-of-the-day-electronic-media/ Last updated: 2009-10-14T15:32:08.000Z **Electronic Media**: Electronic storage media including memory devices in computers (hard drives) and any removable/transportable digital memory medium, such as magnetic tape or disk, optical disk, or digital memory card; or transmission media used to exchange information already in electronic storage media. Transmission media include the Internet (wide open), extranet (using Internet technology to link a business with information accessible only to collaborating parties), leased lines, dial-up lines, private networks, and the physical movement of removable/transportable electronic storage media. Written communications sent via facsimile (not from one computer to another) and verbal information exchanges are not considered electronic media. ### Word of the Day: Data Authentication URL: https://hipaa.com/word-of-the-day-data-authentication/ Last updated: 2009-10-13T13:30:43.000Z **Data Authentication**: The corroboration that data have not been altered or destroyed in an unauthorized manner. ### Is Certification a Surrogate for HIPAA Privacy and Security Training? URL: https://hipaa.com/is-certification-a-surrogate-for-hipaa-privacy-and-security-training/ Last updated: 2009-09-14T13:30:31.000Z Several visitors to HIPAA.com have asked if 'certification' can substitute for compliance with the HIPAA Privacy and Security training standards and new Privacy requirements under the HITECH Act. Generally, certification is a snapshot in a moment of time. The Merrim-Webster's Collegiate Dictionary (11th ed.) defines certification as the act or state of "attest\[ing\] as being true or as represented or as meeting a standard." Certification generally is done by an external source. Training is an ongoing internal process for safeguarding protected health information from unauthorized use or disclosure as business policies and procedures evolve and regulatory standards are initiated or modified. Further, training requires that workforce members, including management, demonstrate awareness and understanding on an ongoing basis, and that covered entities and business associates document that their workforce members have been trained. As examples, the first implementation specifications of the Security Rule 'Security Awareness and Training' standard is "Security *reminders* (addressable). *Periodic* security updates." \[45 CFR (a)(5)(ii)(A)\] \[emphasis added\] One part of the implementation specification for the Privacy Rule 'Training' standard states that a "covered entity must provide training ... \[t\]o each member of covered entity's workforce whose functions are affected by a material *change* in the policies or procedures required by this subpart, within a reasonable *period of time after the material change becomes effective..."* \[45 CFR 164.530(b)(2)(c)\] \[emphasis added\]. Another requires that a new workforce member receive training "within a reasonable period of time after the person joins the covered entity's workforce." These examples regarding training are dynamic, as indicated in the italicized words and phrases, and the need to conduct training of new workforce members. Although the comment in the preamble of the January 16, 2009, Final Rule pertaining to HIPAA Electronic Transaction Standards refers to 'administrative transactions', it may be instructive in the context of training as well: "HHS does not recognize certification of any systems or software for purposes of HIPAA compliance." \[74 Federal Register 3310\] The burden on a covered entity or business associate is to conduct and periodically review its risk assessment, implement policies and procedures to safeguard protected health information, conduct 'awareness' training for all workforce members based on those policies and procedures, update that training if policies and procedures change or HIPAA privacy and security regulations are initiated or modified, and document in writing those activities. Certification is not a requirement in that process. ### Three Key Properties of HIPAA Privacy and Security of Protected Health Information URL: https://hipaa.com/three-key-properties-of-hipaa-privacy-and-security-of-protected-health-information/ Last updated: 2009-09-11T13:00:45.000Z HIPAA.com has received from its readers requests for information on topics related to HIPAA Administrative Simplification Privacy and Security Rules and to updates to those rules reflected in the HITECH Act provisions of the American Recovery and Reinvestment Act of 2009, signed by President Obama on February 17, 2009\. Recently, HIPAA.com answered the question of particular interest to several readers: what exactly is *protected health information* (PHI)? In this posting, we answer the question: what are the fundamental properties that underlie privacy and security of protected health information? **Three Key Properties** The three key properties that underpin privacy and security under the Health Insurance Portability and Accountability Act (HIPAA) are *availability*, *confidentiality,* and *integrity*. *Availability* is the property that data or information is accessible and useable upon demand by an authorized person. *Confidentiality* is the property that data or information is not made available or disclosed to unauthorized persons or processes. *Integrity* is the property that data or information have not been altered or destroyed in an unauthorized manner. These definitions appear in 45 CFR § 164.304, where CFR is Code of Federal Regulations. Part 164 covers Security and Privacy. These definitions fall into Subpart C, which covers Security Standards for the Protection of Electronic Protected Health Information. These properties also underpin the "Guidance Specifying the Technologies and Methodologies that Render Protected Health Information Unusable, Unreadable, or Indecipherable to Unauthorized Individuals' that appears in the *Interim Final Rule: Breach Notification for Unsecured Protected Health Information*, issued by the Office of Civil Rights (OCR) of the U.S. Department of Health and Human Services (HHS) and published in the Federal Register on August 24, 2009. ### HIPAA 'Protected Health Information': What Does PHI Include? URL: https://hipaa.com/hipaa-protected-health-information-what-does-phi-include/ Last updated: 2009-09-01T13:30:02.000Z HIPAA.com has received from its readers requests for information on topics related to HIPAA Administrative Simplification Privacy and Security Rules and to updates to those rules reflected in the HITECH Act provisions of the American Recovery and Reinvestment Act of 2009, signed by President Obama on February 17, 2009\. Of particular interest to readers is: what exactly is *protected health information* (PHI)? **Protected Health Information** To get to protected health information, you have to examine two definitions that were in Section 1171 of Part C of Subtitle F of Public Law 104-191 (August 21, 1996): Health Insurance Portability and Accountability Act of 1996: Administrative Simplification. These statutory definitions are of *health information* and *individually identifiable health information*. *"Health information* means any information, whether oral or recorded in any form or medium, that-- (A) is created or received by a health care provider, health plan, public health authority, employer, life insurer, school or university, or health care clearinghouse; and (B) relates to the past, present, or future physical or mental health or condition of any individual, the provision of health care to an individual, or the past, present, or future payment for the provision of health care to an individual." "*Individually identifiable health information* is information that is a subset of health information, including demographic information collected from an individual, and: (1) Is created or received by a health care provider, health plan, employer, or health care clearinghouse; and (2) Relates to the past, present, or future physical or mental health or condition of an individual; the provision of health care to an individual; or the past, present, or future payment for the provision of health care to an individual; and (i) That identifies the individual; or (ii) With respect to which there is a reasonable basis to believe the information can be used to identify the individual." *Protected health information* is defined in 45 CFR 160.103, where 'CFR' means 'Code of Federal Regulations', and, as defined, is referenced in Section 13400 of Subtitle D ('Privacy') of the HITECH Act. "*Protected health information* means individually identifiable health information \[defined above\]: (1) Except as provided in paragraph (2) of this definition, that is: (i) Transmitted by electronic media; (ii) Maintained in electronic media; or (iii) Transmitted or maintained in any other form or medium. (2) *Protected health information* excludes individually identifiable health information in: (i) Education records covered by the Family Educational Rights and Privacy Act, as amended, 20 U.S.C. 1232g; (ii) Records described at 20 U.S.C. 1232g(a)(4)(B)(iv); and (iii) Employment records held by a covered entity in its role as employer." The HIPAA Privacy Rule covers protected health information in any medium while the HIPAA Security Rule covers electronic protected health information. With those definitions in place, the question becomes: what elements comprise protected health information such that if they were removed, items (i) and (ii) of (2) in the definition of *individually identifiable health information* would not obtain. The answer is in the *de-identification* standard and its two implementation specifications of the HIPAA Privacy Rule \[45 CFR 164.514\]: "(a) *Standard: de-identification of protected health information*. Health information \[defined above\] that does not identify an individual and with respect to which there is no reasonable basis to believe that the information can be used to identify an individual is not individually identifiable health information. (b) *Implementation specifications: requirements for de-identification of protected health information*. A covered entity may determine that health information is not individually identifiable health information only if: (1) A person with appropriate knowledge of and experience with generally accepted statistical and scientific principles and methods for rendering information not individually identifiable: (i) Applying such principles and methods, determines that the risk is very small that the information could be used, alone or in combination with other reasonably available information, by an anticipated recipient to identify an individual who is subject of the information; and (ii) Documents the methods and results of the analysis that justify such determination; or (2) (i) The following identifiers of the individual or of relatives, employers, or household members of the individual, are removed: (A) Names; (B) All geographic subdivisions smaller than a State, including street address, city, county, precinct, zip code, and their equivalent geocodes, except for the initial three digits of a zip code if, according to the current publicly available data from the Bureau of the Censue: (1) The geographic unit formed by combining all zip codes with the same three initial digits contains more than 20,000 people; and (2) The initial three digits of a zip code for all such geographic units containing 20,000 or fewer people is changed to 000. (C) All elements of dates (except year) for dates directly related to an individual, including birth date, admission date,, discharge date, date of death; and all ages over 89 and all elements of dates (including year) indicative of such age, except that such ages and elements may be aggregated into a single category of age 90 or older; (D) Telephone numbers; (E) Fax numbers; (F) Electronic mail addresses; (G) Social security numbers; (H) Medical record numbers; (I) Health plan beneficiary numbers; (J) Account numbers; (K) Certificate/license numbers; (L) Vehicle identifiers and serial numbers, including license plate numbers; (M) Device identifiers and serial numbers; (N) Web Universal Resource Locators (URLs); (O) Internet Protocol (IP) address numbers; (P) Biometric identifiers, including finger and voice prints; (Q) Full face photographic images and any comparable images; and (R) Any other unique identifying number, characteristic, or code, except as permitted by paragraph (c) of this section; and (ii) The covered entity does not have actual knowledge that the information could be used alone or in combination with other information to identify an individual who is a subject of the information. (c) I*mplementation specifications: re-identification*. A covered entity may assign a code or other means of record identification to allow information de-identified under this section to be re-identified by the covered entity, provided that: (1) *Derivation*. The code or other means of record identification is not derived from or related to information about the individual and is not otherwise capable of being translated so as to identify the individual; and (2) *Security*. The covered entity does not use or disclose the code or other means of record identification for any other purpose, and does not disclose the mechanism for re-identification." With HHS's release of the Interim Final Rule, 'Breach Notification for Unsecured Protected Health Information,' published in the Federal Register on Monday, August 24, 2009, note the following: "If information is de-identified in accordance with 45 CFR 164.514(b) \[the first implementation specification, defined above\], it is not protected health information, and thus, any inadvertent or unauthorized use or disclosure of such information will not be considered a breach for purposes of this subpart." \[74 *Federal Register* 42743\] ### CMS Issues New and Updated HIPAA and HITECH Act FAQs: EHR Incentive Payment Start Dates URL: https://hipaa.com/cms-issues-new-and-updated-hipaa-and-hitech-act-faqs-ehr-incentive-payment-start-dates/ Last updated: 2009-08-27T14:00:24.000Z The Centers for Medicare and Medicaid Services (CMS) periodically issues new and updated Frequently Asked Questions (FAQs). HIPAA.com will periodically reproduce new and updated *Questions* and *Answers* pertaining to HIPAA Administrative Simplification standards and implementation specifications and to HITECH Act provisions that will be of interest to its readers. This FAQ \[ID#9807\] was created on June 22, 2009, and updated by CMS on August 18, 2009. *Question*: When will CMS begin to pay incentives to eligible professionals and hospitals for using certified Electronic Health Records (EHRs)? *Answer*: By statute \[American Recovery and Reinvestment Act of 2009\], the earliest dates that CMS will be able to pay an incentive under Medicare is October 1, 2010, for hospitals, and January 1, 2011, for eligible professionals. The statute does not define a date for the Medicaid incentives program. Given the range of regulatory and planning activities that must precede States being able to make provider incentive payments, as well as the importance of coordinating Medicaid and Medicare payments to prevent duplication, CMS does not expect that States will be able to make such payments until 2011. Work is underway to define the meaningful EHR user criteria, as well as the requirements for applying for and receiving the EHR payment incentives. CMS expects to issue a proposed rule in late 2009 \[relating to these matters\]. For information on the Medicare and Medicaid incentive programs, see Title IV, pp. 353-382 of the American Recovery and Reinvestment Act (ARRA), signed by President Obama on February 17, 2009, which is available for download on HIPAA.com. ### CMS Issues New and Updated HIPAA and HITECH Act FAQs: EHR Incentives URL: https://hipaa.com/cms-issues-new-and-updated-hipaa-and-hitech-act-faqs-ehr-incentives/ Last updated: 2009-08-26T14:00:20.000Z The Centers for Medicare and Medicaid Services (CMS) periodically issues new and updated Frequently Asked Questions (FAQs). HIPAA.com will periodically reproduce new and updated *Questions* and *Answers* pertaining to HIPAA Administrative Simplification standards and implementation specifications and to HITECH Act provisions that will be of interest to its readers. The FAQ \[ID#9844\] that follows is new, published by CMS on August 13, 2009. *Question*: Are physicians who practice in hospital-based ambulatory clinics eligible to receive the Recovery Act's Medicare or Medicaid electronic health record (EHR) incentive payments. *Answer*: Hospital-based eligible professionals are ineligible for the EHR incentive payments under both Medicare and Medicaid. Our \[Department of Health and Human Services\] forthcoming NPRM \[Notice of Proposed Rule Making\] will propose a definition for determining whether a physician or other eligible professional is hospital based. For information on the Medicare and Medicaid incentive programs, see Title IV, pp. 353-382 of the American Recovery and Reinvestment Act (ARRA), signed by President Obama on February 17, 2009, which is available for download on HIPAA.com. ### HHS Issues Interim Final Rule for HITECH 'Breach Notification' URL: https://hipaa.com/hhs-issues-interim-final-rule-for-hitech-breach-notification/ Last updated: 2009-08-21T14:00:38.000Z U.S. Department of Health and Human Services Secretary, Kathleen Sebelius, has issued the Interim Final Rule for *Breach Notification for Unsecured Protected Health Information*. The Interim Final Rule was signed by Secretary Sebelius on August 6, 2009, filed at the Federal Register on Wednesday, August 19, 2009, and will be published on Monday, August 24, 2009, in the Federal Register . The effective date of the Interim Final Rule will be 30 days after publication, and will cover both covered entities and business associates of covered entities. Here is the *Summary* of the Interim Final Rule: "The Department of Health and Human Services (HHS) is issuing this interim final rule with a request for comments to require notification of breaches of unsecured protected health information. Section 13402 of the Health Information Technology for Economic and Clinical Health (HITECH) Act, part of the American Recovery and Reinvestment Act of 2009 (ARRA) that was enacted on February 17, 2009, requires HHS to issue interim final regulations with 180 days to require covered entities under the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and their business associates to provide notification in the case of breaches of unsecured protected health information. For purposes of determining what information is 'unsecured protected health information,' in this document HHS is also issuing an update to its guidance specifying the technologies and methodologies that render protected health information unusable, unreadable, or indecipherable to unauthorized individuals." Here is the updated guidance that appears in the Interim Final Rule: " B. Guidance Specifying the Technologies and Methodologies that Render Protected Health Information Unusable, Unreadable, or Indecipherable to Unauthorized Individuals Protected health information (PHI) is rendered unusable, unreadable, or indecipherable to unauthorized individuals if one or more of the following applies: (a) Electronic PHI has been encrypted as specified in the HIPAA Security Rule by 'the use of an algorithmic process to transform data into a form in which there is a low probability of assigning meaning without use of a confidential process or key' \[45 CFR 164.304, definition of 'encryption'\] and such confidential process or key that might enable decryption has not been breached. To avoid a breach of the confidential process or key, these decryption tools should be stored on a device or at a location separate from the data they are used to encrypt or decrypt. The encryption processes identified below have been tested by the National Institute of Standards and Technology (NIST) and judged to meet this standard. (i) Valid encryption processes for data at rest are consistent with NIST Special Publication 800-111, Guide to Storage Encryption Technologies for End User Devices \[Available at http://www.csrc.nist.gov; NIST Roadmap plans include the development of security guidelines for enterprise-level storage devices, and such guidelines will be considered in updates to this guidance, when available.\] (ii) Valid encryption processes for data in motion are those which comply, as appropriate, with NIST Special Publications 800-52, Guidelines for the Selection and Use of Transport Layer Security (TLS) Implementations; 800-77, Guide to IPsec VPNs; or 800-113, Guide to SSL VPNs, or others which are Federal Information Processing Standards (FIPS) 140-2 validated \[available at http://www.csrc.nist.gov.\] (b) The media on which the PHI is stored or recorded has been destroyed in one of the following ways: (i) Paper, film, or other hard copy media have been shredded or destroyed such that the PHI cannot be read or otherwise cannot be reconstructed. Redaction is specifically excluded as a means of data destruction. (ii) Electronic media have been cleared, purged, or destroyed consistent with NIST Special Publication 800-88, Guidelines for Media Sanitization \[available at http://www.csrc.nist.gov\], such that the PHI cannot be retrieved." Comments on the provisions of the Interim Final Rule are due on or before 60 days after the publication date \[of August 24, 2009\], and instructions for filing comments are included in the Interim Final Rule. Comments regarding guidance "received in response to the interim final rule will be addressed in the first annual update to the guidance, to be issued in April 2010." HIPAA.com will have available on its site the official published version of the Guidance on August 24, 2009, and recommends that you consult the online version cited above for an early look, but rely on the published Federal Register version, when published. ### HHS Secretary Delegates to ONC Head New HITECH Act Authority URL: https://hipaa.com/hhs-secretary-delegates-to-onc-head-new-hitech-act-authority/ Last updated: 2026-10-24T21:32:58.000Z Effective August 7, 2009, and published in the Federal Register on Tuesday, August 18, 2009, Secretary Kathleen Sebelius of the U.S. Department of Health and Human Services (HHS) has delegated authority to the National Coordinator for Health Information Technology, David Blumenthal, M.D., to administer "Subtitle B, 'Incentives for the Use of health Information Technology,' sections 3011 through 3017, with the exception of 3012(c)(5), the Financial Support subsection." These sections and titles, which appear on pages 132-144 of the American Recovery and Reinvestment Act of 2009 (ARRA), signed by President Obama on February 17, 2009, available on the hipaa.com site, include: - *3011* *Immediate Funding to Strengthen the Health Information Technology Infrastructure*, including "invest\[ment\] in the infrastructure necessary to allow for and promote the electronic exchange and use of health information for each individual in the United States consistent with the goals outlined in the strategic plan developed by the National Coordinator...". - *3012* *Health Information Technology Implementation Assistance*, with the exclusion of assistance to any health information technology regional extension center as noted in the quote above. - *3013 State Grants to Promote Health Information Technology.* - *3014 Competitive Grants to States and Indian Tribes for the Development of Loan Programs to Facilitate the Widespread Adoption of Certified EHR Technology*. - *3015 Demonstration Program to Integrate Information Technology into Clinical Education.* - *3016 Information Technology Professionals in Health Care.* - *3017 General Grant and Loan Provisions.* The delegation notice in the Federal Register is available [here](https://hipaa.com/content/files/2026/10/e9-19709.pdf). For additional information pertaining to this delegation and to its substance, please read the referenced ARRA pages and visit the [Office of the National Coordinator for Health Information Technology (ONC) website](http://healthit.hhs.gov/?ref=hipaa.com). ### HHS Secretary Sebelius Delegates Oversight and Enforcement of HIPAA Security Rule to OCR URL: https://hipaa.com/hhs-secretary-sebelius-delegates-oversight-and-enforcement-of-hipaa-security-rule-to-ocr/ Last updated: 2009-08-04T13:00:11.000Z U.S. Health and Human Services (HHS) Secretary Kathleen Sebelius has delegated oversight and enforcement of the HIPAA Administrative Simplification Security Rule Standards for Protection of Electronic Protected Health Information to HHS's Office of Civil Rights (OCR), effective July 27, 2009\. Since October 7, 2003, the Security Rule had been the responsibility of HHS's Center for Medicare & Medicaid Services (CMS). OCR also has responsibility for the HIPAA Administrative Simplification Privacy Rule. This delegation brings responsibility for administrative, technical, and physical standards for safeguarding of protected health information in each rule under one authority, and likely will facilitate enforcement of the HITECH Act breach, notification, and business associate security rule compliance provisions in the American Recovery and Reinvestment Act of 2009, signed by President Obama on February 17, 2009. The Delegation of Authority was published in the August 4, 2009, *Federal Register*. ### What's In Your Personal Health Record? URL: https://hipaa.com/whats-in-your-personal-health-record/ Last updated: 2009-08-03T17:56:24.000Z The 800-pound gorilla at the center of health information transformation is the patient. This sleeping giant is slowly emerging from hibernation, and watch out when it wakes up. Folded into ARRA’s HITECH Act are provisions that require health care providers to “Provide patients and families with access to data, knowledge, and tools to make informed decisions and to manage their health.” If you are a caregiver, or manage a chronic disease, this policy will have a profound effect on you. While my sister and brother battled terminal aggressive cancers, it was their caregiver who carried the pharmacological list of medications, nutritional supplements, allergies, adverse reactions, near fatal overdoses, sleep patterns, and vitals in a spiral-bound paper notebook. Between visits to oncologists, radiation oncologists, labs, and hospital rooms, the notebook became the hub of health information exchange. In 2006, my sister’s healthcare providers were part of a pilot site for health information exchange, but what had become “The Notebook” evolved into THE hard copy resource that her clinician’s relied on for subjective patient information. Even though each of the doctors could access her record electronically, they looked to the caregiver for the complete story, partly out of compassion, partly because they knew it was more complete than the picture they had, given the current state of health information exchange. Content of your personal health record (PHRs) should include fields for the following: emergency contact information, payer information (subscriber, your relationship to the subscriber), name of primary care physician, allergies, medications (active and inactive), current medical history, current health concerns, family medical history, social habits such as drinking and smoking, surgeries. In a future posting, I’ll provide my list of favorite PHR companies, their cost, and what I like about them. ### FTC Delays "Red Flags" Rule for Third Time URL: https://hipaa.com/ftc-delays-red-flags-rule-for-third-time/ Last updated: 2009-07-29T19:18:15.000Z The Federal Trade Commission announced a third delay, from August 1, 2009, to November 1, 2009, for compliance with the identity theft prevention *red flags* rule. The delay is for another three months. Compliance originally was scheduled for November 1, 2008, then delayed the first time until May 1, 2009\. Entities affected are creditors and financial institutions. Healthcare providers that extend delayed payment plans to patients are deemed "creditors" under the *red flags* rule. This delay was to give affected entities more time to develop and implement written identity theft prevention policies and procedures for compliance with the rule, which is based on enabling regulations of provisions in the Fair and Accurate Credit Transactions Act of 2003\. You can visit www.ftc.gov/redflagsrule for additional information. HIPAA.com has outlined provisions of the rule [in an earlier posting](http://www.hipaa.com/2009/04/ftcs-red-flags-rule-to-prevent-identity-theft-requires-compliance-by-healthcare-providers-on-friday-may-1-2009/?ref=hipaa.com), and has [available for download](http://www.hipaa.com/2009/04/identity-theft-red-flags-and-address-discrepancies/?ref=hipaa.com) a copy of FTC's "Fighting Fraud with the Red Flags Rule: A How-To Guide for Business." Just click on "Red Flags Rule" to the right to access this information online. ### Transmission Security Encryption: What to Do and How to Do It URL: https://hipaa.com/transmission-security-encryption-what-to-do-and-how-to-do-it/ Last updated: 2026-10-24T21:33:10.000Z In our series on the HIPAA Administrative Simplification Security Rule, this is the second of two implementation specifications for the Technical Safeguard Standard, Transmission Security. This implementation specification is *addressable*. Addressable does not mean "optional." Rather, an addressable implementation specification means that a covered entity must use reasonable and appropriate measures to meet the standard. As we noted in earlier postings on HIPAA.com, business associates of covered entities will be required to comply with the Security Rule safeguard standards, beginning February 17, 2010\. This requirement is one of the HITECH Act provisions of the American Recovery and Reinvestment Act (ARRA), signed by President Obama on February 17, 2009. **What to Do** Implement a mechanism to encrypt electronic protected health information whenever deemed appropriate. **How to Do It** For the sender of electronic protected health information, encryption converts the message in a file or document from a readable to an unreadable format. Decryption is the reverse, allowing encrypted information to be converted from an unreadable format to a readable format by the recipient. A covered entity should always encrypt electronic protected health information to ensure its integrity and confidentiality. As discussed in the earlier posting on the meaning of Transmission Security, a covered entity with only a local network with no electronic connectivity to any person or entity outside of the covered entity may not need to encrypt. With new federal regulations and incentives focused on increasing interoperability amongst healthcare stakeholders, it will be more and more important for these types of covered entities to have encryption capabilities. Any covered entity with open networks should have that encryption capabilities in place now and encrypt all transmissions of electronic protected health information. On April 17, 2009, the U.S. Department of Health and Human Services issued *Guidance Specifying the Technologies and Methodologies That Render Protected Health Information Unusable, Unreadable, or Indecipherable to Unauthorized Individuals for Purposes of the Breach Notification Requirements under Section 13402 of Title X111 (Health Information Technology for Economic and Clinical Health Act) of the American Recovery and Reinvestment Act of 2009*, which is available on the HIPAA.com site. The guidance is related to forthcoming HHS and FTC 'breach notification' regulations pertaining to 'unsecured protected health information.' We provide excerpts here from the aforementioned guidance that is germane to electronic protected health information and encryption, therefore to this implementation specification. "The term 'unsecured protected health information' includes PHI \[protected health information\] in any form that is not secured through the use of a technology or methodology specified in this guidance. This guidance, however addresses methods for rendering PHI in paper or electronic form unusable, unreadable, or indecipherable to unauthorized individuals. "Data comprising PHI can be vulnerable to a breach in any of the commonly recognized data states: 'data in motion' (i.e., data that is moving through a network, including wireless transmission); 'data at rest' (i.e., data that resides in databases, file systems, and other structured storage methods); 'data in use' (i.e., data in the process of being created, retrieved, updated, or deleted); or 'data disposed' (e.g., discarded paper records or recycled electronic media).' "Encryption is one method of rendering electronic PHI unusable, unreadable, or indecipherable to unauthorized persons. The successful use of encryption depends upon two main features: the strength of the encryption algorithm and the security of the decryption key or process. The specification of encryption methods in this guidance includes the condition that the processes or keys that might enable decryption have not been breached.... "Guidance Specifying the Technologies and Methodologies that Render Protected Health Information Unusable, Unreadable, or Indecipherable to Unauthorized Individuals. "Protected health information (PHI) is rendered unusable, unreadable, or indecipherable to unauthorized individuals only if one or more of the following applies: "a) Electronic PHI has been encrypted as specified in the HIPAA Security Rule by 'the use of an algorithmic process to transform data into a form in which there is a low probability of assigning meaning without use of a confidential process or key' and such confidential process or key that might enable decryption has not been breached. Encryption process identified below have been tested by the National Institute of Standards and Technology (NIST) and judged to meet this standard. i) "Valid encryption processes for data at rest are consistent with [NIST Special Publication 800-111, *Guide to Storage Encryption Technologies for End Use Devices*, November 2007](https://hipaa.com/content/files/2026/10/sp800-111.pdf). ii) "Valid encryption processes for data in motion are those that comply with the requirements of Federal Information Processing Standards (FIPS) 140-2\. These include, as appropriate, standards described in NIST Special Publications [800-52, *Guidelines for the Selection and Use of Transport Layer Security (TLS) Implementations*, June 2005](http://static.hipaa.com/documents/SP800-52.pdf?ref=hipaa.com); [800-77, *Guide to IPsec VPNs*, December 2005](http://static.hipaa.com/documents/sp800-77.pdf?ref=hipaa.com); [800-113, *Guide to SSL VPNs*, July 2008](https://hipaa.com/content/files/2026/10/sp800-113.pdf); and May include others, which are FIPS 140-2 validated. ...." Again, a covered entity must rely on outcomes of its risk analysis to determine whether encryption is necessary. In that risk analysis, the covered entity should evaluate potential risks and costs of breach of unsecured electronic protected health information that becomes accessible to unauthorized users outside of the covered entity, whether data at rest or data in motion, which would trigger the new 'breach notification' provisions of the HITECH Act. If a covered entity does not encrypt electronic protected health information, then it must document its decision and explain why this implementation specification does not apply. Even in the absence of exposure to an open network, a covered entity should consider in its risk analysis costs and benefits of encrypting electronic protected health information at rest on its closed electronic information system. With expected increased use of electronic transactions in healthcare, such as e-prescribing, and electronic communications via email, say, between a physician practice and a patient, most covered entities will be using open systems and will have need for encryption tools. HIPAA.com recommends that you contact your electronic information system hardware and software vendors for advice on encryption, and that you also consult the National Institute for Standards and Technology (NIST) Special Publication 800-53, Revision 3: *Recommended Security Controls for Federal Information Systems and Organizations* (Initial Public Draft), February 2009, and NIST Special Publication 800-66, Revision 1, [*An Introductory Resource Guide for Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule*, October 2008](http://static.hipaa.com/documents/SP-800-66-Revision1.pdf?ref=hipaa.com). ### Transmission Security Integrity Controls: What to Do and How to Do It URL: https://hipaa.com/transmission-security-integrity-controls-what-to-do-and-how-to-do-it/ Last updated: 2009-07-13T13:00:27.000Z In our series on the HIPAA Administrative Simplification Security Rule, this is the first implementation specification for the Technical Safeguard Standard, Transmission Security. This implementation specification is *addressable*. Addressable does not mean "optional." Rather, an addressable implementation specification means that a covered entity must use reasonable and appropriate measures to meet the standard. As we noted in earlier postings on HIPAA.com, business associates of covered entities will be required to comply with the Security Rule safeguard standards, beginning February 17, 2010\. This requirement is one of the HITECH Act provisions of the American Recovery and Reinvestment Act (ARRA), signed by President Obama on February 17, 2009. **What to Do** Implement security measures to ensure that electronically transmitted protected health information is not improperly modified without detection until disposed of. **How to Do It** A covered entity must ensure data integrity. Integrity is "the property that data or information have not been altered or destroyed in an unauthorized manner." As a covered entity, you ensure that electronic protected health information is not altered without appropriate knowledge and approval of your Security Official. To do this, you need to assign appropriate authentication credentials to workforce members and business associates **and** make sure that all entries by an authenticated user are tracked appropriately through audit trails. The Security Official should be responsible for periodically examining the audit trails to ensure integrity, and for applying appropriate sanctions if changes to electronic protected health information are made without authorization. During review and update of the covered entity's risk analysis, the Security Official should report on the success of the integrity controls, based on an empirical review of the audit trails and any incidence of unauthorized modification of electronic protected health information. ### Transmission Security: What This HIPAA Security Rule Technical Safeguard Standard Means URL: https://hipaa.com/transmission-security-what-this-hipaa-security-rule-technical-safeguard-standard-means/ Last updated: 2026-10-24T21:33:11.000Z This is the fifth and last Technical Safeguard Standard of the HIPAA Administrative Simplification Security Rule. It has two implementation specifications: integrity controls; and encryption. Each is *addressable*. Addressable does not mean "optional." Rather, an addressable implementation specification means that a covered entity must use reasonable and appropriate measures to meet the standard. As we have noted in earlier postings on HIPAA.com, business associates of covered entities will be required to comply with the Security Rule safeguard standards, beginning February 17, 2010\. This requirement is one of the HITECH Act provisions of the American Recovery and Reinvestment Act (ARRA), signed by President Obama on February 17, 2009. For compliance with this Technical Safeguard Standard, a covered entity is required to implement technical security measures to guard against unauthorized access to electronic protected health information that is being transmitted over an electronic communications network. In simplest terms, a covered entity must safeguard its electronic networks to ensure the availability and integrity of its electronic protected health information. How the covered entity implements this safeguard is an outcome of the covered entity's risk analysis. A covered entity with only a local network with no connectivity to any entity outside of the covered entity will have a different solution than a covered entity with connectivity to outside entities. With new federal regulations and incentives focused on increasing interoperability amongst healthcare stakeholders, it will be more and more important for covered entities to protect their networks. A covered entity should explore options for safeguarding its electronic media by discussing safeguards with its business associate hardware and software vendors. With open networks, such as the Internet, it is especially important to *harden* existing systems with up-to-date security software applications, firewalls, and intrusion detection systems. In earlier postings on data back-up on HIPAA.com, we have discussed the importance of the integrity of electronic protected health information not be impaired by changes or alterations to electronic media. We recommend that you consult the National Institute of Standards and Technology (NIST) Information Security Special Publication 800-63: *Electronic Authentication Guideline* (Version 1.0.2), April 2006, which is available online at [](https://hipaa.com/content/files/2026/10/sp800-63v1%5F0%5F2.pdf). This "document provides technical guidance to Federal agencies implementing electronic authentication. The recommendation covers remote authentication of users over open networks. It defines technical requirements for each of four levels of assurance in the areas of identity proofing, registration, tokens, authentication protocols and related assertions.... \[This guideline\] may also be used by nongovernmental organizations on a voluntary basis and is not subject to copyright (Attribution would be appreciated by NIST.)" \[Pp. iii-iv\] ### Person or Entity Authentication: What to Do and How to Do It URL: https://hipaa.com/person-or-entity-authentication-what-to-do-and-how-to-do-it/ Last updated: 2009-07-09T13:00:34.000Z In our series on the HIPAA Administrative Simplification Security Rule, this is the fourth Technical Safeguard Standard. There is not a separately described implementation specification. Rather, this standard's implementation specification is connoted in the language of the standard and is required. As we have noted in earlier postings on HIPAA.com, business associates of covered entities will be required to comply with the Security Rule safeguard standards, beginning February 17, 2010\. This requirement is one of the HITECH Act provisions of the American Recovery and Reinvestment Act (ARRA), signed by President Obama on February 17, 2009. **What to Do** A covered entity is required to implement procedures to verify that a person or entity seeking access to electronic protected health information is the person or entity claimed. **How to Do It** During its risk analysis, a covered entity must determine threats and vulnerabilities to authentication of persons or entities that seek access to its electronic protected health information, and mitigate risks by establishing verification techniques to ensure that the person or entity seeking access to such information is the person or entity claimed. Accordingly, the covered entity must establish a system requiring the person or entity seeking access to have positive identification. A person or entity authentication system involves two electronic round trip inquiries and responses to authenticate party seeking access: » Inquiry of party (1): Who are you? (Computer waits for response from party) » Inquiry of party (2): Prove it! (Computer verifies party's identification to authenticate access) Three accepted methods of authentication are: » Something you have. Examples are ATM or other type of swipe or smart card, token, or badge. » Something you know. Examples are User ID, mother's maiden name, personal ID number, or password. » Something you are. Examples are biometric such as a facial image, finger image, voice scan, or iris or retina scan. The covered entity's Security Official will define the policy to achieve the requirements of this authentication standard for controlling, monitoring, and enforcing access to electronic protected health information. How to do so will be an outcome of the covered entity's risk analysis. For workforce members, the policy likely will involve logon username and password procedures and audit trails. Passwords should be at least eight characters long and alphanumeric, and never based on username, actual names, or any dictionary name. For business associates of a covered entity that seek access to the covered entity's electronic protected health information, we recommend the same conditions for passwords, but that passwords be at least ten characters long and alphanumeric. We anticipate that biometric identification techniques will by a surrogate for passwords in the healthcare clinical environment in the years ahead as providers adopt single sign-on and electronic health record systems. ### Person or Entity Authentication: What This HIPAA Security Rule Technical Safeguard Standard Means URL: https://hipaa.com/person-or-entity-authentication-what-this-hipaa-security-rule-technical-safeguard-standard-means/ Last updated: 2009-07-08T13:00:46.000Z This is the fourth Technical Safeguard Standard of the HIPAA Administrative Simplification Security Rule. There is not a separately described implementation specification. Rather, this standard's implementation specification is connoted in the language of the standard and is required. As we have noted in earlier postings on HIPAA.com, business associates of covered entities will be required to comply with the Security Rule safeguard standards, beginning February 17, 2010\. This requirement is one of the HITECH Act provisions of the American Recovery and Reinvestment Act (ARRA), signed by President Obama on February 17, 2009. For compliance with this Technical Safeguard Standard, a covered entity is required to implement procedures to verify that a person or entity seeking access to electronic protected health information is the person or entity claimed. This standard means that a covered entity's Security Official must establish policies and procedures that require a workforce member or business associate, such as the covered entity's software or hardware vendor, to verify who or what entity seeks access to electronic protected health information. This standard requires more than just password management, and includes maintaining audit trails so that the covered entity can authenticate who or what entity is creating, reading, altering, destroying, or transmitting electronic protected health information. Procedures for authentication control will be though features associated with the covered entity's electronic information systems, and may be part of a software application, operating systems, database, or a combination thereof. The Security Official should consult with its hardware and software vendors regarding authentication regarding its electronic media. A covered entity will should consider threats and vulnerabilities regarding authentication as part of its risk analysis. ### Privacy and Security in Disasters or Emergencies URL: https://hipaa.com/privacy-and-security-in-disasters-or-emergencies/ Last updated: 2009-07-07T13:00:17.000Z Families searching for loved ones in a presidential-declared disaster, whether a hurricane, tornado, earthquake or unnatural disasters, should not have to also overcome HIPAA privacy roadblocks. As our nation winds down mid-western tornado season and steps up Hurricane season, review the guidance issued by DHHS after hundreds of thousand of Hurricane Katrina and Rita displaced citizens tried to locate loved ones. **Privacy and Security in Disasters or Emergency Guidance** If the president declares an emergency or disaster and the secretary of HHS declares a public health emergency, the secretary may waive sanctions and penalties against a covered hospital that does not comply with certain provisions of the HIPAA Privacy Rule, as noted here: » the requirements to obtain a patient's agreement to speak with family members or friends involved in the patient's care (45 CFR 164.510(b)); » the requirement to honor a request to opt out of the facility directory (45 CFR 164.510(a)); » the requirement to distribute a notice of privacy practices (45 CFR 164.520); » the patient's right to request privacy restrictions (45 CFR 164.522(a)); and » the patient's right to request confidential communications (45 CFR 164.522(b)). **When and to what entities does the waiver apply?** If the secretary issues such a waiver, it only applies: » in the emergency area and for the emergency period identified in the public health emergency declaration. » to hospitals that have instituted a disaster protocol. The waiver would apply to all patients at such hospitals. » for up to 72 hours from the time the hospital implements its disaster protocol. When the presidential or secretarial declaration terminates, a hospital must then comply with all requirements of the Privacy Rule for any patient still under its care, even if 72 hours has not elapsed since implementation of its disaster protocol. Regardless of the activation of an emergency waiver, the HIPAA Privacy Rule permits disclosures for treatment purposes and certain disclosures to disaster relief organizations. For instance, the Privacy Rule allows covered entities to share patient information with the American Red Cross so it can notify family members of the patient's location. See 45 CFR 164.510(b)(4). This guidance is available online at [http://www.hhs.gov/ocr/hipaa/emergencyPPR.html](http://www.hhs.gov/ocr/hipaa/emergencyPPR.html?ref=hipaa.com). **Need help with Emergency Planning?** The following websites offer federally-developed planning tools. 1\. Office for Civil Rights (OCR) the agency named to oversee privacy of confidential health information. This is HHS's primary site for assisting you in emergency preparedness and disaster recovery planning and response. At its Web site, [http://www.hhs.gov/ocr/hipaa/emergencyPPR.html](http://www.hhs.gov/ocr/hipaa/emergencyPPR.html?ref=hipaa.com), OCR provides links to its own planning documents and also provides links to other agencies inside and outside of HHS that have developed disaster recovery guidance tools (see number 2 in this list); other links will take you to the National Aging Network. 2\. Agency for Healthcare Research and Quality. At AHRQ's Web site, [http://www.ahrq.gov/path/katrina.htm](http://www.ahrq.gov/path/katrina.htm?ref=hipaa.com), you will find links to multiple tools and resources to assist in response and recovery efforts. Those that are most likely to affect a physician practice include a. Personal protective equipment, decontamination, isolation/quarantine, and laboratory capacity b. Computer staffing model for disaster preparedness response c. Alternate site locator d. Health Emergency Assistance Line and Triage Hub model 3\. Decision tool to help you determine who, when, and how health information can be disclosed in emergencies. That tool is available at [http://www.hhs.gov/ocr/hipaa/decisiontool/tool/source1.html](http://www.hhs.gov/ocr/hipaa/decisiontool/tool/source1.html?ref=hipaa.com). ### Accountability Key Privacy/Security Principle of Meaningful Use 2011 Objectives URL: https://hipaa.com/accountability-key-privacysecurity-principle-of-meaningful-use-2011-objectives/ Last updated: 2009-07-06T12:30:59.000Z On December 15, 2008, the Office of the National Coordinator for Health Information Technology of the U.S. Department of Health and Human Services (HHS) published its 11 page report: *Nationwide Privacy and Security Framework for Electronic Exchange of Individually Identifiable Health Information*. The eight principles in this report underpin the HIPAA Administrative Simplification Privacy and Security Rule standards, provide a foundation of the Privacy provisions of the HITECH Act in the American Recovery and Reinvestment Act of 2009, signed by President Obama on February 17, 2009, and are a key objective of proposed 2011 *Objective* recommendations for *Meaningful Use* published by HHS’ Health IT Policy Committee on June 16, 2009\. The *Framework* and *Meaningful Use* documents are [available here](http://www.hipaa.com/2009/06/hhss-hit-policy-committee-releases-draft-recommendations-on-meaningful-use-for-public-comment/?ref=hipaa.com). In this series of postings, we reproduce—one at a time—Level 1 and Level 2 descriptions of the eight principles. A Level 1 (L1) description is a “short title and concise statement,” and a Level 2 (L2) description is a “short explanation that further elaborates on the principle, what it is designed to do, and its parameters.” The eighth and last of the principles is: **(L1) ACCOUNTABILITY**. These principles should be implemented, and adherence assured, through appropriate monitoring and other means and methods should be in place to report and mitigate non-adherence and breaches. \[p. 9\] **(L2)** *These nationwide privacy and security principles will not be effective in building trust in electronic exchange of individually identifiable health information unless there is compliance with these Principles and enforcement mechanisms. Mechanisms for assuring accountability include policies and procedures and other tools. At a minimum, such mechanisms adopted by persons and entities that participate in a network for the purpose of electronic exchange of individually identifiable health information should address: (1) monitoring for internal compliance, including authentication and authorizations for access to or disclosure of individually identifiable health information; (2) the ability to receive and act on complaints, including taking corrective measures; and (3) the provision of reasonable mitigation measures, including notice to individuals of privacy violations or security breaches that pose substantial risk of harm to such individuals.* ### Safeguards Key Privacy/Security Principle of Meaningful Use 2011 Objectives URL: https://hipaa.com/safeguards-key-privacysecurity-principle-of-meaningful-use-2011-objectives/ Last updated: 2009-07-03T12:41:37.000Z On December 15, 2008, the Office of the National Coordinator for Health Information Technology of the U.S. Department of Health and Human Services (HHS) published its 11 page report: *Nationwide Privacy and Security Framework for Electronic Exchange of Individually Identifiable Health Information*. The eight principles in this report underpin the HIPAA Administrative Simplification Privacy and Security Rule standards, provide a foundation of the Privacy provisions of the HITECH Act in the American Recovery and Reinvestment Act of 2009, signed by President Obama on February 17, 2009, and are a key objective of proposed 2011 *Objective* recommendations for *Meaningful Use* published by HHS’ Health IT Policy Committee on June 16, 2009\. The *Framework* and *Meaningful Use* documents are [available here](http://www.hipaa.com/2009/06/hhss-hit-policy-committee-releases-draft-recommendations-on-meaningful-use-for-public-comment/?ref=hipaa.com). In this series of postings, we reproduce—one at a time—Level 1 and Level 2 descriptions of the eight principles. A Level 1 (L1) description is a “short title and concise statement,” and a Level 2 (L2) description is a “short explanation that further elaborates on the principle, what it is designed to do, and its parameters.” The seventh of the eight principles is: **(L1) SAFEGUARDS**. Individually identifiable health information should be protected with reasonable administrative, technical, and physical safeguards to ensure its confidentiality, integrity, and availability and to prevent unauthorized or inappropriate access, use, or disclosure. \[p. 9\] **(L2)** *Trust in electronic exchange of individually identifiable health information can only be achieved if reasonable administrative, technical, and physical safeguards are in place to protect individually identifiable health information and minimize the risks of unauthorized or inappropriate access, use, or disclosure. These safeguards should be developed after a thorough assessment to determine any risks or vulnerabilities to individually identifiable health information. Persons and entities that participate in a network for the purpose of electronic exchange of individually identifiable health information should implement administrative, technical, and physical safeguards to protect information, including assuring that only authorized persons and entities and employees of such persons or entities have access to individually identifiable health information. Administrative, technical, and physical safeguards should be reasonable in scope and balanced with the need for access to individually identifiable health information.* **Definitions of Safeguards Pertaining to This Principle** **Administrative safeguards:** Administrative actions, and policies and procedures to manage the selection, development, implementation, and maintenance of security measures to protect electronic individually identifiable health information and to manage the conduct of the entity’s workforce in relation to the protection of that information. Administrative safeguards include policies and procedures, workforce training, risk management plans, and contingency plans. **Physical safeguards:** Physical measures, policies and procedures to protect electronic information systems and related buildings and equipment from natural and environmental hazards, and unauthorized intrusion. Physical safeguards include workstation security and use procedures, facility security plans, data backup and storage, and portable device and media controls. **Technical safeguards:** The technology and the policies and procedures for its use that protect electronic individually identifiable health information and control access to it. ### Data Quality and Integrity Key Privacy/Security Principle of Meaningful Use 2011 Objectives URL: https://hipaa.com/data-quality-and-integrity-key-privacysecurity-principle-of-meaningful-use-2011-objectives/ Last updated: 2009-07-02T12:39:54.000Z On December 15, 2008, the Office of the National Coordinator for Health Information Technology of the U.S. Department of Health and Human Services (HHS) published its 11 page report: *Nationwide Privacy and Security Framework for Electronic Exchange of Individually Identifiable Health Information*. The eight principles in this report underpin the HIPAA Administrative Simplification Privacy and Security Rule standards, provide a foundation of the Privacy provisions of the HITECH Act in the American Recovery and Reinvestment Act of 2009, signed by President Obama on February 17, 2009, and are a key objective of proposed 2011 *Objective* recommendations for *Meaningful Use* published by HHS’ Health IT Policy Committee on June 16, 2009\. The *Framework* and *Meaningful Use* documents are [available here](http://www.hipaa.com/2009/06/hhss-hit-policy-committee-releases-draft-recommendations-on-meaningful-use-for-public-comment/?ref=hipaa.com). In this series of postings, we reproduce—one at a time—Level 1 and Level 2 descriptions of the eight principles. A Level 1 (L1) description is a “short title and concise statement,” and a Level 2 (L2) description is a “short explanation that further elaborates on the principle, what it is designed to do, and its parameters.” The sixth of the eight principles is: **(L1) DATA QUALITY AND INTEGRITY**. Persons and entities should take reasonable steps to ensure that individually identifiable health information is complete, accurate, and up-to-date to the extent necessary for the person’s or entity’s intended purposes and has not been altered or destroyed in an unauthorized manner. \[p. 8\] **(L2)** *The completeness and accuracy of an individual’s health information may affect, among other things, the quality of care that the individual receives, medical decisions, and health outcomes*.* Persons and entities that participate in a network for the purpose of electronic exchange of individually identifiable health information have a responsibility to maintain individually identifiable health information that is useful for its intended purposes, which involves taking reasonable steps to ensure that information is accurate, complete, and up-to-date, and has not been altered or destroyed in an unauthorized manner.* *Persons and entities have a responsibility to update or correct individually identifiable health information and to provide timely notice of these changes to others with whom the underlying information has been shared. Moreover, persons and entities should develop processes to detect, prevent, and mitigate any unauthorized changes to, or deletions of, individually identifiable health information.* ### Collection, Use, and Disclosure Limitation Key Privacy/Security Principle of Meaningful Use 2011 Objectives URL: https://hipaa.com/collection-use-and-disclosure-limitation-key-privacysecurity-principle-of-meaningful-use-2011-objectives/ Last updated: 2009-07-01T12:38:00.000Z On December 15, 2008, the Office of the National Coordinator for Health Information Technology of the U.S. Department of Health and Human Services (HHS) published its 11 page report: *Nationwide Privacy and Security Framework for Electronic Exchange of Individually Identifiable Health Information*. The eight principles in this report underpin the HIPAA Administrative Simplification Privacy and Security Rule standards, provide a foundation of the Privacy provisions of the HITECH Act in the American Recovery and Reinvestment Act of 2009, signed by President Obama on February 17, 2009, and are a key objective of proposed 2011 *Objective* recommendations for *Meaningful Use* published by HHS’ Health IT Policy Committee on June 16, 2009\. The *Framework* and *Meaningful Use* documents are [available here](http://www.hipaa.com/2009/06/hhss-hit-policy-committee-releases-draft-recommendations-on-meaningful-use-for-public-comment/?ref=hipaa.com). In this series of postings, we reproduce—one at a time—Level 1 and Level 2 descriptions of the eight principles. A Level 1 (L1) description is a “short title and concise statement,” and a Level 2 (L2) description is a “short explanation that further elaborates on the principle, what it is designed to do, and its parameters.” The fifth of the eight principles is: **(L1) COLLECTION, USE, AND DISCLOSURE LIMITATION**. Individually identifiable health information should be collected, used, and/or disclosed only to the extent necessary to accomplish a specified purpose(s) and never to discriminate inappropriately. \[p. 8\] **(L2)** *Establishing appropriate limits on the type and amount of information collected, used, and/or disclosed increases privacy protections and is essential to building trust in electronic exchange of individually identifiable health information because it minimizes potential misuse and abuse. Persons and entities that participate in a network for the purpose of electronic exchange of individually identifiable health information should only collect, use, and/or disclose information necessary to accomplish a specified purpose(s). Persons and entities should take advantage of technological advances to limit data collection, use, and/or disclosure.* ### Individual Choice Key Privacy/Security Principle of Meaningful Use 2011 Objectives URL: https://hipaa.com/individual-choice-key-privacysecurity-principle-of-meaningful-use-2011-objectives/ Last updated: 2009-06-30T12:35:26.000Z On December 15, 2008, the Office of the National Coordinator for Health Information Technology of the U.S. Department of Health and Human Services (HHS) published its 11 page report: *Nationwide Privacy and Security Framework for Electronic Exchange of Individually Identifiable Health Information*. The eight principles in this report underpin the HIPAA Administrative Simplification Privacy and Security Rule standards, provide a foundation of the Privacy provisions of the HITECH Act in the American Recovery and Reinvestment Act of 2009, signed by President Obama on February 17, 2009, and are a key objective of proposed 2011 *Objective* recommendations for *Meaningful Use* published by HHS’ Health IT Policy Committee on June 16, 2009\. The *Framework* and *Meaningful Use* documents are [available here](http://www.hipaa.com/2009/06/hhss-hit-policy-committee-releases-draft-recommendations-on-meaningful-use-for-public-comment/?ref=hipaa.com). In this series of postings, we reproduce—one at a time—Level 1 and Level 2 descriptions of the eight principles. A Level 1 (L1) description is a “short title and concise statement,” and a Level 2 (L2) description is a “short explanation that further elaborates on the principle, what it is designed to do, and its parameters.” The fourth of the eight principles is: **(L1) INDIVIDUAL CHOICE**. Individuals should be provided a reasonable opportunity and capability to make informed decisions about the collection, use, and disclosure of their individually identifiable health information. \[p. 8\] **(L2)** *The ability of individuals to make choices with respect to electronic exchange of individually identifiable health information concerning them is important to building trust. Persons and entities that participate in a network for the purpose of electronic exchange of individually identifiable health information should provide reasonable opportunities and capabilities for individuals to exercise choice with respect to their individually identifiable health information.* *The degree of choice made available may vary with the type of information being exchanged, the purpose of the exchange, and the recipient of the information. Applicable law, population health needs, medical necessity, ethical principles, and technology, among other factors, may affect options for expressing choice. Individuals should be able to designate someone else, such as a family member, caregiver, or legal guardian, to make decisions on their behalf. When an individual exercises choice, including the ability to designate someone else to make decisions on his or her behalf, the process should be fair and not unduly burdensome.* ### Openness and Transparency Key Privacy/Security Principle of Meaningful Use 2011 Objectives URL: https://hipaa.com/openness-and-transparency-key-privacysecurity-principle-of-meaningful-use-2011-objectives/ Last updated: 2009-06-29T12:30:50.000Z On December 15, 2008, the Office of the National Coordinator for Health Information Technology of the U.S. Department of Health and Human Services (HHS) published its 11 page report: *Nationwide Privacy and Security Framework for Electronic Exchange of Individually Identifiable Health Information*. The eight principles in this report underpin the HIPAA Administrative Simplification Privacy and Security Rule standards, provide a foundation of the Privacy provisions of the HITECH Act in the American Recovery and Reinvestment Act of 2009, signed by President Obama on February 17, 2009, and are a key objective of proposed 2011 *Objective* recommendations for *Meaningful Use* published by HHS’ Health IT Policy Committee on June 16, 2009\. The *Framework* and *Meaningful Use* documents are [available here](http://www.hipaa.com/2009/06/hhss-hit-policy-committee-releases-draft-recommendations-on-meaningful-use-for-public-comment/?ref=hipaa.com). In this series of postings, we reproduce—one at a time—Level 1 and Level 2 descriptions of the eight principles. A Level 1 (L1) description is a “short title and concise statement,” and a Level 2 (L2) description is a “short explanation that further elaborates on the principle, what it is designed to do, and its parameters.” The third of the eight principles is: **(L1) OPENNESS AND TRANSPARENCY**. There should be openness and transparency about policies, procedures, and technologies that directly affect individuals and/or their individually identifiable health information. \[p. 7\] **(L2)** *Trust in electronic exchange of individually identifiable health information can best be established in an open and transparent environment. Individuals should be able to understand what individually identifiable health information exists about them, how that individually identifiable health information is collected, used, and disclosed and whether and how they can exercise choice over such collections, uses, and disclosures. Persons and entities that participate in a network for the purpose of electronic exchange of individually identifiable health information should provide reasonable opportunities for individuals to review who has accessed their individually identifiable health information or to whom it has been disclosed, in a readable form and format. Notice of policies, procedures, and technology—including what information will be provided under what circumstances—should be timely and, wherever possible, made in advance of the collection, use, and/or disclosure of individually identifiable health information. Policies and procedures developed consistent with this Nationwide Privacy and Security Framework for Electronic Exchange of Individually Identifiable Health Information should be communicated in a manner that is appropriate and understandable to individuals.* ### Correction Key Privacy/Security Principle of Meaningful Use 2011 Objectives URL: https://hipaa.com/correction-key-privacysecurity-principle-of-meaningful-use-2011-objectives/ Last updated: 2009-06-26T12:30:11.000Z On December 15, 2008, the Office of the National Coordinator for Health Information Technology of the U.S. Department of Health and Human Services (HHS) published its 11 page report: *Nationwide Privacy and Security Framework for Electronic Exchange of Individually Identifiable Health Information*. The eight principles in this report underpin the HIPAA Administrative Simplification Privacy and Security Rule standards, provide a foundation of the Privacy provisions of the HITECH Act in the American Recovery and Reinvestment Act of 2009, signed by President Obama on February 17, 2009, and are a key objective of proposed 2011 *Objective* recommendations for *Meaningful Use* published by HHS’ Health IT Policy Committee on June 16, 2009\. The *Framework* and *Meaningful Use* documents are [available here](http://www.hipaa.com/2009/06/hhss-hit-policy-committee-releases-draft-recommendations-on-meaningful-use-for-public-comment/?ref=hipaa.com). In this series of postings, we reproduce—one at a time—Level 1 and Level 2 descriptions of the eight principles. A Level 1 (L1) description is a “short title and concise statement,” and a Level 2 (L2) description is a “short explanation that further elaborates on the principle, what it is designed to do, and its parameters.” The second of the eight principles is: **(L1) CORRECTION**. Individuals should be provided with a timely means to dispute the accuracy or integrity of their individually identifiable health information, and to have erroneous information corrected or to have a dispute documented if their requests are denied. \[p. 7\] **(L2)** *Individuals have an important stake in the accuracy and integrity of their individually identifiable health information and an important role to play in ensuring its accuracy and integrity. Electronic exchange of individually identifiable health information may improve care and reduce adverse events. However, any errors or conclusions drawn from erroneous data may be easily communicated or replicated (e.g., as a result of an administrative error as simple as a transposed digit or more complex error arising from medical identity theft). For this reason it is essential for individuals to have practical, efficient, and timely means for disputing the accuracy or integrity of their individually identifiable health information, to have this information corrected, or a dispute documented when their requests are denied, and to have the correction or dispute communicated to others with whom the underlying information has been shared. Persons and entities that participate in a network for the purpose of electronic exchange of individually identifiable health information should make processes available to empower individuals to exercise a role in managing their individually identifiable health information and should correct information or document disputes in a timely fashion.* ### Individual Access Key Privacy/Security Principle of Meaningful Use 2011 Objectives URL: https://hipaa.com/individual-access-key-privacysecurity-principle-of-meaningful-use-2011-objectives/ Last updated: 2009-06-25T12:30:57.000Z On December 15, 2008, the Office of the National Coordinator for Health Information Technology of the U.S. Department of Health and Human Services (HHS) published its 11 page report: *Nationwide Privacy and Security Framework for Electronic Exchange of Individually Identifiable Health Information*. The eight principles in this report underpin the HIPAA Administrative Simplification Privacy and Security Rule standards, provide a foundation of the Privacy provisions of the HITECH Act in the American Recovery and Reinvestment Act of 2009, signed by President Obama on February 17, 2009, and are a key objective of proposed 2011 *Objective* recommendations for *Meaningful Use* published by HHS’ Health IT Policy Committee on June 16, 2009\. The *Framework* and *Meaningful Use* documents are [available here](http://www.hipaa.com/2009/06/hhss-hit-policy-committee-releases-draft-recommendations-on-meaningful-use-for-public-comment/?ref=hipaa.com). In this series of postings, we reproduce—one at a time—Level 1 and Level 2 descriptions of the eight principles. A Level 1 (L1) description is a “short title and concise statement,” and a Level 2 (L2) description is a “short explanation that further elaborates on the principle, what it is designed to do, and its parameters.” The first of the eight principles is: **(L1) INDIVIDUAL ACCESS**. Individuals should be provided with a simple and timely means to access and obtain their individually identifiable health information in a readable form and format. \[p. 6\] **(L2)** *Access to information enables individuals to manage their health care and wellbeing. Individuals should have a reasonable means of access to their individually identifiable health information. Individuals should be able to obtain this information easily, consistent with security needs for authentication of the individual; and such information should be provided promptly so as to be useful for managing their health. Additionally, the persons and entities that participate in a network for the purpose of electronic exchange of individually identifiable health information should provide such information in a readable form and format, including an electronic format, when appropriate. In limited instances, medical or other circumstances may result in the appropriate denial of individual access to their health information.* ### Nationwide Privacy and Security Framework for Electronic Exchange: Key Meaningful Use 2011 Objective Recommendation URL: https://hipaa.com/nationwide-privacy-and-security-framework-for-electronic-exchange-key-meaningful-use-2011-objective-recommendation/ Last updated: 2009-06-24T12:38:05.000Z On December 15, 2008, the Office of the National Coordinator for Health Information Technology of the U.S. Department of Health and Human Services (HHS) published its 11 page report: *Nationwide Privacy and Security Framework for Electronic Exchange of Individually Identifiable Health Information*. This report states: “\[a\] key factor to achieving a high-level of trust among individuals, health care providers, and other health care organizations participating in electronic health information exchange is the development of, and adherence to, a consistent and coordinated approach to privacy and security. Clear, understandable, uniform principles are a first step in developing a consistent and coordinated approach to privacy and security and a key component to building the trust required to realized the potential benefits of electronic health information exchange.” \[p. 1\] With eight principles outlined the report, “\[t\]he goal of this effort is to establish a policy framework for electronic health information exchange that can help guide the Nation’s adoption of health information technologies and help improve the availability of health information and health care quality. The principles have been designed to establish the roles of individuals and the responsibilities of those who hold and exchange electronic individually identifiable health information through a network.” \[p. 1\] The principles provide a foundation of the Privacy provisions of the HITECH Act in the American Recovery and Reinvestment Act of 2009, signed by President Obama on February 17, 2009, and are a key objective of proposed 2011 *Objective* recommendations for *Meaningful Use* published by HHS’ Health IT Policy Committee on June 16, 2009\. Both of those documents are available on the HIPAA.com site. In this posting, we reproduce Level 1 descriptions of the eight principles: “short title and concise statement.” In eight subsequent postings, we add Level 2 descriptions of each principle: “short explanation that further elaborates on the principle, what it is designed to do, and its parameters.” As the report states: “These principles are expected to guide the actions of all health care-related persons and entities that participate in a network for the purpose of electronic exchange of individually identifiable health information. These principles are not intended to apply to individuals with respect to their own individually identifiable health information… Individuals may use and/or disclose their individual health information as they choose \[as they are not covered entities, as defined in HIPAA Administrative Simplification standards\].” \[p. 4\] The eight principles are: » INDIVIDUAL ACCESS. Individuals should be provided with a simple and timely means to access and obtain their individually identifiable health information in a readable form and format. \[p. 6\] » CORRECTION. Individuals should be provided with a timely means to dispute the accuracy or integrity of their individually identifiable health information, and to have erroneous information corrected or to have a dispute documented if their requests are denied. \[p. 7\] » OPENNESS AND TRANSPARENCY. There should be openness and transparency about policies, procedures, and technologies that directly affect individuals and/or their individually identifiable health information. \[p. 7\] » INDIVIDUAL CHOICE. Individuals should be provided a reasonable opportunity and capability to make informed decisions about the collection, use, and disclosure of their individually identifiable health information. \[p. 8\] » COLLECTION, USE, AND DISCLOSURE LIMITATION. Individually identifiable health information should be collected, used, and/or disclosed only to the extent necessary to accomplish a specified purpose(s) and never to discriminate inappropriately. \[p. 8\] » DATA QUALITY AND INTEGRITY. Persons and entities should take reasonable steps to ensure that individually identifiable health information is complete, accurate, and up-to-date to the extent necessary for the person’s or entity’s intended purposes and has not been altered or destroyed in an unauthorized manner. \[p. 8\] » SAFEGUARDS. Individually identifiable health information should be protected with reasonable administrative, technical, and physical safeguards to ensure its confidentiality, integrity, and availability and to prevent unauthorized or inappropriate access, use, or disclosure. \[p. 9\] » ACCOUNTABILITY. These principles should be implemented, and adherence assured, through appropriate monitoring and other means and methods should be in place to report and mitigate non-adherence and breaches. \[p. 9\] ### Nationwide Privacy and Security Framework for Electronic Exchange of Individually Identifiable Health Information URL: https://hipaa.com/nationwide-privacy-and-security-framework-for-electronic-exchange-of-individually-identifiable-health-information/ Last updated: 2026-10-24T21:33:14.000Z Office of the National Coordinator for Health Information Technology U.S. Department of Health and Human Services Numerous forces are driving the health care industry towards the use of health information technology, such as the potential for reducing medical errors and health care costs, and increasing individuals’ involvement in their own health and health care. To facilitate this advancement and reap its benefits while reducing the risks, it is important to consider individual privacy interests together with the potential benefits to population health. - [Download](https://hipaa.com/content/files/2026/10/nationwideps%5Fframework-5.pdf) (Requires [Acrobat Reader](http://get.adobe.com/reader/?ref=hipaa.com)) ### HHS’s Health IT Policy Committee 2011 Draft Meaningful Use Objectives and Measures for Public Comment URL: https://hipaa.com/hhss-health-it-policy-committee-2011-draft-meaningful-use-objectives-and-measures-for-public-comment/ Last updated: 2009-06-23T14:00:38.000Z The HITECH Act of the American Recovery and Reinvestment Act of 2009, signed by President Obama on February 17, 2009, provides an electronic health record (EHR) adoption incentive program for healthcare providers who adopt certified electronic health records *and* use them in a meaningful way to improve patient care. The incentive program begins in January 2011 and terminates at the end of 2014 for new adopters of certified electronic health record technology. HHS’ Health Information Technology (IT) Policy Committee released on June 16, 2009, two documents pertaining to the definition of “meaningful use” for public comment by 5 PM ET, Friday, June 26, 2009\. These documents are the *Meaningful Use Preamble* and *Meaningful Use Matrix*, [available here](http://www.hipaa.com/2009/06/hhss-hit-policy-committee-releases-draft-recommendations-on-meaningful-use-for-public-comment/?ref=hipaa.com). Information on providing public comment is [available online](http://healthit.hhs.gov/portal/server.pt?open=512&objID=1269&parentname=CommunityPage&parentid=26&mode=2&in%5Fhi%5Fuserid=11113&cached=true&ref=hipaa.com), along with other information on the HIT Policy Committee and its activities. In our previous posting on [Meaningful Use](http://www.hipaa.com/2009/06/hhss-hit-policy-committee-releases-draft-recommendations-on-meaningful-use-for-public-comment/?ref=hipaa.com), we outlined Health Outcomes Policy Priorities and Care Goals, and described the Meaningful Use Preamble and Meaningful Use Matrix. In this posting, HIPAA.com reproduces the draft recommendation 2011 Objectives and Measures for each of the five Health Outcomes Policy Priorities. We recommend that you review the previous posting prior to examining the 2011 Objectives and 2011 Measures. Remember, the deadline for public comment is 5 PM ET, Friday, June 26, 2009. **Meaningful Use Matrix** The meaningful use matrix outlines in Column 1 of eight columns five Health Outcomes Policy Priorities (P), and in Columns 3 and 4 2011 Objectives (O) and 2001 Measures (M), respectively. **(P) Improve quality, safety, efficiency, and reduce health disparities** » (O) Use CPOE for all order types including medications (OP, IP) » (O) Implement drug-drug, drug-allergy, drug-formulary checks (OP, IP) » (O) Maintain and up-to-date problem list (OP, IP) Generate and transmit permissible prescriptions electronically (eRX)(OP) » (O) Maintain active medication list (OP, IP) » (O) Record primary language, insurance type, gender, race, ethnicity (OP, IP) » (O) Record vital signs including height, weight, blood pressure (OP, IP) » (O) Incorporate lab-test results in EHR (OP, IP) » (O) Generate lists of patients by specific condition to use for quality improvement, reduction of disparities, and outreach (OP) » (O) Send reminders to patients per patient preference for preventive/follow-up care (OP, IP) » (O) Document a progress note for each encounter (OP) » (M) Report quality measures, including » % diabetics with A1c under control (OP) » % hypertensive patients with BP under control (OP) » % of patients with LDL under control (OP) » % of smokers offered smoking cessation counseling (OP, IP) » (M) % of patients with recorded BMI (OP) » (M) % eligible surgical patients who received VTE prophylaxis (IP) » (M) % of orders entered directly by physicians through CPOE » (M) Use of high-risk medications in the elderly (OP, IP) » % of patients over 50 with annual colorectal cancer screenings (OP) » (M) % of females over 50 receiving annual mammograms (OP) » (M) % patients at high-risk for cardiac events on aspirin prophylaxis (OP) » (M) % of patients with current pneumovax (OP) » (M) % eligible patients who received flu vaccine (OP) » (M) % lab results incorporated into EHR in coded format (OP, IP) » (M) Stratify reports by gender, insurance type, primary language, race, ethnicity (OP, IP) **(P) Engage patients and families** » (O) Provide patients with electronic copy of—or electronic access to—clinical information (including lab results, problem list, medication lists, allergies) per patient preference (e.g., through PHR)(OP, IP) » (O) Provide access to patient-specific educational resources (OP, IP) » (O) Provide clinical summaries for patients for each encounter (OP, IP) » (M) % of all patients with access to personal health information electronically (OP, IP) » (M) % of all patients with access to patient-specific educational resources (OP, IP) » (M) % of encounters for which clinical summaries were provided (OP, IP) **(P) Improve care coordination** » (O) Exchange key clinical information among providers of care (e.g., problems, medications, allergies, test results)(OP, IP) » (O) Perform medication reconciliation at relevant encounters (OP, IP) » (M) Report 30-day readmission rate (IP) » (M) % of encounters where med reconciliation was performed (OP, IP) » (M) Implemented ability to exchange health information with external clinical entity (specifically labs, care summary and medication lists)(OP, IP) » (M) % of transitions in care for which summary care record is shared (e.g., electronic, paper, eFax)(OP, IP) **(P) Improve population and public health** » (O) Submit electronic data to immunization registries where required and accepted (OP, IP) » (O) Provide electronic submissions of reportable lab results to public health agencies (IP) » (O) Provide electronic syndrome surveillance data to public health agencies according to applicable law and practice (IP) » (M) Report up-to-date status for childhood immunizations (OP) » (M) % reportable lab results submitted electronically (IP) **(P) Ensure adequate privacy and security protections for personal health information** » (O) Compliance with HIPAA Privacy and Security Rules and state laws » (O) Compliance with fair data sharing practices set forth in the Nationwide Privacy and Security Framework \[released by HHS’ Office of the National Coordinator for Health Information Technology on December 15, 2008, and available on the HIPAA.com site\] » (M) Full compliance with HIPAA Privacy and Security Rules » (M) An entity under investigation for a HIPAA privacy or security violation cannot achieve meaningful use until the entity is cleared by the investigating authority » (M) Conduct or update a security risk assessment and implement security updates as necessary. The 2011 Objectives are described in the Meaningful Use Matrix header to Column 3 as follows: “Goal is to electronically capture in coded format and to report health information and to use that information to track by clinical conditions.” The *Meaningful Use Preamble* elaborates further: “Although some recommended measure used to assess meaningful use in 2011 may apply to specific chronic diseases, the recommended 2011 objective are meant to establish a foundation for affecting a more comprehensive set of health outcomes in the future…. In identifying potential criteria for ‘meaningful use’ of an electronic health record, it became apparent that that there are considerable gaps in EHR-generated measures available to monitor key desired policy outcomes (e.g., efficiency, patient safety, care coordination)…. \[T\]hese measures will not be required for Medicare and Medicaid incentive payments until 2013….” The Health IT Policy Committee “is seeking feedback on how to best frame these measures including measurement of key public health conditions, measuring health care efficiency, and measuring the avoidance of certain adverse events. These comments will be used to help revise the recommended measurement strategy to include more extensive and refined outcome measures for ‘meaningful use’ in 2013 and beyond. Remember, if you have a contribution to make concerning the definition of *meaningful use*, your comments should be submitted no later than 5 PM ET, on Friday, June 26, 2009\. Instructions for submission are at the at the site shown at the healthit site shown at the beginning of this posting. ### HHS’s HIT Policy Committee Releases Draft Recommendations on Meaningful Use for Public Comment URL: https://hipaa.com/hhss-hit-policy-committee-releases-draft-recommendations-on-meaningful-use-for-public-comment/ Last updated: 2009-06-22T12:38:08.000Z The HITECH Act of the American Recovery and Reinvestment Act of 2009, signed by President Obama on February 17, 2009, provides an electronic health record (EHR) adoption incentive program for healthcare providers who adopt certified electronic health records and use them in a meaningful way to improve patient care. The incentive program begins in January 2011 and terminates at the end of 2014 for new adopters of certified electronic health record technology. HHS' Health Information Technology (IT) Policy Committee released on June 16, 2009, two documents pertaining to the definition of "meaningful use" for public comment by 5 PM ET, Friday, June 26, 2009\. These documents are the *Meaningful Use Preamble* and *Meaningful Use Matrix*. Information on providing public comment is available online at the [HHS website](http://healthit.hhs.gov/portal/server.pt?open=512&objID=1269&parentname=CommunityPage&parentid=26&mode=2&in%5Fhi%5Fuserid=11113&cached=true&ref=hipaa.com), along with other information on the HIT Policy Committee and its activities. HIPAA.com outlines the draft recommendation on meaningful use in two postings, and recommends that its site visitors read the 3-page Meaningful Use Preamble: [*Meaningful Use: A Definition-Recommendations from the Meaningful Use Workgroup to the Health IT Policy Committee, June 16, 2009*](http://static.hipaa.com/documents/Meaningful%20Use%20Preamble.pdf?ref=hipaa.com), prior to examining the [*Meaningful Use Matrix*](http://static.hipaa.com/documents/Meaningful%20Use%20Matrix.pdf?ref=hipaa.com). In this posting, we take a high level view of the content of the matrix, reproducing Health Outcomes Policy Priorities, embedded Care Goals, and summary Objectives for each of the years 2011, 2013, and 2015, and Measures for tracking objective performance in each of those years. In the next posting, HIPAA.com reproduces Objectives and Measures for 2011, the first year for which healthcare providers will be eligible for incentives under Medicare. **Meaningful Use Matrix** The meaningful use matrix outlines in Column 1 of eight columns five *Health Outcomes Policy Priorities* (P), and for each priority, in Column 2, *Care Goals* (G): (P) Improve quality, safety, efficiency, and reduce health disparities » (G) Provide access to comprehensive patient health data for patient's health care team » (G) Use evidence-based order sets and CPOE \[computerized physician order entering\] » (G) Apply clinical decision support at the point of care » (G) Generate lists of patients who need care and use them to reach out to patients (e.g., reminders, care instructions, etc.) » (G) Report to patient registries for quality improvement, public reporting, etc. (P) Engage patients and families » (G) Provide patients and families with access to data, knowledge, and tools to make informed decisions and to manage their health (P) Improve care coordination » (G) Exchange meaningful clinical information among professional health care team (P) Improve population and public health » (G) Communicate with public health agencies (P) Ensure adequate privacy and security protections for personal health information » (G) Ensure privacy and security protections for confidential information through operating policies, procedures, and technologies and compliance with applicable law» (G) Provide transparency of data sharing to patient. For each set of priorities and embedded goals, there are three combinations of objectives and measures for three years: » 2011: To electronically capture in coded format and to report health information and to use that information to track key clinical conditions » 2013: To guide and support care processes and care coordination » 2015: To achieve and improve performance and support care processes and on key health system outcomes. The *Meaningful Use Preamble* from the Health IT Policy Committee recognizes that meaningful use will evolve over time as "considerable gaps in EHR-generated measures available to monitor key desired policy outcomes (e.g., efficiency, patient safety, care coordination)" are closed. Hence, the objectives and measures for 2013 build on those of 2011, and those of 2015 build on those of the preceding years. The Centers for Medicare & Medicaid (CMS) expects to issue a notice of proposed rulemaking (NPRM) relating to the EHR adoption incentive program and definition of meaningful use late in 2009. ### Integrity: Mechanism to Authenticate Electronic Protected Health Information-What to Do and How to Do It URL: https://hipaa.com/integrity-mechanism-to-authenticate-electronic-protected-health-information-what-to-do-and-how-to-do-it/ Last updated: 2009-06-12T14:00:12.000Z In our series on the HIPAA Administrative Simplification Security Rule, this is the implementation specification for the third Technical Safeguard Standard, Integrity. This implementation specification is addressable. Addressable does not mean “optional.” Rather, an addressable implementation specification means that a covered entity must use reasonable and appropriate measures to meet the standard. As we noted in earlier postings on HIPAA.com, business associates of covered entities will be required to comply with the Security Rule safeguard standards, beginning February 17, 2010\. This requirement is one of the HITECH Act provisions of the American Recovery and Reinvestment Act (ARRA), signed by President Obama on February 17, 2009. **What to Do** Implement electronic controls to ensure that electronic protected health information has not been altered or destroyed in an unauthorized manner. **How to Do It** A covered entity or its electronic information systems vendor should establish electronic controls to protect electronic protected health information from being altered or destroyed. The covered entity’s risk analysis will determine how the covered entity should authenticate electronic protected health information in its electronic information systems. Considerations should include how many times the covered entity’s system has crashed and damaged information in storage, or how many times incorrect information has been added to the database that should not have been allowed. An outcome of the risk analysis, based on these types of considerations, will be how to mitigate risk through preventive electronic controls. Controls that check for human errors and accuracy of back-ups should be employed. In addition, intrusion detection systems should be used if there is evidence of hacking or tampering attempts. The Security Official of the covered entity is responsible for designing policies and procedures to ensure the integrity of electronic protected health information. A policy should be regular testing for data integrity. A covered entity should check with its electronic information systems vendor to see if its systems have automatic data integrity testing capabilities. If not, the vendor should be able to recommend software programs to add to the covered entity’s electronic information systems to do such testing. The policy for the covered entity also should include regular examination of test logs to ensure that integrity checks have run successfully. ### Integrity: What This HIPAA Security Rule Technical Safeguard Standard Means URL: https://hipaa.com/integrity-what-this-hipaa-security-rule-technical-safeguard-standard-means/ Last updated: 2009-06-11T13:00:35.000Z This is the third Technical Safeguard Standard of the HIPAA Administrative Simplification Security Rule. It has one implementation specification: mechanism to authenticate electronic protected health information. This implementation specification is addressable. Addressable does not mean “optional.” Rather, an addressable implementation specification means that a covered entity must use reasonable and appropriate measures to meet the standard. As we have noted in earlier postings on HIPAA.com, business associates of covered entities will be required to comply with the Security Rule safeguard standards, beginning February 17, 2010\. This requirement is one of the HITECH Act provisions of the American Recovery and Reinvestment Act (ARRA), signed by President Obama on February 17, 2009. For compliance with this Technical Safeguard Standard, a covered entity is required to implement policies and procedures to protect electronic protected health information from improper alteration or destruction. Integrity means that a covered entity’s data are dependable and accurate. It also means that the authorized user can have access to the right information at the appropriate time, and that the data are not altered or destroyed in any manner. Inaccurate electronic protected health information could result in harm or even potential death of a patient. In addition, the risk of such information could adversely impair the business viability of one or more covered entities. It is for these reasons that integrity is one of the foundational concepts underpinning HIPAA Administrative Simplification, along with availability and confidentiality. The Technical Safeguard Standards of access control and audit control can help in maintaining confidentiality of electronic protected health information, but data comprising such information can become inaccurate or corrupt from several sources, including data entry errors, hacking or tampering, mechanical errors in storage devices, transmission error, and inadequate data capture from poorly integrated or interfaced electronic information systems. Also, corruption of data can be due to software or programming bugs, computer viruses, or human error. A covered entity must ensure that its electronic protected health information, as well as other critical electronic business information, has not been altered or destroyed without its knowledge and approval. ### Audit Control: What to Do and How to Do It URL: https://hipaa.com/audit-control-what-to-do-and-how-to-do-it/ Last updated: 2009-06-10T12:18:21.000Z In our series on the HIPAA Administrative Simplification Security Rule, this is the second Technical Safeguard Standard. There is not a separately described implementation specification. Rather, this standard’s implementation specification is connoted in the language of the standard and is required. As we have noted in earlier postings on HIPAA.com, business associates of covered entities will be required to comply with the Security Rule safeguard standards, beginning February 17, 2010\. This requirement is one of the HITECH Act provisions of the American Recovery and Reinvestment Act (ARRA), signed by President Obama on February 17, 2009. **What to Do** A covered entity is required to implement hardware, software, and/or procedural mechanisms that record and examine activity in electronic information systems that contain or use electronic protected health information. **How to Do It** During the risk analysis, a covered entity needs to define the reasons for establishing audit trail mechanisms and procedures for its electronic information systems that contain or use electronic protected health information. These reasons may include, but are not limited to, system troubleshooting, policy enforcement, compliance with the Security Rule, mitigating risks of security incidents, monitoring workforce member activities and actions. With regard to workforce member activities and actions, audit controls might focus on the following: » Are workforce members accessing information or performing tasks beyond the scope of their job descriptions? » Are workforce members sharing user IDs, measured by a user logged onto two or more workstations simultaneously? » Are workforce members logged onto workstations for several days, indicating that users are not logging off? An automatic logoff system may mitigate risk when workforce members leave workstations unattended during the workday, but the better practice at the end of the workday is for the covered entity to have a policy of workforce members taking the responsibility to log off. In establishing or fine-tuning its policies and procedures with respect to audit controls, a covered entity should focus on the following, under the direction of its Security Official: » Maintaining a regular and frequent review of audit trails and activity logs for electronic information systems containing electronic protected health information. » Investigating immediately any suspicious entries such as unauthorized accesses or attempts to access electronic information systems containing electronic protected health information. » Applying sanctions to workforce members for inappropriate activity related to electronic information systems containing electronic protected health information. » Determining if workforce members are downloading executable files that may violate software licensing agreements or that may corrupt electronic information systems containing electronic protected health information. Finally, with the Federal Trade Commission (FTC) Red Flags Rule to protect against identity theft, requiring compliance by covered entities that offer extended payment plans, covered entities need to examine their policies and procedures with respect to this Rule prior to the August 1, 2009 compliance date. Additional information is available on the HIPAA.com site. ### Audit Control: What This HIPAA Security Rule Technical Safeguard Standard Means URL: https://hipaa.com/audit-control-what-this-hipaa-security-rule-technical-safeguard-standard-means/ Last updated: 2009-06-09T19:24:07.000Z This is the second Technical Safeguard Standard of the HIPAA Administrative Simplification Security Rule. There is not a separately described implementation specification. Rather, this standard’s implementation specification is connoted in the language of the standard and is required. As we have noted in earlier postings on HIPAA.com, business associates of covered entities will be required to comply with the Security Rule safeguard standards, beginning February 17, 2010\. This requirement is one of the HITECH Act provisions of the American Recovery and Reinvestment Act (ARRA), signed by President Obama on February 17, 2009. Covered entities are required to have in place audit controls to monitor activity on their electronic systems that contain or use electronic protected health information. In addition, they have to have a policy in place for regularly monitoring and reviewing of audit records to ensure that activity on those electronic systems is appropriate. Such activity would include, but is not limited to, logons and logoffs, file accesses, updates, edits, and any security incidents. Monitoring and review of audit trails must be as close to real time as possible to be useful. There is no benefit in discovering a problem days or weeks after it has occurred. How a covered entity sets its policies and procedures will be based on outcomes of the covered entity’s risk analysis. If a security incident occurs, failure to exercise this audit control standard may be proof in an inquiry that a covered entity had the capability of knowing what was occurring, but failed to exercise timely corrective action. ### Access Control: Encryption and Decryption-What to Do and How to Do It URL: https://hipaa.com/access-control-encryption-and-decryption-what-to-do-and-how-to-do-it/ Last updated: 2026-10-24T21:33:31.000Z In our series on the HIPAA Administrative Simplification Security Rule, this is the fourth implementation specification for the Technical Safeguard Standard, Access Control. This implementation specification is addressable. Addressable does not mean "optional." Rather, an addressable implementation specification means that a covered entity must use reasonable and appropriate measures to meet the standard. As we noted in earlier postings on HIPAA.com, business associates of covered entities will be required to comply with the Security Rule safeguard standards, beginning February 17, 2010\. This requirement is one of the HITECH Act provisions of the American Recovery and Reinvestment Act (ARRA), signed by President Obama on February 17, 2009. **What to Do** Implement a mechanism to encrypt and decrypt electronic protected health information. **How to Do It** Encryption converts the message in a file or document from a readable to an unreadable format. Decryption is the reverse, allowing encrypted information to be converted from an unreadable format to a readable format. On April 17, 2009, the U.S. Department of Health and Human Services issued Guidance Specifying the Technologies and Methodologies That Render Protected Health Information Unusable, Unreadable, or Indecipherable to Unauthorized Individuals for Purposes of the Breach Notification Requirements under Section 13402 of Title X!!! (Health Information Technology for Economic and Clinical Health Act) of the American Recovery and Reinvestment Act of 2009, which is available on the HIPAA.com site. The guidance is related to forthcoming HHS and FTC 'breach notification' regulations pertaining to 'unsecured protected health information.' We provide excerpts here from the aforementioned guidance that is germane to electronic protected health information and encryption, therefore to this implementation specification. "The term 'unsecured protected health information' includes PHI \[protected health information\] in any form that is not secured through the use of a technology or methodology specified in this guidance. This guidance, however addresses methods for rendering PHI in paper or electronic form unusable, unreadable, or indecipherable to unauthorized individuals. "Data comprising PHI can be vulnerable to a breach in any of the commonly recognized data states: 'data in motion' (i.e., data that is moving through a network, including wireless transmission); 'data at rest' (i.e., data that resides in databases, file systems, and other structured storage methods); 'data in use' (i.e., data in the process of being created, retrieved, updated, or deleted); or 'data disposed' (e.g., discarded paper records or recycled electronic media).' "Encryption is one method of rendering electronic PHI unusable, unreadable, or indecipherable to unauthorized persons. The successful use of encryption depends upon two main features: the strength of the encryption algorithm and the security of the decryption key or process. The specification of encryption methods in this guidance includes the condition that the processes or keys that might enable decryption have not been breached.... "Guidance Specifying the Technologies and Methodologies that Render Protected Health Information Unusable, Unreadable, or Indecipherable to Unauthorized Individuals. "Protected health information (PHI) is rendered unusable, unreadable, or indecipherable to unauthorized individuals only if one or more of the following applies: "a) Electronic PHI has been encrypted as specified in the HIPAA Security Rule by 'the use of an algorithmic process to transform data into a form in which there is a low probability of assigning meaning without use of a confidential process or key' and such confidential process or key that might enable decryption has not been breached. Encryption process identified below have been tested by the National Institute of Standards and Technology (NIST) and judged to meet this standard. 1\. Valid encryption processes for data at rest are consistent with [NIST Special Publication 800-111, Guide to Storage Encryption Technologies for End Use Devices, November 2007](https://hipaa.com/content/files/2026/10/sp800-111-1.pdf). 2\. "Valid encryption processes for data in motion are those that comply with the requirements of Federal Information Processing Standards (FIPS) 140-2\. These include, as appropriate, standards described in NIST Special Publications \* [800-52, Guidelines for the Selection and Use of Transport Layer Security (TLS) Implementations, June 2005](http://static.hipaa.com/documents/SP800-52.pdf?ref=hipaa.com); \* [800-77, Guide to IPsec VPNs, December 2005](http://static.hipaa.com/documents/sp800-77.pdf?ref=hipaa.com); \* [800-113, Guide to SSL VPNs, July 2008](https://hipaa.com/content/files/2026/10/sp800-113-1.pdf); and \* May include others, which are FIPS 140-2 validated. ...." Again, a covered entity must rely on outcomes of its risk analysis to determine whether encryption is necessary. In that risk analysis, the covered entity should evaluate potential risks and costs of breach of unsecured electronic protected health information that becomes accessible to unauthorized users outside of the covered entity, whether data at rest or data in motion, which would trigger the new 'breach notification' provisions of the HITECH Act. If a covered entity does not encrypt electronic protected health information, then it must document its decision and explain why this implementation specification does not apply. Even in the absence of exposure to an open network, a covered entity should consider in its risk analysis costs and benefits of encrypting electronic protected health information at rest on its closed electronic information system. With expected increased use of electronic transactions in healthcare, such as e-prescribing, and electronic communications via email, say, between a physician practice and a patient, most covered entities will be using open systems and will have need for encryption tools. HIPAA.com recommends that you contact your electronic information system hardware and software vendors for advice on encryption, and that you also consult the National Institute for Standards and Technology (NIST) Special Publication 800-53, Revision 3: Recommended Security Controls for Federal Information Systems and Organizations (Initial Public Draft), February 2009, and [NIST Special Publication 800-66, Revision 1, An Introductory Resource Guide for Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule, October 2008](http://static.hipaa.com/documents/SP-800-66-Revision1.pdf?ref=hipaa.com). ### Access Control: Automatic Logoff-What to Do and How to Do It URL: https://hipaa.com/access-control-automatic-logoff-what-to-do-and-how-to-do-it/ Last updated: 2009-06-05T14:00:49.000Z In our series on the HIPAA Administrative Simplification Security Rule, this is the third implementation specification for the Technical Safeguard Standard, Access Control. This implementation specification is addressable. Addressable does not mean "optional." Rather, an addressable implementation specification means that a covered entity must use reasonable and appropriate measures to meet the standard. As we noted in earlier postings on HIPAA.com, business associates of covered entities will be required to comply with the Security Rule safeguard standards, beginning February 17, 2010\. This requirement is one of the HITECH Act provisions of the American Recovery and Reinvestment Act (ARRA), signed by President Obama on February 17, 2009. **What to Do** Implement electronic procedures that terminate an electronic session after a predetermined time of inactivity. **How to Do It** A covered entity should activate a password-protected screensaver that automatically prevents unauthorized users from viewing or accessing electronic protected health information from unattended electronic information system devices. This is an addressable implementation specification, so timeouts and logoff features will relate to size of covered entity and degree of access to electronic information system devices. As a benchmark, establish a 10-minute timeout period before the logoff capability locks the device and makes information inaccessible. Devices in high-traffic areas might have a timeout of 2 to 3 minutes. Devices in protected areas with controlled, limited access, such as a lab or isolated office, could have longer timeout periods. A log off would require the authorized user to re-enter a password to gain access to electronic protected health information. A covered entity without a logoff feature should consult its software vendor to build timeouts into all of its electronic information systems. Timeout settings will be suggested by the risk analysis, based on size of facility, and location and accessibility of electronic information system devices. The covered entity should pay particular attention to the growing use of handheld devices that can be moved from one part of a covered entity to another as it considers its timeout strategy. ### President Obama’s Council of Economic Advisers Outlines Economic Case for Health Care Reform URL: https://hipaa.com/president-obamas-council-of-economic-advisers-outlines-economic-case-for-health-care-reform/ Last updated: 2026-10-24T21:33:32.000Z The Council of Economic Advisers in the Executive Office of the President published on Tuesday, June 2, 2009, [*The Economic Case for Health Care Reform*](https://hipaa.com/content/files/2026/10/cea%5Fhealth%5Fcare%5Freport.pdf). We provide an excerpt from the beginning of the Executive Summary that highlights "large economic impacts" of health care reform, and the report's conclusion (Section VII on pp. 38-39) that highlights that the current "American health care system is on an unsustainable path." **Excerpt from Executive Summary** The Council of Economic Advisers (CEA) has undertaken a comprehensive analysis of the economic impacts of health care reform. The report provides an overview of current economic impacts of health care in the United States and a forecast of where we are headed in the absence of reform; an analysis of inefficiencies and market failures in the current health care system; a discussion of the key components of health care reform; and an analysis of the economic effects of slowing health care cost growth and expanding coverage. The findings in the report point to large economic impacts of genuine health care reform: » We estimate that slowing the annual growth rate of health care costs by 1.5 percentage points would increase real gross domestic product (GDP), relative to the no-reform baseline, by over 2 percent in 2020 and nearly 8 percent in 2030. » For a typical family of four, this implies that income in 2020 would be approximately $2,600 higher than it would have been without reform (in 2009 dollars), and that in 2030 it would be almost $10,000 higher. Under more conservative estimates of the reduction in the growth rate of health care costs, the income gains are smaller, but still substantial. » Slowing the growth rate of health care costs will prevent disastrous increases in the Federal budget deficit. » Slowing cost growth would lower the unemployment rate consistent with steady inflation by approximately one-quarter of a percentage point for a number of years. The beneficial impact on employment in the short and medium run (relative to the no-reform baseline) is estimated to be approximately 500,000 each year that the effect is felt. » Expanding health insurance coverage to the uninsured would increase net economic well-being by roughly $100 billion a year, which is roughly two-thirds of a percent of GDP. » Reform would likely increase labor supply, remove unnecessary barriers to job mobility, and help to "level the playing field" between large and small businesses. **Conculsion** The American health care system is on an unsustainable path. Expenditures as a share of GDP are already substantially higher than in other developed countries, and are projected to grow rapidly in the next three decades. This growth threatens to have a devastating impact on the growth in workers' take-home pay and the government budget deficit. It is also likely to increase the number of Americans without health insurance from its already very high level and thus undermine the health of our population. Successful health care reform will slow the growth rate of health care costs, maintain choices of doctors and health plans, and expand coverage. Slowing the growth rate of costs by 1.5 percentage points per year would have a dramatic impact on the trajectory of health care expenditures as a share of GDP over time. Slowing the growth rate of costs by a smaller amount (0.5 or 1.0 percentage point per year) would have smaller, but still important effects. Our analysis shows that successful health care reform would have major benefits for the U.S. economy. Over time, the slowing of cost growth through increased efficiency would bring about substantial increases in Americans' standard of living. It will also prevent devastating increases in the budget deficit and raise capital formation. We estimate that slowing health care cost growth by 1.5 percentage points will increase real GDP in 2030 by nearly 8 percent relative to what would happen without reform. We also find that slowing cost growth is likely to lower the unemployment rate consistent with steady inflation by roughly one-quarter of a percentage point for an extended period. The net welfare effects of expanding coverage to the uninsured are also likely to be very large-probably in the range of $100 billion each year. Genuine reform will also likely increase labor supply, reduce job lock, and aid small businesses. The kind of reform that will bring about these economic rewards will not be easy. It will require truly game-changing innovations in many areas. But, if we can bring about such changes, there will be substantial benefits to American households, businesses, and the economy as a whole. ### Access Control: Emergency Access Procedure-What to Do and How to Do It URL: https://hipaa.com/access-control-emergency-access-procedure-what-to-do-and-how-to-do-it/ Last updated: 2009-06-04T13:20:22.000Z In our series on the HIPAA Administrative Simplification Security Rule, this is the second implementation specification for the Technical Safeguard Standard, Access Control. This implementation specification is required. As we noted in earlier postings on HIPAA.com, business associates of covered entities will be required to comply with the Security Rule safeguard standards, beginning February 17, 2010\. This requirement is one of the HITECH Act provisions of the American Recovery and Reinvestment Act (ARRA), signed by President Obama on February 17, 2009. **What to Do** Establish and implement as needed procedures for obtaining necessary electronic protected health information during an emergency. **How to Do It** Emergency access refers to loss of data and systems containing electronic protected health information due to an emergency. Emergencies may include, but are not limited to, fire, vandalism, terrorism, system failure, or natural disaster. In an emergency situation, delay in accessing vital information could result in danger to someone's health. As part of its risk analysis, a covered entity should identify emergency situations that would warrant immediate access to electronic protected health information. The Security Official of the covered entity should prepare a written inventory of such situations. The covered entity should coordinate policies and procedures for this technical safeguard standard implementation specification with the policies and procedures developed for the Facility Access Physical Safeguard Standard implementation specification: Contingency Operations. The covered entity should work with its electronic information system and software vendors to establish emergency access procedures to accommodate the emergency situations identified in the risk analysis. Such procedures should include offsite backup of electronic protected health information. In addition, a covered entity should consider "alarm" procedures to respond to an emergency, including the use of a special user password by the Security Official and one other designated workforce member who would have full access to electronic protected health information and who would be accountable for their actions. Finally, a covered entity should document emergency response procedures and distribute them to workforce members, and maintain a special audit log of responses to emergencies. ### Access Control: Unique User Identification-What to Do and How to Do It URL: https://hipaa.com/access-control-unique-user-identification-what-to-do-and-how-to-do-it/ Last updated: 2009-06-03T14:30:51.000Z In our series on the HIPAA Administrative Simplification Security Rule, this is the first implementation specification for the Technical Safeguard Standard, Access Control. This implementation specification is *required*. As we noted in earlier postings on HIPAA.com, business associates of covered entities will be required to comply with the Security Rule safeguard standards, beginning February 17, 2010\. This requirement is one of the HITECH Act provisions of the American Recovery and Reinvestment Act (ARRA), signed by President Obama on February 17, 2009. **What to Do** Assign a unique name and/or number for identifying and tracking user identity. **How to Do It** The covered entity should establish a policy whereby its Security Official assigns unique user identification to each workforce member. This ID can be alpha, numeric, or a combination thereof. The Security Official or his designee (e.g., office manager or IT head) should manage and track user identity, especially when new workforce members are employed, current workforce members change jobs or roles within jobs, or when a workforce member changes a name. If the covered entity uses the *access control list* (ACL) approach to access control, then the covered entity should assign a unique username and password for login to its electronic information system or network and applications. If the covered entity uses a *role based access control* (RBAC)or *user based access control* (UBAC)approach, then the covered entity should assign access controls based on roles (RBAC) or rules to govern how workforce members access information (UBAC). The covered entity's software and system vendors can help in these assignments. The covered entity should change passwords according to the timetable established in its policies and procedures. The timetable will be dictated by outcomes of the covered entity's risk analysis. The covered entity should consider passwords containing at least seven alphanumeric characters to make them difficult to guess or decode. ### Access Control: What This HIPAA Security Rule Technical Safeguard Standard Means URL: https://hipaa.com/access-control-what-this-hipaa-security-rule-technical-safeguard-standard-means/ Last updated: 2026-10-24T21:33:32.000Z This is the first Technical Safeguard Standard of the HIPAA Administrative Simplification Security Rule. It has four implementation specifications: unique user identification; emergency access procedure; automatic logoff; and encryption and decryption. The first two are *required*; the last two are *addressable*. Addressable does not mean "optional." Rather, an addressable implementation specification means that a covered entity must use reasonable and appropriate measures to meet the standard. As we have noted in earlier postings on HIPAA.com, business associates of covered entities will be required to comply with the Security Rule safeguard standards, beginning February 17, 2010\. This requirement is one of the HITECH Act provisions of the American Recovery and Reinvestment Act (ARRA), signed by President Obama on February 17, 2009. For compliance with this Technical Safeguard Standard, a covered entity is required to implement technical policies and procedures for electronic information systems that maintain electronic protected health information, allowing access only to those persons or software programs that have been granted access rights as specified in the Administrative Safeguard Standard: Information Access Management. This standard means that a covered entity's Security Official must establish policies and procedures that govern how its electronic information systems allow workforce members or software programs to access electronic protected health information. Procedures for access control will be though features associated with the covered entity's electronic information systems, and may be part of a software application, operating systems, database, or a combination thereof. There are four commonly used approaches to controlling who has access to information and when access is available. These approaches use software tools to achieve access control, and vary from simple to complex. A covered entity will choose one of the following approaches based on outcomes of the covered entity's risk analysis. **Access Control List (ACL)** The Security Official or designee (e.g., office manager or IT head) will control a workforce member's access to specific applications. **User Based Access Control (UBAC)** The Security Official or designee will control a workforce member's access based on the workforce member's identity. **Role Based Access Control (RBAC)** The Security Official or designee will control a workforce member's access based on the workforce member's work role. For example, a workforce member with multiple job functions would be assigned multiple roles and access rights. **Context Based Access Control (CBAC)** The Security Official or designee will enhance control of a workforce member's access through context-based rights, such as restricting access to certain dates or times, or certain devices on the covered entity's electronic information system or network. The Context Based Access Control approach is relatively more complex than the preceding three approaches. For additional information on access control, consult the [National Institute of Standards and Technology (NIST) Interagency Report 7316, *Assessment of Access Control Systems*](https://hipaa.com/content/files/2026/10/nistir-7316.pdf). ### Technical Safeguard Standards of the HIPAA Administrative Simplification Security Rule URL: https://hipaa.com/technical-safeguard-standards-of-the-hipaa-administrative-simplification-security-rule/ Last updated: 2009-06-01T13:00:46.000Z There are five technical safeguard standards: access control, audit controls, integrity, person or entity authentication, and transmission security. Each standard has implementation specifications, which can be *required* or *addressable*. Remember, addressable does not mean "optional." Rather, an addressable implementation specification means that a covered entity must use reasonable and appropriate measures to meet the standard. As we have noted in earlier postings on HIPAA.com, business associates of covered entities will be required to comply with the Security Rule safeguard standards, beginning February 17, 2010\. This requirement is one of the HITECH Act provisions of the American Recovery and Reinvestment Act (ARRA), signed by President Obama on February 17, 2009. Technical safeguard standards are "the technology and the policies and procedures for its use that protect electronic protected health information and control access to it." \[68 *Federal Register* 8376\] The Technology Safeguard Standards protect a covered entity's electronic information assets, including electronic protected health information that is use, disclosed, transmitted, or stored in the covered entity's electronic environment. The electronic environment includes all computer workstations, laptops, handheld devices, database servers, applications servers, data management systems, and infrastructure devices. Administrative and physical safeguards that we have discussed in earlier postings on HIPAA.com apply to actions that workforce members perform routinely on a daily basis. Technical safeguards apply to actions that are related to software performance. Over the next two weeks, HIPAA.com will examine the ten implementation specifications for Technical Safeguard Standards. HIPAA.com also will discuss, in the examination of the 10th implementation specification-encryption-HHS' "Guidance Specifying the Technologies and Methodologies that Render Protected Health Information Unusable, Unreadable, or Indecipherable to Unauthorized Individuals," issued April 17, 2009, as required under the HITECH Act. Stay tuned. ### ARRA Stimulus Funds URL: https://hipaa.com/arra-stimulus-funds/ Last updated: 2009-05-29T13:40:59.000Z On Thursday, May 28, 2009, the Office of the National Coordinator released guidance on the new Health IT Regional Extension Centers (HITRC). Section 3012 of the Public Health Service Act (PHSA), as added by the HITECH Act, authorizes a Health Information Technology Extension Program to make assistance available to all providers, but with priority access to Health IT for the uninsured, underinsured, historically underserved and other special-needs populations, and use of that technology to achieve reduction in health disparities. The major focus for the Centers' work with most of the providers that they serve will be to help to select and successfully implement certified electronic health records (EHRs). Assistance is NOT limited to new users, but may also be provided to existing EHR users who need technical assistance to achieve "meaningful user" status. Goals of the HITRC are to: encourage adoption of electronic health records by clinicians and hospitals; assist clinicians and hospitals to become meaningful users of electronic health records; and increase the probability that adopters of electronic health record systems will become meaningful users of the technology. The centers shall offer to all providers in a designated region access to information and to some level of assistance. The regional centers will become, upon award, members of a consortium that will be coordinated and facilitated by the to-be-established Health Information Technology Research Center. We expect that each HITRC will provide technical assistance within a defined geographic area, and that each defined geographic area will be served by only one center. To apply to host a center, an entity may have to: » Define the geographic region and the provider population within that region it proposes to serve. » Describe proposed levels and approaches of support for prioritized and other providers to be served. » Address how the applicant would structure its organization and staffing to enable providers served to have ready access to reasonably local health IT "extension agents" and provide training and on-going support for these critical workers. » Demonstrate the capacity to facilitate and support cooperation among local providers, health systems, communities, and health information exchanges. » Propose an efficient and feasible strategy to furnish deep specialized expertise broadly to all providers served and intensive, individualized, "local" presence from an interdisciplinary extension agent to smaller groups of providers assigned to individual agents. Initially, HITRC would have to provide matching funds, but ONC proposes to exercise the option in the HITECH Act to not require matching funds for awards made in FY 2010\. It anticipates providing $1 - $2 million per center, with the largest center receiving a maximum of $10 million. Centers will begin to be awarded in the first quarter of fiscal year 2010 (October - December 2009), and awards will continue through the end of fiscal year 2010 (September 2010). The comment period is open for two weeks, and must be received not later than 5 p.m., June 11, 2009\. Electronic responses are preferred and should be addressed to [HealthIT-comments@hhs.gov](mailto:HealthIT-comments@hhs.gov). [E9-12419 ONC Guidance on HITRC.pdf](http://static.hipaa.com/documents/e9-12419-onc-guidance-on-hitrc.pdf?ref=hipaa.com) ### Word of the Day: Data Storage URL: https://hipaa.com/word-of-the-day-data-storage/ Last updated: 2009-05-28T13:39:48.000Z **Data Storage:** Computer storage is the holding of data in an electromagnetic form for access by a computer processor. Primary storage are data in random access memory (RAM) and other "built-in" devices. Secondary storage are data on hard disk, tapes, and other external devices. ### Physical Safeguard Standard, Device and Media Controls: Data Backup and Storage Implementation Specification-What to Do and How to Do It URL: https://hipaa.com/physical-safeguard-standard-device-and-media-controls-data-backup-and-storage-implementation-specification-what-to-do-and-how-to-do-it/ Last updated: 2009-05-22T14:17:11.000Z In our series on the HIPAA Administrative Simplification Security Rule, Device and Medial Controls is the fourth and last Physical Safeguard Standard. Data Backup and Storage is the fourth and last of four implementation specifications, and it is *addressable*. Remember, addressable does not mean "optional." Rather, an addressable implementation specification means that a covered entity must use reasonable and appropriate measures to meet the standard. As we have noted in earlier postings on HIPAA.com, business associates of covered entities will be required to comply with the Security Rule safeguard standards, beginning February 17, 2010\. This requirement is one of the HITECH Act provisions of the American Recovery and Reinvestment Act (ARRA), signed by President Obama on February 17, 2009. **What to Do** A covered entity should create a retrievable, exact copy of electronic protected health information, when needed, before moving electronic hardware or media upon which the electronic protected health information is stored. **How to Do It** The Security Official of the covered entity should ensure that an exact copy of electronic protected health information is created and validated prior to moving of electronic hardware or media upon which it is stored. The copy of the electronic protected health information should be stored in a secure environment off site of the covered entity's physical facility. The copy should be readily retrievable if the hardware or electronic media is damaged in moving, or in the event of the covered entity's need to recover from a contingency or disaster. Again, scale and size of the covered entity plays a role in the manner in which this implementation is carried out, with the particulars an outcome of the covered entity's risk analysis. ### Physical Safeguard Standard, Device and Media Controls: Accountability Implementation Specification-What to Do and How to Do It URL: https://hipaa.com/physical-safeguard-standard-device-and-media-controls-accountability-implementation-specification-what-to-do-and-how-to-do-it/ Last updated: 2009-05-21T13:30:43.000Z In our series on the HIPAA Administrative Simplification Security Rule, Device and Medial Controls is the fourth and last Physical Safeguard Standard. Accountability is the third of four implementation specifications, and it is *addressable*. Remember, addressable does not mean "optional." Rather, an addressable implementation specification means that a covered entity must use reasonable and appropriate measures to meet the standard. As we have noted in earlier postings on HIPAA.com, business associates of covered entities will be required to comply with the Security Rule safeguard standards, beginning February 17, 2010\. This requirement is one of the HITECH Act provisions of the American Recovery and Reinvestment Act (ARRA), signed by President Obama on February 17, 2009. **What to Do** A covered entity should maintain a record of the movements of hardware and electronic media and any person responsible for that hardware or electronic media. **How to Do It** A covered entity should maintain written documentation concerning the movement of hardware and electronic media and responsible parties for such hardware and electronic media. How this is done is an outcome of the covered entity's risk analysis. At a minimum, a covered entity should develop an up-to-date written inventory of hardware and electronic media, and for each item in the inventory, assign a workforce member to have responsibility for that property. A sample inventory might include, for each item of hardware and electronic media: description, model and serial number, manufacturer, purchase price, date purchased, date put in service, responsible party. A copy of the inventory should be kept in a secure location outside of the physical facility of the covered entity for use in recovery from a contingency or disaster. The covered entity may find it useful to leave a copy with its attorney or insurance agent for safekeeping. Remember, the written inventory must be maintained for six years from the last entry, and can be kept on paper or electronic format. It is important to note why this implementation specification is addressable. A covered entity such as a health plan with many workforce members and hardware and electronic media needs is going to have different inventory accountability requirements than say a small healthcare provider. The former likely will have to require "systematic tracking" of hardware and electronic media, whereas the latter may never have need to move and account for such equipment. ### Physical Safeguard Standard, Device and Media Controls: Medi Re-use Implementation Specification-What to Do and How to Do It URL: https://hipaa.com/physical-safeguard-standard-device-and-media-controls-medi-re-use-implementation-specification-what-to-do-and-how-to-do-it/ Last updated: 2009-05-20T14:00:17.000Z In our series on the HIPAA Administrative Simplification Security Rule, Device and Medial Controls is the fourth and last Physical Safeguard Standard. Media Re-use is the second of four implementation specifications, and it is *required*. As we have noted in earlier postings on HIPAA.com, business associates of covered entities will be required to comply with the Security Rule safeguard standards, beginning February 17, 2010\. This requirement is one of the HITECH Act provisions of the American Recovery and Reinvestment Act (ARRA), signed by President Obama on February 17, 2009. **What to Do** A covered entity must implement procedures for removal of electronic protected health information from electronic media before the media are made available for re-use. **How to Do It** A covered entity must delete any electronic protected health information on electronic media prior to re-use of the media. The covered entity should consult with its hardware and software vendors to determine methods that work best for deleting electronic protected health information from electronic media that are to be re-used. This includes moving electronic protected health information from one workstation to another within a covered entity as job responsibilities change for workforce members. The covered entity's Security Official should ensure that electronic protected health information is backed up and in secure storage prior to deleting electronic health information on subject electronic media. Since publication of the final Security Rule on February 20, 2003, in the *Federal Register*, new storage media such as flash drives have become ubiquitous and costs of storage media have fallen significantly, with the result that replacing electronic storage media is relatively inexpensive. Accordingly, a covered entity should consider as part of its risk analysis as an appropriate risk mitigation strategy the destruction rather than re-use of any electronic media that contain electronic protected health information. ### Physical Safeguard Standard, Device and Media Controls: Disposal Implementation Specification-What to Do and How to Do It URL: https://hipaa.com/physical-safeguard-standard-device-and-media-controls-disposal-implementation-specification-what-to-do-and-how-to-do-it/ Last updated: 2009-05-19T19:08:53.000Z In our series on the HIPAA Administrative Simplification Security Rule, Device and Medial Controls is the fourth and last Physical Safeguard Standard. Disposal is the first of four implementation specifications, and it is *required*. As we have noted in earlier postings on HIPAA.com, business associates of covered entities will be required to comply with the Security Rule safeguard standards, beginning February 17, 2010\. This requirement is one of the HITECH Act provisions of the American Recovery and Reinvestment Act (ARRA), signed by President Obama on February 17, 2009. **What to Do** A covered entity must implement policies and procedures to address the final disposition of electronic protected health information and the hardware or electronic media on which it is stored. **How to Do It** A covered entity must ensure proper disposal of electronic protected health information and the hardware or electronic media on which it is stored. Failure to do so exposes the covered entity to civil liability should a security incident be reported. Enforcement provisions and fines were increased under ARRA. A covered entity should consult its hardware and software vendors about appropriate and effective ways to achieve disposal and to verify that disposal of electronic protected health information has been attained. For additional information, use the term "data disposal" in a standard online search engine. For disposal, consider the following, written by Carolyn Hartley, et.al., in *Handbook of HIPAA Security Implementation* (Chicago, IL: AMA Press, 2004, p.81): "Render magnetic media such as hard drives, floppy disks, and backup tapes that are unusable or nonrepairable completely unusable prior to their disposal. Degaussing is a method whereby a strong magnetic filed is applied to magnetic media to fully erase the data. If you don't have access to degaussing equipment, you can physically damage the media beyond repair, e.g., drill a hold through it or cut it up with wire cutters or scissors. Optical disks must be physically damaged. Reformatting media is not sufficient to render the data totally inaccessible to people who know how to retrieve it." The covered entity's Security Offical should verify, and document in writing, that electronic protected health information is deleted from hardware or electronic media. ### Device and Media Controls: What This HIPAA Security Rule Physical Safeguard Standard Means URL: https://hipaa.com/device-and-media-controls-what-this-hipaa-security-rule-physical-safeguard-standard-means/ Last updated: 2009-05-18T13:31:02.000Z This is the fourth and last Physical Safeguard Standard of the HIPAA Administrative Simplification Security Rule. It has four implementation specifications: disposal, media re-use, accountability, and data backup and storage. The first two are required; the last two are addressable. Addressable does not mean "optional." Rather, an addressable implementation specification means that a covered entity must use reasonable and appropriate measures to meet the standard. As we have noted in earlier postings on HIPAA.com, business associates of covered entities will be required to comply with the Security Rule safeguard standards, beginning February 17, 2010\. This requirement is one of the HITECH Act provisions of the American Recovery and Reinvestment Act (ARRA), signed by President Obama on February 17, 2009. This standard requires that covered entities implement policies and procedures that govern the receipt and removal of hardware and electronic media that contain electronic protected health information into and out of a facility, and the movement of these items within the facility. The policies and procedures will be outcomes of the covered entity's risk analysis. A covered entity should create a written inventory of all of its hardware and electronic media and track the movement of its inventory within its physical facility. In addition, a covered entity should tightly control the introduction in the covered entity of unauthorized electronic media, such as software and USB compatible external drives used externally by workforce members. Maintaining a current inventory and controlling unauthorized external electronic media enhances the covered entity's likelihood of risk mitigation in the event of a contingency. As mentioned above, there are four implementation specifications for this standard. With respect to disposal and media re-use implementation specifications, it is critical to remember that file deletion and erasure functions generally do not delete files and data, but rather delete only the file name, not the underlying data content. In the context of this discussion, data content means electronic protected health information. Using the file deletion and erasure functions prior to disposal or media re-use may not achieve the intended result, eliminating electronic protected health information and proprietary information of the covered entity. Failure to properly eliminate electronic protected health information increases potential risk of a privacy breach or security incident that could have serious consequences for the covered entity, especially with the increased enforcement provisions of ARRA, which are in effect. The bottom line: if you dispose of or reuse electronic media, ask your vendor or computer store for information on how to delete electronic protected health information in your database, and, most importantly, how to verify the deletion. Finally, as part of the procedure, be sure to document in writing your actions. ### Word of the Day: Benchmarking URL: https://hipaa.com/word-of-the-day-benchmarking/ Last updated: 2009-05-14T19:00:46.000Z **Benchmarking**: Continuous process whereby an enterprise measures and compares all of its functions, systems, and practices against strong competitors, identifying quality gaps in the organization, and striving to achieve competitive advantage locally and globally. ### Physical Safeguard Standard, Workstation Security-What to Do and How to Do It URL: https://hipaa.com/physical-safeguard-standard-workstation-security-what-to-do-and-how-to-do-it/ Last updated: 2009-05-14T13:30:19.000Z In our series on the HIPAA Administrative Simplification Security Rule, this is the third Physical Safeguard Standard, Workstation Security. The implementation specification for this standard is defined by the standard title, and is *required*. As we have noted in earlier postings on HIPAA.com, business associates of covered entities will be required to comply with the Security Rule safeguard standards, beginning February 17, 2010\. This requirement is one of the HITECH Act provisions of the American Recovery and Reinvestment Act (ARRA), signed by President Obama on February 17, 2009. **What to Do** A covered entity must implement physical safeguards for all workstations that access electronic protected health information to restrict access to authorized users. **How to Do It** A covered entity is required to secure workstations in such a manner that access is restricted to authorized users. The solution is "dependent on the \[covered\] entity's risk analysis and risk management process," and may involve controlled access to the workstation or controls on the workstation that restrict access of unauthorized users. \[68 *Federal Register* 8354\] As with many of the implementation specifications for the Security Rule standards, the solution depends on the outcomes of the covered entity's risk analysis. An example of an appropriate workstation security requirement would be a policy that workforce members log off before leaving electronic media unattended. Another example, for a workstation in a controlled access environment, would be a policy requiring automatic logoff after a defined period of inactivity, say, ten minutes or less. A final example would be to control access to the Internet while working with electronic protected health information, in an effort to minimize unauthorized access by an outsider to such information. This is especially important as mobile devices such as personal data assistants (PDAs) with browser access proliferate in the healthcare community. Finally, a covered entity also must pay particular attention to electronic media devices used by receptionists. This pertains primarily to healthcare providers, but also may pertain to any receptionist in a covered entity that handles overflow processing of healthcare matters involving electronic protected health information. A receptionist position is a highly vulnerable point of unauthorized access and should be addressed specifically in a covered entity's risk analysis. Any workstation, in a controlled access environment or not, should be shielded physically from view by passersby who are not authorized to have access to electronic protected health information. A covered entity's Security Official should establish and implement policies and procedures to protect workstations and restrict access to authorized users. ### Word of the Day: Request for Proposal URL: https://hipaa.com/word-of-the-day-request-for-proposal/ Last updated: 2009-05-13T17:00:28.000Z **Request for Proposal (RFP)**: A compilation of factors the buyer will consider before making a purchase. An RFP is typically sent to two or more potential responders and always contains a due date and contact person in the event those bidding on the proposal have additional questions. ### Physical Safeguard Standard, Workstation Use-What to Do and How to Do It URL: https://hipaa.com/physical-safeguard-standard-workstation-use-what-to-do-and-how-to-do-it/ Last updated: 2009-05-13T13:32:16.000Z In our series on the HIPAA Administrative Simplification Security Rule, Workstation Use is the second Physical Safeguard Standard. There is no defined implementation specification for this standard. Implementation of policies and procedures pertaining to this standard are *required*. As we have noted in earlier postings on HIPAA.com, business associates of covered entities will be required to comply with the Security Rule safeguard standards, beginning February 17, 2010\. This requirement is one of the HITECH Act provisions of the American Recovery and Reinvestment Act (ARRA), signed by President Obama on February 17, 2009. **What is Required** A covered entity must implement policies and procedures that specify the proper functions to be performed, the manner in which those functions are to be performed, and the physical attributes of the surroundings of a specific workstation that can access electronic protected health information. **What to Do** Identify how workstations are used and where authorized workforce members access the workstations in the covered entity. **How to Do It** This physical safeguard standard requires covered entities to develop and implement policies and procedures pertaining to the use of workstations that can access electronic protected health information in a covered entity. The standard requires that the covered entity ensure appropriate workstation uses, how such uses are to be performed, and in what physical environment access to workstations that process electronic protected health information is permitted. Workstations include, but are not limited to, desktop computers, laptop computers, tablet computers, and personal data assistants (PDAs) that transmit, receive, or store electronic protected health information. Examples of policies are: » Automatic logoff protocols in the absence of activity, including definition of appropriate length of time to trigger automatic logoff. » Controls on Internet access when workforce members are working with electronic protected health information. » Frequency of password changes, as defined and controlled by a covered entity's Security Official. » Controls on display of passwords on or near workstations. » Controls on sharing of passwords among workforce members. » Controls on access of business associates to workstations containing electronic protected health information, as defined in a business associate agreement. » Controls on workstations that contain or have access to electronic protected health information and that are taken offsite of the covered entity by an authorized user. » Compliance with software licensing and copyright laws. » Ensuring that antivirus and other software and database security tools are deployed on each workstation. ### HHS appoints members to HIT Policy and Standards Committee URL: https://hipaa.com/hhs-appoints-members-to-hit-policy-and-standards-committee/ Last updated: 2009-05-11T18:25:55.000Z On Friday, May 8, 2009, the U.S. Department of Health and Human Services (HHS) announced appointments to the Health Information Technology (HIT) Policy Committee and HIT Standards Committee. These federal advisory committees were established by provisions in the American Recovery and Reinvestment Act (ARRA) that President Obama signed on February 17, 2009\. Today, is the first meeting of the HIT Policy Committee, and Friday, May 15, 2009, is the first scheduled meeting of the HIT Standards Committee, both in Washington, DC. According to the press release issued by HHS, "\[t\]he HIT Policy Committee will make recommendations to the National Coordinator for Health Information Technology \[Dr. David Blumenthal\] on a policy framework for the development and adoption of a nationwide interoperable health information infrastructure, including standards for the secure and private exchange of patient medical information." The role of the HIT Standards Committee is to make "recommendations to the National Coordinator on standards, implementation specifications, and certification criteria for the electronic exchange and use of health information." Lists of members of each committee can be found online at [http://healthit.hhs.gov](http://healthit.hhs.gov/?ref=hipaa.com). ### HITECH Privacy Provisions Include HIPAA Privacy Definitions and New or Broadened Concepts URL: https://hipaa.com/hitech-privacy-provisions-include-hipaa-privacy-definitions-and-new-or-broadened-concepts/ Last updated: 2009-05-11T15:00:37.000Z This posting is one of several that outline the HITECH privacy provisions of the American Recovery and Reinvestment Act that President Obama signed into law on Tuesday, February 17, 2009, in Denver, CO. Here, we reproduce the definitions that appear in Subtitle D—Privacy, Section 13400\. Definitions, that appear in the Conference Report on page H1345 of Congressional Record—House, February 12, 2009\. These definitions are critical in understanding the content of the new HITECH privacy provisions and how they relate to existing HIPAA Administrative Simplification Privacy Rule standards. HIPAA Privacy Definitions: | [Breach](http://www.hipaa.com/2009/05/the-definition-of-breach/?ref=hipaa.com)[Business Associate](http://www.hipaa.com/2009/05/the-definition-of-business-associate/?ref=hipaa.com)[Covered Entity](http://www.hipaa.com/2009/05/the-definition-of-covered-entity/?ref=hipaa.com)[Disclosure](http://www.hipaa.com/2009/05/the-definition-of-disclosure/?ref=hipaa.com)[Electronic Health Record](http://www.hipaa.com/2009/05/the-definition-of-electronic-health-record/?ref=hipaa.com)[Health Care Operations](http://www.hipaa.com/2009/05/the-definition-of-health-care-operations/?ref=hipaa.com) | [Health Care Provider](http://www.hipaa.com/2009/05/the-definition-of-health-care-provider/?ref=hipaa.com)[Health Plan](http://www.hipaa.com/2009/05/the-definition-of-health-plan/?ref=hipaa.com)[National Coordinator](http://www.hipaa.com/2009/05/the-definition-of-national-coordinator/?ref=hipaa.com)[Payment](http://www.hipaa.com/2009/05/the-definition-of-payment/?ref=hipaa.com)[Personal Health Record](http://www.hipaa.com/2009/05/the-definition-of-personal-health-record/?ref=hipaa.com)[Protected Health Information](http://www.hipaa.com/2009/05/the-definition-of-protected-health-information/?ref=hipaa.com) | [Secretary](http://www.hipaa.com/2009/05/the-definition-of-secretary/?ref=hipaa.com)[Security](http://www.hipaa.com/2009/05/the-definition-of-security/?ref=hipaa.com)[State](http://www.hipaa.com/2009/05/the-definition-of-state/?ref=hipaa.com)[Treatment](http://www.hipaa.com/2009/05/the-definition-of-treatment/?ref=hipaa.com)[Use](http://www.hipaa.com/2009/05/the-definition-of-use/?ref=hipaa.com)[Vendor Of Personal Health Records](http://www.hipaa.com/2009/05/the-definition-of-vendor-of-personal-health-records/?ref=hipaa.com) | | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ### The Definition of Vendor of Personal Health Records URL: https://hipaa.com/the-definition-of-vendor-of-personal-health-records/ Last updated: 2009-05-11T12:32:47.000Z This posting is one of several that outline the HITECH privacy provisions of the American Recovery and Reinvestment Act that President Obama signed into law on Tuesday, February 17, 2009, in Denver, CO. Here, we reproduce the definitions that appear in Subtitle D—Privacy, Section 13400\. Definitions, that appear in the Conference Report on page H1345 of Congressional Record—House, February 12, 2009\. These definitions are critical in understanding the content of the new HITECH privacy provisions and how they relate to existing HIPAA Administrative Simplification Privacy Rule standards. HIPAA Privacy Definitions: | [Breach](http://www.hipaa.com/2009/05/the-definition-of-breach/?ref=hipaa.com)[Business Associate](http://www.hipaa.com/2009/05/the-definition-of-business-associate/?ref=hipaa.com)[Covered Entity](http://www.hipaa.com/2009/05/the-definition-of-covered-entity/?ref=hipaa.com)[Disclosure](http://www.hipaa.com/2009/05/the-definition-of-disclosure/?ref=hipaa.com)[Electronic Health Record](http://www.hipaa.com/2009/05/the-definition-of-electronic-health-record/?ref=hipaa.com)[Health Care Operations](http://www.hipaa.com/2009/05/the-definition-of-health-care-operations/?ref=hipaa.com) | [Health Care Provider](http://www.hipaa.com/2009/05/the-definition-of-health-care-provider/?ref=hipaa.com)[Health Plan](http://www.hipaa.com/2009/05/the-definition-of-health-plan/?ref=hipaa.com)[National Coordinator](http://www.hipaa.com/2009/05/the-definition-of-national-coordinator/?ref=hipaa.com)[Payment](http://www.hipaa.com/2009/05/the-definition-of-payment/?ref=hipaa.com)[Personal Health Record](http://www.hipaa.com/2009/05/the-definition-of-personal-health-record/?ref=hipaa.com)[Protected Health Information](http://www.hipaa.com/2009/05/the-definition-of-protected-health-information/?ref=hipaa.com) | [Secretary](http://www.hipaa.com/2009/05/the-definition-of-secretary/?ref=hipaa.com)[Security](http://www.hipaa.com/2009/05/the-definition-of-security/?ref=hipaa.com)[State](http://www.hipaa.com/2009/05/the-definition-of-state/?ref=hipaa.com)[Treatment](http://www.hipaa.com/2009/05/the-definition-of-treatment/?ref=hipaa.com)[Use](http://www.hipaa.com/2009/05/the-definition-of-use/?ref=hipaa.com)[Vendor Of Personal Health Records](http://www.hipaa.com/2009/05/the-definition-of-vendor-of-personal-health-records/?ref=hipaa.com) | | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | **VENDOR OF PERSONAL HEALTH RECORDS** The term ‘vendor of personal health records’ means an entity, other than a covered entity (as defined in paragraph (3)), that offers or maintains a personal health record. ### The Definition of Use URL: https://hipaa.com/the-definition-of-use/ Last updated: 2009-05-11T12:31:26.000Z This posting is one of several that outline the HITECH privacy provisions of the American Recovery and Reinvestment Act that President Obama signed into law on Tuesday, February 17, 2009, in Denver, CO. Here, we reproduce the definitions that appear in Subtitle D—Privacy, Section 13400\. Definitions, that appear in the Conference Report on page H1345 of Congressional Record—House, February 12, 2009\. These definitions are critical in understanding the content of the new HITECH privacy provisions and how they relate to existing HIPAA Administrative Simplification Privacy Rule standards. HIPAA Privacy Definitions: | [Breach](http://www.hipaa.com/2009/05/the-definition-of-breach/?ref=hipaa.com)[Business Associate](http://www.hipaa.com/2009/05/the-definition-of-business-associate/?ref=hipaa.com)[Covered Entity](http://www.hipaa.com/2009/05/the-definition-of-covered-entity/?ref=hipaa.com)[Disclosure](http://www.hipaa.com/2009/05/the-definition-of-disclosure/?ref=hipaa.com)[Electronic Health Record](http://www.hipaa.com/2009/05/the-definition-of-electronic-health-record/?ref=hipaa.com)[Health Care Operations](http://www.hipaa.com/2009/05/the-definition-of-health-care-operations/?ref=hipaa.com) | [Health Care Provider](http://www.hipaa.com/2009/05/the-definition-of-health-care-provider/?ref=hipaa.com)[Health Plan](http://www.hipaa.com/2009/05/the-definition-of-health-plan/?ref=hipaa.com)[National Coordinator](http://www.hipaa.com/2009/05/the-definition-of-national-coordinator/?ref=hipaa.com)[Payment](http://www.hipaa.com/2009/05/the-definition-of-payment/?ref=hipaa.com)[Personal Health Record](http://www.hipaa.com/2009/05/the-definition-of-personal-health-record/?ref=hipaa.com)[Protected Health Information](http://www.hipaa.com/2009/05/the-definition-of-protected-health-information/?ref=hipaa.com) | [Secretary](http://www.hipaa.com/2009/05/the-definition-of-secretary/?ref=hipaa.com)[Security](http://www.hipaa.com/2009/05/the-definition-of-security/?ref=hipaa.com)[State](http://www.hipaa.com/2009/05/the-definition-of-state/?ref=hipaa.com)[Treatment](http://www.hipaa.com/2009/05/the-definition-of-treatment/?ref=hipaa.com)[Use](http://www.hipaa.com/2009/05/the-definition-of-use/?ref=hipaa.com)[Vendor Of Personal Health Records](http://www.hipaa.com/2009/05/the-definition-of-vendor-of-personal-health-records/?ref=hipaa.com) | | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | **USE** The term ‘use’ has the meaning given such term in section 160.103 of title 45, Code of Federal Regulations. Section 160.103— With respect to individually identifiable health information, the sharing, employment, application, utilization, examination, or analysis of such information with an entity that maintains such information. ### The Definition of Treatment URL: https://hipaa.com/the-definition-of-treatment/ Last updated: 2009-05-11T12:30:21.000Z This posting is one of several that outline the HITECH privacy provisions of the American Recovery and Reinvestment Act that President Obama signed into law on Tuesday, February 17, 2009, in Denver, CO. Here, we reproduce the definitions that appear in Subtitle D—Privacy, Section 13400\. Definitions, that appear in the Conference Report on page H1345 of Congressional Record—House, February 12, 2009\. These definitions are critical in understanding the content of the new HITECH privacy provisions and how they relate to existing HIPAA Administrative Simplification Privacy Rule standards. HIPAA Privacy Definitions: | [Breach](http://www.hipaa.com/2009/05/the-definition-of-breach/?ref=hipaa.com)[Business Associate](http://www.hipaa.com/2009/05/the-definition-of-business-associate/?ref=hipaa.com)[Covered Entity](http://www.hipaa.com/2009/05/the-definition-of-covered-entity/?ref=hipaa.com)[Disclosure](http://www.hipaa.com/2009/05/the-definition-of-disclosure/?ref=hipaa.com)[Electronic Health Record](http://www.hipaa.com/2009/05/the-definition-of-electronic-health-record/?ref=hipaa.com)[Health Care Operations](http://www.hipaa.com/2009/05/the-definition-of-health-care-operations/?ref=hipaa.com) | [Health Care Provider](http://www.hipaa.com/2009/05/the-definition-of-health-care-provider/?ref=hipaa.com)[Health Plan](http://www.hipaa.com/2009/05/the-definition-of-health-plan/?ref=hipaa.com)[National Coordinator](http://www.hipaa.com/2009/05/the-definition-of-national-coordinator/?ref=hipaa.com)[Payment](http://www.hipaa.com/2009/05/the-definition-of-payment/?ref=hipaa.com)[Personal Health Record](http://www.hipaa.com/2009/05/the-definition-of-personal-health-record/?ref=hipaa.com)[Protected Health Information](http://www.hipaa.com/2009/05/the-definition-of-protected-health-information/?ref=hipaa.com) | [Secretary](http://www.hipaa.com/2009/05/the-definition-of-secretary/?ref=hipaa.com)[Security](http://www.hipaa.com/2009/05/the-definition-of-security/?ref=hipaa.com)[State](http://www.hipaa.com/2009/05/the-definition-of-state/?ref=hipaa.com)[Treatment](http://www.hipaa.com/2009/05/the-definition-of-treatment/?ref=hipaa.com)[Use](http://www.hipaa.com/2009/05/the-definition-of-use/?ref=hipaa.com)[Vendor Of Personal Health Records](http://www.hipaa.com/2009/05/the-definition-of-vendor-of-personal-health-records/?ref=hipaa.com) | | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | **TREATMENT** The term ‘treatment’ has the meaning given such term in section 164.501 of title 45, Code of Federal Regulations. Section 164.501— The provision, coordination, or management of health care and related services by one or more health care providers, including the coordination or management of health care by a health care provider with a third party; consultation between health care providers relating to a patient; or the referral of a patient for health care from one health care provider to another. ### The Definition of State URL: https://hipaa.com/the-definition-of-state/ Last updated: 2009-05-11T11:27:02.000Z This posting is one of several that outline the HITECH privacy provisions of the American Recovery and Reinvestment Act that President Obama signed into law on Tuesday, February 17, 2009, in Denver, CO. Here, we reproduce the definitions that appear in Subtitle D—Privacy, Section 13400\. Definitions, that appear in the Conference Report on page H1345 of Congressional Record—House, February 12, 2009\. These definitions are critical in understanding the content of the new HITECH privacy provisions and how they relate to existing HIPAA Administrative Simplification Privacy Rule standards. HIPAA Privacy Definitions: | [Breach](http://www.hipaa.com/2009/05/the-definition-of-breach/?ref=hipaa.com)[Business Associate](http://www.hipaa.com/2009/05/the-definition-of-business-associate/?ref=hipaa.com)[Covered Entity](http://www.hipaa.com/2009/05/the-definition-of-covered-entity/?ref=hipaa.com)[Disclosure](http://www.hipaa.com/2009/05/the-definition-of-disclosure/?ref=hipaa.com)[Electronic Health Record](http://www.hipaa.com/2009/05/the-definition-of-electronic-health-record/?ref=hipaa.com)[Health Care Operations](http://www.hipaa.com/2009/05/the-definition-of-health-care-operations/?ref=hipaa.com) | [Health Care Provider](http://www.hipaa.com/2009/05/the-definition-of-health-care-provider/?ref=hipaa.com)[Health Plan](http://www.hipaa.com/2009/05/the-definition-of-health-plan/?ref=hipaa.com)[National Coordinator](http://www.hipaa.com/2009/05/the-definition-of-national-coordinator/?ref=hipaa.com)[Payment](http://www.hipaa.com/2009/05/the-definition-of-payment/?ref=hipaa.com)[Personal Health Record](http://www.hipaa.com/2009/05/the-definition-of-personal-health-record/?ref=hipaa.com)[Protected Health Information](http://www.hipaa.com/2009/05/the-definition-of-protected-health-information/?ref=hipaa.com) | [Secretary](http://www.hipaa.com/2009/05/the-definition-of-secretary/?ref=hipaa.com)[Security](http://www.hipaa.com/2009/05/the-definition-of-security/?ref=hipaa.com)[State](http://www.hipaa.com/2009/05/the-definition-of-state/?ref=hipaa.com)[Treatment](http://www.hipaa.com/2009/05/the-definition-of-treatment/?ref=hipaa.com)[Use](http://www.hipaa.com/2009/05/the-definition-of-use/?ref=hipaa.com)[Vendor Of Personal Health Records](http://www.hipaa.com/2009/05/the-definition-of-vendor-of-personal-health-records/?ref=hipaa.com) | | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | **STATE** The term ‘state’ means each of the several States, the District of Columbia, Puerto Rico, the Virgin Islands, Guam, American Samoa, and the Northern Mariana Islands. ### The Definition of Security URL: https://hipaa.com/the-definition-of-security/ Last updated: 2009-05-11T11:26:40.000Z This posting is one of several that outline the HITECH privacy provisions of the American Recovery and Reinvestment Act that President Obama signed into law on Tuesday, February 17, 2009, in Denver, CO. Here, we reproduce the definitions that appear in Subtitle D—Privacy, Section 13400\. Definitions, that appear in the Conference Report on page H1345 of Congressional Record—House, February 12, 2009\. These definitions are critical in understanding the content of the new HITECH privacy provisions and how they relate to existing HIPAA Administrative Simplification Privacy Rule standards. HIPAA Privacy Definitions: | [Breach](http://www.hipaa.com/2009/05/the-definition-of-breach/?ref=hipaa.com)[Business Associate](http://www.hipaa.com/2009/05/the-definition-of-business-associate/?ref=hipaa.com)[Covered Entity](http://www.hipaa.com/2009/05/the-definition-of-covered-entity/?ref=hipaa.com)[Disclosure](http://www.hipaa.com/2009/05/the-definition-of-disclosure/?ref=hipaa.com)[Electronic Health Record](http://www.hipaa.com/2009/05/the-definition-of-electronic-health-record/?ref=hipaa.com)[Health Care Operations](http://www.hipaa.com/2009/05/the-definition-of-health-care-operations/?ref=hipaa.com) | [Health Care Provider](http://www.hipaa.com/2009/05/the-definition-of-health-care-provider/?ref=hipaa.com)[Health Plan](http://www.hipaa.com/2009/05/the-definition-of-health-plan/?ref=hipaa.com)[National Coordinator](http://www.hipaa.com/2009/05/the-definition-of-national-coordinator/?ref=hipaa.com)[Payment](http://www.hipaa.com/2009/05/the-definition-of-payment/?ref=hipaa.com)[Personal Health Record](http://www.hipaa.com/2009/05/the-definition-of-personal-health-record/?ref=hipaa.com)[Protected Health Information](http://www.hipaa.com/2009/05/the-definition-of-protected-health-information/?ref=hipaa.com) | [Secretary](http://www.hipaa.com/2009/05/the-definition-of-secretary/?ref=hipaa.com)[Security](http://www.hipaa.com/2009/05/the-definition-of-security/?ref=hipaa.com)[State](http://www.hipaa.com/2009/05/the-definition-of-state/?ref=hipaa.com)[Treatment](http://www.hipaa.com/2009/05/the-definition-of-treatment/?ref=hipaa.com)[Use](http://www.hipaa.com/2009/05/the-definition-of-use/?ref=hipaa.com)[Vendor Of Personal Health Records](http://www.hipaa.com/2009/05/the-definition-of-vendor-of-personal-health-records/?ref=hipaa.com) | | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | **SECURITY** The term ‘security’ has the meaning given such term in section 164.304 of title 45, Code of Federal Regulations. Section 164.304— Security or security measures encompass all of the administrative, physical, and technical safeguards in an information system. ### The Definition of Secretary URL: https://hipaa.com/the-definition-of-secretary/ Last updated: 2009-05-11T11:25:22.000Z This posting is one of several that outline the HITECH privacy provisions of the American Recovery and Reinvestment Act that President Obama signed into law on Tuesday, February 17, 2009, in Denver, CO. Here, we reproduce the definitions that appear in Subtitle D—Privacy, Section 13400\. Definitions, that appear in the Conference Report on page H1345 of Congressional Record—House, February 12, 2009\. These definitions are critical in understanding the content of the new HITECH privacy provisions and how they relate to existing HIPAA Administrative Simplification Privacy Rule standards. HIPAA Privacy Definitions: | [Breach](http://www.hipaa.com/2009/05/the-definition-of-breach/?ref=hipaa.com)[Business Associate](http://www.hipaa.com/2009/05/the-definition-of-business-associate/?ref=hipaa.com)[Covered Entity](http://www.hipaa.com/2009/05/the-definition-of-covered-entity/?ref=hipaa.com)[Disclosure](http://www.hipaa.com/2009/05/the-definition-of-disclosure/?ref=hipaa.com)[Electronic Health Record](http://www.hipaa.com/2009/05/the-definition-of-electronic-health-record/?ref=hipaa.com)[Health Care Operations](http://www.hipaa.com/2009/05/the-definition-of-health-care-operations/?ref=hipaa.com) | [Health Care Provider](http://www.hipaa.com/2009/05/the-definition-of-health-care-provider/?ref=hipaa.com)[Health Plan](http://www.hipaa.com/2009/05/the-definition-of-health-plan/?ref=hipaa.com)[National Coordinator](http://www.hipaa.com/2009/05/the-definition-of-national-coordinator/?ref=hipaa.com)[Payment](http://www.hipaa.com/2009/05/the-definition-of-payment/?ref=hipaa.com)[Personal Health Record](http://www.hipaa.com/2009/05/the-definition-of-personal-health-record/?ref=hipaa.com)[Protected Health Information](http://www.hipaa.com/2009/05/the-definition-of-protected-health-information/?ref=hipaa.com) | [Secretary](http://www.hipaa.com/2009/05/the-definition-of-secretary/?ref=hipaa.com)[Security](http://www.hipaa.com/2009/05/the-definition-of-security/?ref=hipaa.com)[State](http://www.hipaa.com/2009/05/the-definition-of-state/?ref=hipaa.com)[Treatment](http://www.hipaa.com/2009/05/the-definition-of-treatment/?ref=hipaa.com)[Use](http://www.hipaa.com/2009/05/the-definition-of-use/?ref=hipaa.com)[Vendor Of Personal Health Records](http://www.hipaa.com/2009/05/the-definition-of-vendor-of-personal-health-records/?ref=hipaa.com) | | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | **SECRETARY** The term ‘Secretary’ means the Secretary of Health and Human Services. ### The Definition of Protected Health Information URL: https://hipaa.com/the-definition-of-protected-health-information/ Last updated: 2009-05-11T11:21:02.000Z This posting is one of several that outline the HITECH privacy provisions of the American Recovery and Reinvestment Act that President Obama signed into law on Tuesday, February 17, 2009, in Denver, CO. Here, we reproduce the definitions that appear in Subtitle D—Privacy, Section 13400\. Definitions, that appear in the Conference Report on page H1345 of Congressional Record—House, February 12, 2009\. These definitions are critical in understanding the content of the new HITECH privacy provisions and how they relate to existing HIPAA Administrative Simplification Privacy Rule standards. HIPAA Privacy Definitions: | [Breach](http://www.hipaa.com/2009/05/the-definition-of-breach/?ref=hipaa.com)[Business Associate](http://www.hipaa.com/2009/05/the-definition-of-business-associate/?ref=hipaa.com)[Covered Entity](http://www.hipaa.com/2009/05/the-definition-of-covered-entity/?ref=hipaa.com)[Disclosure](http://www.hipaa.com/2009/05/the-definition-of-disclosure/?ref=hipaa.com)[Electronic Health Record](http://www.hipaa.com/2009/05/the-definition-of-electronic-health-record/?ref=hipaa.com)[Health Care Operations](http://www.hipaa.com/2009/05/the-definition-of-health-care-operations/?ref=hipaa.com) | [Health Care Provider](http://www.hipaa.com/2009/05/the-definition-of-health-care-provider/?ref=hipaa.com)[Health Plan](http://www.hipaa.com/2009/05/the-definition-of-health-plan/?ref=hipaa.com)[National Coordinator](http://www.hipaa.com/2009/05/the-definition-of-national-coordinator/?ref=hipaa.com)[Payment](http://www.hipaa.com/2009/05/the-definition-of-payment/?ref=hipaa.com)[Personal Health Record](http://www.hipaa.com/2009/05/the-definition-of-personal-health-record/?ref=hipaa.com)[Protected Health Information](http://www.hipaa.com/2009/05/the-definition-of-protected-health-information/?ref=hipaa.com) | [Secretary](http://www.hipaa.com/2009/05/the-definition-of-secretary/?ref=hipaa.com)[Security](http://www.hipaa.com/2009/05/the-definition-of-security/?ref=hipaa.com)[State](http://www.hipaa.com/2009/05/the-definition-of-state/?ref=hipaa.com)[Treatment](http://www.hipaa.com/2009/05/the-definition-of-treatment/?ref=hipaa.com)[Use](http://www.hipaa.com/2009/05/the-definition-of-use/?ref=hipaa.com)[Vendor Of Personal Health Records](http://www.hipaa.com/2009/05/the-definition-of-vendor-of-personal-health-records/?ref=hipaa.com) | | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | **PROTECTED HEALTH INFORMATION** The term ‘protected health information’ has the meaning given such term in section 106.103 of title 45, Code of Federal Regulations. Section 106.103— Individually identifiable health information: (1) Except as provided in paragraph (2) of this definition, that is: (i) Transmitted by electronic media; (ii) Maintained in electronic media; or (iii) Transmitted or maintained in any other form or medium. (2) Protected health information excludes individually identifiable health information in: (i) Education records covered by the Family Educational Rights and Privacy Act, as amended, 20 U.S.C. 1232g; (ii) Records described at 20 U.S.C. 1232g(a)(4)(B)(iv); and (iii) Employment records held by a covered entity in its role as employer. ### The Definition of Personal Health Record URL: https://hipaa.com/the-definition-of-personal-health-record/ Last updated: 2009-05-11T11:20:41.000Z This posting is one of several that outline the HITECH privacy provisions of the American Recovery and Reinvestment Act that President Obama signed into law on Tuesday, February 17, 2009, in Denver, CO. Here, we reproduce the definitions that appear in Subtitle D—Privacy, Section 13400\. Definitions, that appear in the Conference Report on page H1345 of Congressional Record—House, February 12, 2009\. These definitions are critical in understanding the content of the new HITECH privacy provisions and how they relate to existing HIPAA Administrative Simplification Privacy Rule standards. HIPAA Privacy Definitions: | [Breach](http://www.hipaa.com/2009/05/the-definition-of-breach/?ref=hipaa.com)[Business Associate](http://www.hipaa.com/2009/05/the-definition-of-business-associate/?ref=hipaa.com)[Covered Entity](http://www.hipaa.com/2009/05/the-definition-of-covered-entity/?ref=hipaa.com)[Disclosure](http://www.hipaa.com/2009/05/the-definition-of-disclosure/?ref=hipaa.com)[Electronic Health Record](http://www.hipaa.com/2009/05/the-definition-of-electronic-health-record/?ref=hipaa.com)[Health Care Operations](http://www.hipaa.com/2009/05/the-definition-of-health-care-operations/?ref=hipaa.com) | [Health Care Provider](http://www.hipaa.com/2009/05/the-definition-of-health-care-provider/?ref=hipaa.com)[Health Plan](http://www.hipaa.com/2009/05/the-definition-of-health-plan/?ref=hipaa.com)[National Coordinator](http://www.hipaa.com/2009/05/the-definition-of-national-coordinator/?ref=hipaa.com)[Payment](http://www.hipaa.com/2009/05/the-definition-of-payment/?ref=hipaa.com)[Personal Health Record](http://www.hipaa.com/2009/05/the-definition-of-personal-health-record/?ref=hipaa.com)[Protected Health Information](http://www.hipaa.com/2009/05/the-definition-of-protected-health-information/?ref=hipaa.com) | [Secretary](http://www.hipaa.com/2009/05/the-definition-of-secretary/?ref=hipaa.com)[Security](http://www.hipaa.com/2009/05/the-definition-of-security/?ref=hipaa.com)[State](http://www.hipaa.com/2009/05/the-definition-of-state/?ref=hipaa.com)[Treatment](http://www.hipaa.com/2009/05/the-definition-of-treatment/?ref=hipaa.com)[Use](http://www.hipaa.com/2009/05/the-definition-of-use/?ref=hipaa.com)[Vendor Of Personal Health Records](http://www.hipaa.com/2009/05/the-definition-of-vendor-of-personal-health-records/?ref=hipaa.com) | | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | **PERSONAL HEALTH RECORD** The term ‘personal health record’ means an electronic record of PHR identifiable health information (as defined in section 13407(f)(2)5) on an individual that can be drawn from multiple sources and that is managed, shared, and controlled by or primarily for the individual. --- 5 “The term ‘PHR identifiable health information’ means individually identifiable health information, as defined in section 1171(6) of the Social Security Act (42 U.S.C. 1320d(6)), and includes, with respect to an individual, information (A) that is provided by or on behalf of the individual; and (B) that identifies the individual or with respect to which there is a reasonable basis to believe that the information can be used to identify the individual.” See Congressional Record-House, February 12, 2009, p.H1348, which is available on the hipaa.com Web site. Section 1171(6) of the Social Security Act is available online at: [http://www.ssa.gov/OP\_Home/ssact/title11/1171.htm](http://www.ssa.gov/OP%5FHome/ssact/title11/1171.htm?ref=hipaa.com). Subsection 6 states: Individually identifiable health information.—The term “individually identifiable health information” means any information, including demographic information collected from an individual, that—(A) is created or received by a health care provider, health plan, employer, or health care clearinghouse; and (B) relates to the past, present, or future physical or mental health or condition of an individual, the provision of health care to an individual, or the past, present, or future payment for the provision of health care to an individual, and—(i) identifies the individual; or (ii) with respect to which there is a reasonable basis to believe that the information can be used to identify the individual. ### The Definition of Payment URL: https://hipaa.com/the-definition-of-payment/ Last updated: 2009-05-11T02:34:17.000Z This posting is one of several that outline the HITECH privacy provisions of the American Recovery and Reinvestment Act that President Obama signed into law on Tuesday, February 17, 2009, in Denver, CO. Here, we reproduce the definitions that appear in Subtitle D—Privacy, Section 13400\. Definitions, that appear in the Conference Report on page H1345 of Congressional Record—House, February 12, 2009\. These definitions are critical in understanding the content of the new HITECH privacy provisions and how they relate to existing HIPAA Administrative Simplification Privacy Rule standards. HIPAA Privacy Definitions: | [Breach](http://www.hipaa.com/2009/05/the-definition-of-breach/?ref=hipaa.com)[Business Associate](http://www.hipaa.com/2009/05/the-definition-of-business-associate/?ref=hipaa.com)[Covered Entity](http://www.hipaa.com/2009/05/the-definition-of-covered-entity/?ref=hipaa.com)[Disclosure](http://www.hipaa.com/2009/05/the-definition-of-disclosure/?ref=hipaa.com)[Electronic Health Record](http://www.hipaa.com/2009/05/the-definition-of-electronic-health-record/?ref=hipaa.com)[Health Care Operations](http://www.hipaa.com/2009/05/the-definition-of-health-care-operations/?ref=hipaa.com) | [Health Care Provider](http://www.hipaa.com/2009/05/the-definition-of-health-care-provider/?ref=hipaa.com)[Health Plan](http://www.hipaa.com/2009/05/the-definition-of-health-plan/?ref=hipaa.com)[National Coordinator](http://www.hipaa.com/2009/05/the-definition-of-national-coordinator/?ref=hipaa.com)[Payment](http://www.hipaa.com/2009/05/the-definition-of-payment/?ref=hipaa.com)[Personal Health Record](http://www.hipaa.com/2009/05/the-definition-of-personal-health-record/?ref=hipaa.com)[Protected Health Information](http://www.hipaa.com/2009/05/the-definition-of-protected-health-information/?ref=hipaa.com) | [Secretary](http://www.hipaa.com/2009/05/the-definition-of-secretary/?ref=hipaa.com)[Security](http://www.hipaa.com/2009/05/the-definition-of-security/?ref=hipaa.com)[State](http://www.hipaa.com/2009/05/the-definition-of-state/?ref=hipaa.com)[Treatment](http://www.hipaa.com/2009/05/the-definition-of-treatment/?ref=hipaa.com)[Use](http://www.hipaa.com/2009/05/the-definition-of-use/?ref=hipaa.com)[Vendor Of Personal Health Records](http://www.hipaa.com/2009/05/the-definition-of-vendor-of-personal-health-records/?ref=hipaa.com) | | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | **PAYMENT** The term ‘payment’ has the meaning given such term in section 164.501 of title 45, Code of Federal Regulations. Section 164.501— Payment means: (1) The activities undertaken by: (i) A health plan to obtain premiums or to determine or fulfill its responsibility for coverage and provision of benefits under the health plan; or (ii) A covered health care provider or health plan to obtain or provide reimbursement for the provision of health care; and (2) The activities in paragraph (1) of this definition related to the individual to whom health care is provided and include, but are not limited to: (i) Determinations of eligibility or coverage (including coordination of benefits or the determination of cost sharing amounts), and adjudication or subrogation of health benefit claims; (ii) Risk adjusting amounts due based on enrollee health status and demographic characteristics; (iii) Billing, claims management, collection activities, obtaining payment under a contract for reinsurance (including stop-loss insurance and excess of loss insurance), and related health care data processing; (iv) Review of health care services with respect to medical necessity, coverage under a health plan, appropriateness of care, or justification of charges; (v) Utilization review activities, including precertification and preauthorization of services, concurrent and retrospective review of services; and (vi) Disclosure to consumer reporting agencies of any of the following protected health information relating to collection of premiums or reimbursement: (A) Name and address; (B) Date of birth; (C) Social Security number; (D) Payment history; (E) Account number; and (F) Name and address of the health care provider and/or health plan. ### The Definition of National Coordinator URL: https://hipaa.com/the-definition-of-national-coordinator/ Last updated: 2009-05-11T02:33:53.000Z This posting is one of several that outline the HITECH privacy provisions of the American Recovery and Reinvestment Act that President Obama signed into law on Tuesday, February 17, 2009, in Denver, CO. Here, we reproduce the definitions that appear in Subtitle D—Privacy, Section 13400\. Definitions, that appear in the Conference Report on page H1345 of Congressional Record—House, February 12, 2009\. These definitions are critical in understanding the content of the new HITECH privacy provisions and how they relate to existing HIPAA Administrative Simplification Privacy Rule standards. HIPAA Privacy Definitions: | [Breach](http://www.hipaa.com/2009/05/the-definition-of-breach/?ref=hipaa.com)[Business Associate](http://www.hipaa.com/2009/05/the-definition-of-business-associate/?ref=hipaa.com)[Covered Entity](http://www.hipaa.com/2009/05/the-definition-of-covered-entity/?ref=hipaa.com)[Disclosure](http://www.hipaa.com/2009/05/the-definition-of-disclosure/?ref=hipaa.com)[Electronic Health Record](http://www.hipaa.com/2009/05/the-definition-of-electronic-health-record/?ref=hipaa.com)[Health Care Operations](http://www.hipaa.com/2009/05/the-definition-of-health-care-operations/?ref=hipaa.com) | [Health Care Provider](http://www.hipaa.com/2009/05/the-definition-of-health-care-provider/?ref=hipaa.com)[Health Plan](http://www.hipaa.com/2009/05/the-definition-of-health-plan/?ref=hipaa.com)[National Coordinator](http://www.hipaa.com/2009/05/the-definition-of-national-coordinator/?ref=hipaa.com)[Payment](http://www.hipaa.com/2009/05/the-definition-of-payment/?ref=hipaa.com)[Personal Health Record](http://www.hipaa.com/2009/05/the-definition-of-personal-health-record/?ref=hipaa.com)[Protected Health Information](http://www.hipaa.com/2009/05/the-definition-of-protected-health-information/?ref=hipaa.com) | [Secretary](http://www.hipaa.com/2009/05/the-definition-of-secretary/?ref=hipaa.com)[Security](http://www.hipaa.com/2009/05/the-definition-of-security/?ref=hipaa.com)[State](http://www.hipaa.com/2009/05/the-definition-of-state/?ref=hipaa.com)[Treatment](http://www.hipaa.com/2009/05/the-definition-of-treatment/?ref=hipaa.com)[Use](http://www.hipaa.com/2009/05/the-definition-of-use/?ref=hipaa.com)[Vendor Of Personal Health Records](http://www.hipaa.com/2009/05/the-definition-of-vendor-of-personal-health-records/?ref=hipaa.com) | | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | **NATIONAL COORDINATOR** The term ‘national coordinator’ means the head of the Office of the National Coordinator for Health Information Technology established under section 3001(a) of the Public Health Service Act, as added by section 13101.4 --- 4 This position is defined in the Health Information Technology for Economic and Clinical Health Act (HITECH Act) provisions of the American Recovery and Reinvestment Act. See pp. H1337-H1338 of Congressional Record-House, February 12, 2009, which is available on the hipaa.com Web site. ### The Definition of Health Plan URL: https://hipaa.com/the-definition-of-health-plan/ Last updated: 2009-05-11T02:32:34.000Z This posting is one of several that outline the HITECH privacy provisions of the American Recovery and Reinvestment Act that President Obama signed into law on Tuesday, February 17, 2009, in Denver, CO. Here, we reproduce the definitions that appear in Subtitle D—Privacy, Section 13400\. Definitions, that appear in the Conference Report on page H1345 of Congressional Record—House, February 12, 2009\. These definitions are critical in understanding the content of the new HITECH privacy provisions and how they relate to existing HIPAA Administrative Simplification Privacy Rule standards. HIPAA Privacy Definitions: | [Breach](http://www.hipaa.com/2009/05/the-definition-of-breach/?ref=hipaa.com)[Business Associate](http://www.hipaa.com/2009/05/the-definition-of-business-associate/?ref=hipaa.com)[Covered Entity](http://www.hipaa.com/2009/05/the-definition-of-covered-entity/?ref=hipaa.com)[Disclosure](http://www.hipaa.com/2009/05/the-definition-of-disclosure/?ref=hipaa.com)[Electronic Health Record](http://www.hipaa.com/2009/05/the-definition-of-electronic-health-record/?ref=hipaa.com)[Health Care Operations](http://www.hipaa.com/2009/05/the-definition-of-health-care-operations/?ref=hipaa.com) | [Health Care Provider](http://www.hipaa.com/2009/05/the-definition-of-health-care-provider/?ref=hipaa.com)[Health Plan](http://www.hipaa.com/2009/05/the-definition-of-health-plan/?ref=hipaa.com)[National Coordinator](http://www.hipaa.com/2009/05/the-definition-of-national-coordinator/?ref=hipaa.com)[Payment](http://www.hipaa.com/2009/05/the-definition-of-payment/?ref=hipaa.com)[Personal Health Record](http://www.hipaa.com/2009/05/the-definition-of-personal-health-record/?ref=hipaa.com)[Protected Health Information](http://www.hipaa.com/2009/05/the-definition-of-protected-health-information/?ref=hipaa.com) | [Secretary](http://www.hipaa.com/2009/05/the-definition-of-secretary/?ref=hipaa.com)[Security](http://www.hipaa.com/2009/05/the-definition-of-security/?ref=hipaa.com)[State](http://www.hipaa.com/2009/05/the-definition-of-state/?ref=hipaa.com)[Treatment](http://www.hipaa.com/2009/05/the-definition-of-treatment/?ref=hipaa.com)[Use](http://www.hipaa.com/2009/05/the-definition-of-use/?ref=hipaa.com)[Vendor Of Personal Health Records](http://www.hipaa.com/2009/05/the-definition-of-vendor-of-personal-health-records/?ref=hipaa.com) | | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | **HEALTH PLAN** The term ‘health plan’ has the meaning given such term in section 160.103 of title 45, Code of Federal Regulations. Section 160.103— An individual or group plan that provides, or pays the cost of, medical care (as defined in section 2791(a)(2) of the Public Health Service Act, 42 U.S.C. 300gg-91(a)(2)). (1) Health plan includes the following, singly or in combination: (i) A group health plan, as defined in this section. (ii) A health insurance issuer, as defined in this section. (iii) An HMO, as defined in this section. (iv) Part A or Part B of the Medicare program under title XVIII of the Act. (v) The Medicaid program under title XIX of the Act, 42 U.S.C. 1396, et seq. (vi) An issuer of a Medicare supplemental policy (as defined in section 1882(g)(1) of the Act, 42 U.S.C. 1395ss(g)(1)). (vii) An issuer of a long-term care policy, excluding a nursing home fixed- indemnity policy. (viii) An employee welfare benefit plan or any other arrangement that is established or maintained for the purpose of offering or providing health benefits to the employees of two or more employers. (ix) The health care program for active military personnel under title 10 of the United States Code. (x) The veterans health care program under 38 U.S.C. chapter 17. (xi) The Civilian Health and Medical Program of the Uniformed Services (CHAMPUS)(as defined in 10 U.S.C. 1072(4)). (xii) The Indian Health Service program under the Indian Health Care Improvement Act, 25 U.S.C. 1601, et seq. (xiii) The Federal Employees Health Benefits Program under 5 U.S.C. 8902, et seq. (xiv) An approved State child health plan under title XXI of the Act, providing benefits for child health assistance that meet the requirements of section 2103 of the Act, 42 U.S.C. 1397, et seq. (xv) The Medicare + Choice program under Part C of title XVIII of the Act, 42 U.S.C. 1395w-21 through 1395w-28. (xvi) A high risk pool that is a mechanism established under State law to provide health insurance coverage or comparable coverage to eligible individuals. (xvii) Any other individual or group plan, or combination of individual or group plans, that provides or pays for the cost of medical care (as defined in section 2791(a)(2) of the PHS Act, 42 U.S.C. 300gg-91(a)(2)). (2) Health plan excludes: (i) Any policy, plan, or program to the extent that it provides, or pays for the cost of, excepted benefits that are listed in section 2791(c)(1) of the PHS Act, 42 U.S.C. 300gg-91(c)(1); and (ii) A government-funded program (other than one listed in paragraph (1)(i)-(xvi)of this definition): (A) Whose principal purpose is other than providing, or paying the cost of, health care; (or) (B) Whose principal activity is: a. The direct provision of health care to persons; or b. The making of grants to fund the direct provision of health care to persons. ### The Definition of Health Care Provider URL: https://hipaa.com/the-definition-of-health-care-provider/ Last updated: 2009-05-11T02:31:04.000Z This posting is one of several that outline the HITECH privacy provisions of the American Recovery and Reinvestment Act that President Obama signed into law on Tuesday, February 17, 2009, in Denver, CO. Here, we reproduce the definitions that appear in Subtitle D—Privacy, Section 13400\. Definitions, that appear in the Conference Report on page H1345 of Congressional Record—House, February 12, 2009\. These definitions are critical in understanding the content of the new HITECH privacy provisions and how they relate to existing HIPAA Administrative Simplification Privacy Rule standards. HIPAA Privacy Definitions: | [Breach](http://www.hipaa.com/2009/05/the-definition-of-breach/?ref=hipaa.com)[Business Associate](http://www.hipaa.com/2009/05/the-definition-of-business-associate/?ref=hipaa.com)[Covered Entity](http://www.hipaa.com/2009/05/the-definition-of-covered-entity/?ref=hipaa.com)[Disclosure](http://www.hipaa.com/2009/05/the-definition-of-disclosure/?ref=hipaa.com)[Electronic Health Record](http://www.hipaa.com/2009/05/the-definition-of-electronic-health-record/?ref=hipaa.com)[Health Care Operations](http://www.hipaa.com/2009/05/the-definition-of-health-care-operations/?ref=hipaa.com) | [Health Care Provider](http://www.hipaa.com/2009/05/the-definition-of-health-care-provider/?ref=hipaa.com)[Health Plan](http://www.hipaa.com/2009/05/the-definition-of-health-plan/?ref=hipaa.com)[National Coordinator](http://www.hipaa.com/2009/05/the-definition-of-national-coordinator/?ref=hipaa.com)[Payment](http://www.hipaa.com/2009/05/the-definition-of-payment/?ref=hipaa.com)[Personal Health Record](http://www.hipaa.com/2009/05/the-definition-of-personal-health-record/?ref=hipaa.com)[Protected Health Information](http://www.hipaa.com/2009/05/the-definition-of-protected-health-information/?ref=hipaa.com) | [Secretary](http://www.hipaa.com/2009/05/the-definition-of-secretary/?ref=hipaa.com)[Security](http://www.hipaa.com/2009/05/the-definition-of-security/?ref=hipaa.com)[State](http://www.hipaa.com/2009/05/the-definition-of-state/?ref=hipaa.com)[Treatment](http://www.hipaa.com/2009/05/the-definition-of-treatment/?ref=hipaa.com)[Use](http://www.hipaa.com/2009/05/the-definition-of-use/?ref=hipaa.com)[Vendor Of Personal Health Records](http://www.hipaa.com/2009/05/the-definition-of-vendor-of-personal-health-records/?ref=hipaa.com) | | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | **HEALTH CARE PROVIDER** The term ‘health care provider’ has the meaning given such term in section 160.103 of title 45, Code of Federal Regulations. Section 160.103— Provider of services (as defined in section 1861(u) of the \[Social Security\] Act, 42 U.S.C. 1395x(u)), a provider of medical or health services (as defined in section 1861(s) of the Act, 42 U.S.C. 1395x(s)), and any other person or organization who furnishes, bills, or is paid for health care in the normal course of business.3 --- 3 Social Security Act, Section 1861 definitions for (u) and (s) are available online at http://www.ssa.gov/OP\_Home/ssact/title18/1861.htm. ### The Definition of Health Care Operations URL: https://hipaa.com/the-definition-of-health-care-operations/ Last updated: 2009-05-11T02:30:42.000Z This posting is one of several that outline the HITECH privacy provisions of the American Recovery and Reinvestment Act that President Obama signed into law on Tuesday, February 17, 2009, in Denver, CO. Here, we reproduce the definitions that appear in Subtitle D—Privacy, Section 13400\. Definitions, that appear in the Conference Report on page H1345 of Congressional Record—House, February 12, 2009\. These definitions are critical in understanding the content of the new HITECH privacy provisions and how they relate to existing HIPAA Administrative Simplification Privacy Rule standards. HIPAA Privacy Definitions: | [Breach](http://www.hipaa.com/2009/05/the-definition-of-breach/?ref=hipaa.com)[Business Associate](http://www.hipaa.com/2009/05/the-definition-of-business-associate/?ref=hipaa.com)[Covered Entity](http://www.hipaa.com/2009/05/the-definition-of-covered-entity/?ref=hipaa.com)[Disclosure](http://www.hipaa.com/2009/05/the-definition-of-disclosure/?ref=hipaa.com)[Electronic Health Record](http://www.hipaa.com/2009/05/the-definition-of-electronic-health-record/?ref=hipaa.com)[Health Care Operations](http://www.hipaa.com/2009/05/the-definition-of-health-care-operations/?ref=hipaa.com) | [Health Care Provider](http://www.hipaa.com/2009/05/the-definition-of-health-care-provider/?ref=hipaa.com)[Health Plan](http://www.hipaa.com/2009/05/the-definition-of-health-plan/?ref=hipaa.com)[National Coordinator](http://www.hipaa.com/2009/05/the-definition-of-national-coordinator/?ref=hipaa.com)[Payment](http://www.hipaa.com/2009/05/the-definition-of-payment/?ref=hipaa.com)[Personal Health Record](http://www.hipaa.com/2009/05/the-definition-of-personal-health-record/?ref=hipaa.com)[Protected Health Information](http://www.hipaa.com/2009/05/the-definition-of-protected-health-information/?ref=hipaa.com) | [Secretary](http://www.hipaa.com/2009/05/the-definition-of-secretary/?ref=hipaa.com)[Security](http://www.hipaa.com/2009/05/the-definition-of-security/?ref=hipaa.com)[State](http://www.hipaa.com/2009/05/the-definition-of-state/?ref=hipaa.com)[Treatment](http://www.hipaa.com/2009/05/the-definition-of-treatment/?ref=hipaa.com)[Use](http://www.hipaa.com/2009/05/the-definition-of-use/?ref=hipaa.com)[Vendor Of Personal Health Records](http://www.hipaa.com/2009/05/the-definition-of-vendor-of-personal-health-records/?ref=hipaa.com) | | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | **HEALTH CARE OPERATIONS** The term ‘health care operations’ has the meaning given such term in section 164.501 of title 45, Code of Federal Regulations. Section 164.501— Any of the following activities of the covered entity to the extent that the activities are related to covered functions: (1) Conducting quality assessment and improvement activities, including outcomes evaluation and development of clinical guidelines, provided that the obtaining of generalizable knowledge is not the primary purpose of any studies resulting from such activities; population-based activities relating to improving health or reducing health care costs, protocol development, case management and care coordination, contacting of health care providers and patients with information about treatment alternatives; and related functions that do not include treatment; (2) Reviewing the competence or qualifications of health care professionals, evaluating practitioner and provider performance, health plan performance, conducting training programs in which students, trainees, or practitioners in areas of health care learn under supervision to practice or improve their skills as health care providers, training of non-health care professionals, accreditation, certification, licensing, or credentialing activities. (3) Underwriting, premium rating, and other activities relating to the creation, renewal or replacement of a contract of health insurance or health benefits, and ceding, securing, or placing a contract for reinsurance of risk relating to claims for health care (including stop-loss insurance and excess of loss insurance), provided that the requirements of section 164.514(g)1 are met, if applicable; (4) Conducting or arranging for medical review, legal services, and auditing functions, including fraud and abuse detection and compliance programs; (5) Business planning and development, such as conducting cost-management and planning-related analyses related to managing and operating the entity, including formulary development and administration, development or improvement of methods of payment or coverage policies; and (6) Business management and general administrative activities of the entity, including, but not limited to, (i) Management activities relating to implementation of an compliance with the requirements of this subchapter; (ii) Customer service, including the provision of data analyses for policy holders, plan sponsors, or other customers, provided that protected health information is not disclosed to such policy holder, plan sponsor, or customer; (iii) Resolution of internal grievances; (iv) The sale, transfer, merger, or consolidation of all or part of the covered entity with another covered entity, or an entity that following such activity will become a covered entity and due diligence related to such activity; and (v) Consistent with the applicable requirements of section 164.5142, creating de-identified health information or a limited data set, and fundraising for the benefit of the covered entity. --- 1 **Section 164.514(g) Standard:** Uses and disclosures for underwriting and related purposes. If a health plan receives protected heath information for the purpose of underwriting, premium rating, or other activities relating to the creation, renewal, or replacement of a contract of health insurance or health benefits, and if such health insurance or health benefits are not placed with the health plan, such health plan may not use or disclose such protected health information for any other purpose, except as may be required by law. 2 **Section 164.514—Other requirements relating to uses and disclosures of protected health information:** (a) Standard: de-identification of protected health information; (b) Implementation specifications: requirements for de-identification of protected health information; (e)(1) Standard: Limited data set; and (f)(1) Standard: Uses and disclosures for fundraising. ### The Definition of Electronic Health Record URL: https://hipaa.com/the-definition-of-electronic-health-record/ Last updated: 2009-05-11T01:50:20.000Z This posting is one of several that outline the HITECH privacy provisions of the American Recovery and Reinvestment Act that President Obama signed into law on Tuesday, February 17, 2009, in Denver, CO. Here, we reproduce the definitions that appear in Subtitle D—Privacy, Section 13400\. Definitions, that appear in the Conference Report on page H1345 of Congressional Record—House, February 12, 2009\. These definitions are critical in understanding the content of the new HITECH privacy provisions and how they relate to existing HIPAA Administrative Simplification Privacy Rule standards. HIPAA Privacy Definitions: | [Breach](http://www.hipaa.com/2009/05/the-definition-of-breach/?ref=hipaa.com)[Business Associate](http://www.hipaa.com/2009/05/the-definition-of-business-associate/?ref=hipaa.com)[Covered Entity](http://www.hipaa.com/2009/05/the-definition-of-covered-entity/?ref=hipaa.com)[Disclosure](http://www.hipaa.com/2009/05/the-definition-of-disclosure/?ref=hipaa.com)[Electronic Health Record](http://www.hipaa.com/2009/05/the-definition-of-electronic-health-record/?ref=hipaa.com)[Health Care Operations](http://www.hipaa.com/2009/05/the-definition-of-health-care-operations/?ref=hipaa.com) | [Health Care Provider](http://www.hipaa.com/2009/05/the-definition-of-health-care-provider/?ref=hipaa.com)[Health Plan](http://www.hipaa.com/2009/05/the-definition-of-health-plan/?ref=hipaa.com)[National Coordinator](http://www.hipaa.com/2009/05/the-definition-of-national-coordinator/?ref=hipaa.com)[Payment](http://www.hipaa.com/2009/05/the-definition-of-payment/?ref=hipaa.com)[Personal Health Record](http://www.hipaa.com/2009/05/the-definition-of-personal-health-record/?ref=hipaa.com)[Protected Health Information](http://www.hipaa.com/2009/05/the-definition-of-protected-health-information/?ref=hipaa.com) | [Secretary](http://www.hipaa.com/2009/05/the-definition-of-secretary/?ref=hipaa.com)[Security](http://www.hipaa.com/2009/05/the-definition-of-security/?ref=hipaa.com)[State](http://www.hipaa.com/2009/05/the-definition-of-state/?ref=hipaa.com)[Treatment](http://www.hipaa.com/2009/05/the-definition-of-treatment/?ref=hipaa.com)[Use](http://www.hipaa.com/2009/05/the-definition-of-use/?ref=hipaa.com)[Vendor Of Personal Health Records](http://www.hipaa.com/2009/05/the-definition-of-vendor-of-personal-health-records/?ref=hipaa.com) | | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | **ELECTRONIC HEALTH RECORD** The term ‘electronic health record’ means an electronic record of health-related information on an individual that is created, gathered, managed, and consulted by authorized health care clinicians and staff. ### The Definition of Disclosure URL: https://hipaa.com/the-definition-of-disclosure/ Last updated: 2009-05-11T01:45:20.000Z This posting is one of several that outline the HITECH privacy provisions of the American Recovery and Reinvestment Act that President Obama signed into law on Tuesday, February 17, 2009, in Denver, CO. Here, we reproduce the definitions that appear in Subtitle D—Privacy, Section 13400\. Definitions, that appear in the Conference Report on page H1345 of Congressional Record—House, February 12, 2009\. These definitions are critical in understanding the content of the new HITECH privacy provisions and how they relate to existing HIPAA Administrative Simplification Privacy Rule standards. HIPAA Privacy Definitions: | [Breach](http://www.hipaa.com/2009/05/the-definition-of-breach/?ref=hipaa.com)[Business Associate](http://www.hipaa.com/2009/05/the-definition-of-business-associate/?ref=hipaa.com)[Covered Entity](http://www.hipaa.com/2009/05/the-definition-of-covered-entity/?ref=hipaa.com)[Disclosure](http://www.hipaa.com/2009/05/the-definition-of-disclosure/?ref=hipaa.com)[Electronic Health Record](http://www.hipaa.com/2009/05/the-definition-of-electronic-health-record/?ref=hipaa.com)[Health Care Operations](http://www.hipaa.com/2009/05/the-definition-of-health-care-operations/?ref=hipaa.com) | [Health Care Provider](http://www.hipaa.com/2009/05/the-definition-of-health-care-provider/?ref=hipaa.com)[Health Plan](http://www.hipaa.com/2009/05/the-definition-of-health-plan/?ref=hipaa.com)[National Coordinator](http://www.hipaa.com/2009/05/the-definition-of-national-coordinator/?ref=hipaa.com)[Payment](http://www.hipaa.com/2009/05/the-definition-of-payment/?ref=hipaa.com)[Personal Health Record](http://www.hipaa.com/2009/05/the-definition-of-personal-health-record/?ref=hipaa.com)[Protected Health Information](http://www.hipaa.com/2009/05/the-definition-of-protected-health-information/?ref=hipaa.com) | [Secretary](http://www.hipaa.com/2009/05/the-definition-of-secretary/?ref=hipaa.com)[Security](http://www.hipaa.com/2009/05/the-definition-of-security/?ref=hipaa.com)[State](http://www.hipaa.com/2009/05/the-definition-of-state/?ref=hipaa.com)[Treatment](http://www.hipaa.com/2009/05/the-definition-of-treatment/?ref=hipaa.com)[Use](http://www.hipaa.com/2009/05/the-definition-of-use/?ref=hipaa.com)[Vendor Of Personal Health Records](http://www.hipaa.com/2009/05/the-definition-of-vendor-of-personal-health-records/?ref=hipaa.com) | | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | **DISCLOSURE** The terms ‘disclose’ and ‘disclosure’ have the meaning given the term ‘disclosure’ in section 160.103 of title 45, Code of Federal Regulations. Section 160.103— Disclosure means the release, transfer, provision of, access to, or divulging in any other manner of information outside the entity holding the information. ### The Definition of Covered Entity URL: https://hipaa.com/the-definition-of-covered-entity/ Last updated: 2009-05-11T01:42:55.000Z This posting is one of several that outline the HITECH privacy provisions of the American Recovery and Reinvestment Act that President Obama signed into law on Tuesday, February 17, 2009, in Denver, CO. Here, we reproduce the definitions that appear in Subtitle D—Privacy, Section 13400\. Definitions, that appear in the Conference Report on page H1345 of Congressional Record—House, February 12, 2009\. These definitions are critical in understanding the content of the new HITECH privacy provisions and how they relate to existing HIPAA Administrative Simplification Privacy Rule standards. HIPAA Privacy Definitions: | [Breach](http://www.hipaa.com/2009/05/the-definition-of-breach/?ref=hipaa.com)[Business Associate](http://www.hipaa.com/2009/05/the-definition-of-business-associate/?ref=hipaa.com)[Covered Entity](http://www.hipaa.com/2009/05/the-definition-of-covered-entity/?ref=hipaa.com)[Disclosure](http://www.hipaa.com/2009/05/the-definition-of-disclosure/?ref=hipaa.com)[Electronic Health Record](http://www.hipaa.com/2009/05/the-definition-of-electronic-health-record/?ref=hipaa.com)[Health Care Operations](http://www.hipaa.com/2009/05/the-definition-of-health-care-operations/?ref=hipaa.com) | [Health Care Provider](http://www.hipaa.com/2009/05/the-definition-of-health-care-provider/?ref=hipaa.com)[Health Plan](http://www.hipaa.com/2009/05/the-definition-of-health-plan/?ref=hipaa.com)[National Coordinator](http://www.hipaa.com/2009/05/the-definition-of-national-coordinator/?ref=hipaa.com)[Payment](http://www.hipaa.com/2009/05/the-definition-of-payment/?ref=hipaa.com)[Personal Health Record](http://www.hipaa.com/2009/05/the-definition-of-personal-health-record/?ref=hipaa.com)[Protected Health Information](http://www.hipaa.com/2009/05/the-definition-of-protected-health-information/?ref=hipaa.com) | [Secretary](http://www.hipaa.com/2009/05/the-definition-of-secretary/?ref=hipaa.com)[Security](http://www.hipaa.com/2009/05/the-definition-of-security/?ref=hipaa.com)[State](http://www.hipaa.com/2009/05/the-definition-of-state/?ref=hipaa.com)[Treatment](http://www.hipaa.com/2009/05/the-definition-of-treatment/?ref=hipaa.com)[Use](http://www.hipaa.com/2009/05/the-definition-of-use/?ref=hipaa.com)[Vendor Of Personal Health Records](http://www.hipaa.com/2009/05/the-definition-of-vendor-of-personal-health-records/?ref=hipaa.com) | | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | **COVERED ENTITY** The term ‘covered entity’ has the meaning given such term in section 160.103 of title 45, Code of Federal Regulations. Section 160.103— (1) A health plan. (2) A health care clearinghouse. (3) A health care provider who transmits any health information in electronic form in connection with a transaction covered by this subchapter \[e.g., HIPAA Administrative Simplification transaction standards\]. ### The Definition of Business Associate URL: https://hipaa.com/the-definition-of-business-associate/ Last updated: 2009-05-11T01:40:33.000Z This posting is one of several that outline the HITECH privacy provisions of the American Recovery and Reinvestment Act that President Obama signed into law on Tuesday, February 17, 2009, in Denver, CO. Here, we reproduce the definitions that appear in Subtitle D—Privacy, Section 13400\. Definitions, that appear in the Conference Report on page H1345 of Congressional Record—House, February 12, 2009\. These definitions are critical in understanding the content of the new HITECH privacy provisions and how they relate to existing HIPAA Administrative Simplification Privacy Rule standards. HIPAA Privacy Definitions: | [Breach](http://www.hipaa.com/2009/05/the-definition-of-breach/?ref=hipaa.com)[Business Associate](http://www.hipaa.com/2009/05/the-definition-of-business-associate/?ref=hipaa.com)[Covered Entity](http://www.hipaa.com/2009/05/the-definition-of-covered-entity/?ref=hipaa.com)[Disclosure](http://www.hipaa.com/2009/05/the-definition-of-disclosure/?ref=hipaa.com)[Electronic Health Record](http://www.hipaa.com/2009/05/the-definition-of-electronic-health-record/?ref=hipaa.com)[Health Care Operations](http://www.hipaa.com/2009/05/the-definition-of-health-care-operations/?ref=hipaa.com) | [Health Care Provider](http://www.hipaa.com/2009/05/the-definition-of-health-care-provider/?ref=hipaa.com)[Health Plan](http://www.hipaa.com/2009/05/the-definition-of-health-plan/?ref=hipaa.com)[National Coordinator](http://www.hipaa.com/2009/05/the-definition-of-national-coordinator/?ref=hipaa.com)[Payment](http://www.hipaa.com/2009/05/the-definition-of-payment/?ref=hipaa.com)[Personal Health Record](http://www.hipaa.com/2009/05/the-definition-of-personal-health-record/?ref=hipaa.com)[Protected Health Information](http://www.hipaa.com/2009/05/the-definition-of-protected-health-information/?ref=hipaa.com) | [Secretary](http://www.hipaa.com/2009/05/the-definition-of-secretary/?ref=hipaa.com)[Security](http://www.hipaa.com/2009/05/the-definition-of-security/?ref=hipaa.com)[State](http://www.hipaa.com/2009/05/the-definition-of-state/?ref=hipaa.com)[Treatment](http://www.hipaa.com/2009/05/the-definition-of-treatment/?ref=hipaa.com)[Use](http://www.hipaa.com/2009/05/the-definition-of-use/?ref=hipaa.com)[Vendor Of Personal Health Records](http://www.hipaa.com/2009/05/the-definition-of-vendor-of-personal-health-records/?ref=hipaa.com) | | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | **BUSINESS ASSOCIATE** The term ‘business associate’ has the meaning given such term in section 160.103 of title 45, Code of Federal Regulations. Section 160.103— (1) Except as provided in paragraph (2) of this definition, business associate means, with respect to a covered entity, a person who: (i) On behalf of such covered entity or of an organized health care arrangement in which the covered entity participates, but other than in the capacity of a member of the workforce of such covered entity or arrangement, performs, or assists in the performance of: (A) A function or activity involving the use or disclosure of individually identifiable health information, including claims processing or administration, data analysis, processing or administration, utilization review, quality assurance, billing, benefit management, practice management, and repricing; or (B) Any other function or activity regulated by this subchapter; or (ii) Provides, other than in the capacity of a member of the workforce of such covered entity, legal, actuarial, accounting, consulting, data aggregation, management, administrative, accreditation, or financial services to or for such covered entity, or to or for an organized health care arrangement in which the covered entity participates, where the provision of the services involves the disclosure of individually identifiable health information from such covered entity or arrangement, or from another business associate of such covered entity or arrangement, to the person. (2) A covered entity participating in an organized health care arrangement that performs a function or activity as described by paragraph (1)(i) of this definition for or on behalf of such organized health care arrangement, or that provides a services as described in paragraph (1)(ii) of this definition to or for such organized health care arrangement, does not, simply through the performance of such function or activity or the provision of such service, become a business associate of other covered entities participating in such organized health care arrangement. (3) A covered entity may be a business associate of another covered entity. ### The Definition of Breach URL: https://hipaa.com/the-definition-of-breach/ Last updated: 2009-05-10T13:39:30.000Z This posting is one of several that outline the HITECH privacy provisions of the American Recovery and Reinvestment Act that President Obama signed into law on Tuesday, February 17, 2009, in Denver, CO. Here, we reproduce the definitions that appear in Subtitle D—Privacy, Section 13400\. Definitions, that appear in the Conference Report on page H1345 of Congressional Record—House, February 12, 2009\. These definitions are critical in understanding the content of the new HITECH privacy provisions and how they relate to existing HIPAA Administrative Simplification Privacy Rule standards. HIPAA Privacy Definitions: | [Breach](http://www.hipaa.com/2009/05/the-definition-of-breach/?ref=hipaa.com)[Business Associate](http://www.hipaa.com/2009/05/the-definition-of-business-associate/?ref=hipaa.com)[Covered Entity](http://www.hipaa.com/2009/05/the-definition-of-covered-entity/?ref=hipaa.com)[Disclosure](http://www.hipaa.com/2009/05/the-definition-of-disclosure/?ref=hipaa.com)[Electronic Health Record](http://www.hipaa.com/2009/05/the-definition-of-electronic-health-record/?ref=hipaa.com)[Health Care Operations](http://www.hipaa.com/2009/05/the-definition-of-health-care-operations/?ref=hipaa.com) | [Health Care Provider](http://www.hipaa.com/2009/05/the-definition-of-health-care-provider/?ref=hipaa.com)[Health Plan](http://www.hipaa.com/2009/05/the-definition-of-health-plan/?ref=hipaa.com)[National Coordinator](http://www.hipaa.com/2009/05/the-definition-of-national-coordinator/?ref=hipaa.com)[Payment](http://www.hipaa.com/2009/05/the-definition-of-payment/?ref=hipaa.com)[Personal Health Record](http://www.hipaa.com/2009/05/the-definition-of-personal-health-record/?ref=hipaa.com)[Protected Health Information](http://www.hipaa.com/2009/05/the-definition-of-protected-health-information/?ref=hipaa.com) | [Secretary](http://www.hipaa.com/2009/05/the-definition-of-secretary/?ref=hipaa.com)[Security](http://www.hipaa.com/2009/05/the-definition-of-security/?ref=hipaa.com)[State](http://www.hipaa.com/2009/05/the-definition-of-state/?ref=hipaa.com)[Treatment](http://www.hipaa.com/2009/05/the-definition-of-treatment/?ref=hipaa.com)[Use](http://www.hipaa.com/2009/05/the-definition-of-use/?ref=hipaa.com)[Vendor Of Personal Health Records](http://www.hipaa.com/2009/05/the-definition-of-vendor-of-personal-health-records/?ref=hipaa.com) | | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | **BREACH** (A) IN GENERAL. The term ‘breach’ means the unauthorized acquisition, access, use, or disclosure of protected health information which compromises the security or privacy of such information, except where an unauthorized person to whom such information is disclosed would not reasonably have been able to retain such information. (B) EXCEPTIONS. The term ‘breach’ does not include— (i) Any unintentional acquisition, access, or use of protected health information by an employee or individual acting under the authority of a covered entity or business associate if— (1) Such acquisition, access, or use was made in good faith and within the course and scope of the employment or other professional relationship of such employee or individual, respectively, with the covered entity or business associate; and (2) Such information is not further acquired, accessed, used, or disclosed by any person; (ii) Any inadvertent disclosure from an individual who is otherwise authorized to access protected health information at a facility operated by a covered entity or business associate to another similarly situated individual at same facility; and (iii) Any such information received as a result of such disclosure is not further acquired, accessed, used, or disclosed without authorization by any person. ### Word of the Day: Evidence-Based Medicine URL: https://hipaa.com/word-of-the-day-evidence-based-medicine/ Last updated: 2009-05-08T15:00:25.000Z **Evidence-Based Medicine**: The conscientious, explicit, and judicious use of current best evidence in making decisions about the care of individual patients. The practice of evidence-based medicine means integrating individual clinical expertise with the best available external clinical evidence from systematic research. ### Word of the Day: Digital Signature URL: https://hipaa.com/word-of-the-day-digital-signature-2/ Last updated: 2009-05-07T17:00:59.000Z **Digital Signature**: An electronic signature, which serves as a unique identifier for an individual, much like a written signature, in which an algorithm authenticates the integrity of the signed data and the identity of the signatory. ### Word of the Day: Health Level 7 (HL7) URL: https://hipaa.com/word-of-the-day-health-level-7-hl7/ Last updated: 2009-05-06T16:48:21.000Z **Health Level 7** **(HL7):** One of several American National Standards Institute (ANSI)-accredited standards developing organizations (SDOs) operating in the health care arena. Most SDOs produce standards (sometimes called specifications or protocols) for a particular health care domain such as pharmacy, medical devices, imaging, or insurance (claims processing) transactions. HL7's domain is clinical and administrative data. ### Word of the Day: Digital Signature URL: https://hipaa.com/word-of-the-day-digital-signature/ Last updated: 2009-05-05T19:03:34.000Z **Digital Signature:** An electronic signature, which serves as a unique identifier for an individual, much like a written signature, in which an algorithm authenticates the integrity of the signed data and the identity of the signatory. ### FTC Delays Identity Theft Prevention Red Flags Rule for Second Time URL: https://hipaa.com/ftc-delays-identity-theft-prevention-red-flags-rule-for-second-time/ Last updated: 2009-05-05T16:02:41.000Z The Federal Trade Commission announced a second delay on Friday, May 1, 2009, for compliance with the identity theft prevention *red flags* rule. The delay is for three months, with compliance now scheduled for August 1, 2009\. Entities affected are creditors and financial institutions. Healthcare providers that extend delayed payment plans to patients are deemed "creditors" under the *red flags* rule. This delay was to give affected entities more time to develop and implement written identity theft prevention policies and procedures for compliance with the rule, which is based on enabling regulations of provisions in the Fair and Accurate Credit Transactions Act of 2003\. You can visit the [FTC website](http://www.ftc.gov/redflagsrule?ref=hipaa.com) for additional information. HIPAA.com has outlined provisions of the rule [in an earlier posting](http://www.hipaa.com/2009/04/ftcs-red-flags-rule-to-prevent-identity-theft-requires-compliance-by-healthcare-providers-on-friday-may-1-2009/?ref=hipaa.com), and has [available for download](http://www.hipaa.com/2009/04/identity-theft-red-flags-and-address-discrepancies/?ref=hipaa.com) a copy of FTC's "Fighting Fraud with the Red Flags Rule: A How-To Guide for Business." ### Word of the Day: Security Incident URL: https://hipaa.com/word-of-the-day-security-incident-2/ Last updated: 2009-05-04T17:00:55.000Z **Security Incident:** The attempted or successful unauthorized access, use, disclosure, modification, or destruction of information or interference with system operations in an information system. ### Federal Government Declares Public Health Emergency Regarding H1N1 (Swine) Flu URL: https://hipaa.com/federal-government-declares-public-health-emergency-regarding-h1n1-swine-flu/ Last updated: 2009-05-04T13:30:44.000Z The federal government has declared a public health emergency in the United States concerning H1N1 swine flu. The Centers for Disease Control and Prevention (CDC) provides "information to help health care providers, public health officials and the public address the challenges posed by this emergency. CDC is issuing and updating interim guidance daily in response to the rapidly evolving situation." HIPAA.com recommends that you visit the CDC site, [http://www.cdc.gov/h1n1flu](http://www.cdc.gov/h1n1flu?ref=hipaa.com), where you can get additional information and sign up for situation updates via email. Also, CDC posts emergency updates on Twitter at [http://twitter.com/cdcemergency](http://twitter.com/cdcemergency?ref=hipaa.com). ### Red Flags Rules Compliance Countdown: Today URL: https://hipaa.com/red-flags-rules-compliance-countdown-today/ Last updated: 2009-05-01T13:00:40.000Z The Federal Trade Commission's (FTC's) red flags rules for financial institutions and creditors to fight identity theft require compliance by most healthcare providers **today**, Friday, May 1, 2009. See [this post](http://www.hipaa.com/2009/04/ftcs-red-flags-rule-to-prevent-identity-theft-requires-compliance-by-healthcare-providers-on-friday-may-1-2009/?ref=hipaa.com) for more information on how to prepare for today's deadline. ### Get Your Team Prepared for the EHR, Part Four URL: https://hipaa.com/get-your-team-prepared-for-the-ehr-part-four/ Last updated: 2009-05-01T13:00:08.000Z **Technical Assessment** Technology management and support helps determine the degree to which your clinic or practice can systematically and proactively manage technology assets. For example, you want to know the IT skill set of your staff, the current state of your organization's technology infrastructure, your approach to technology planning, the existing technology management structures and technology project management capabilities. The technical assessment looks also at how well management and technology infrastructure can effectively support quality and operational goals. A technical assessment can save thousands of dollars, simply by identifying what you have and what you need. High-level items in the technical assessment or checklist include completion of a security risk assessment and the processes and procedures you plan to implement to protect confidential health information, identifying interfaces, third-party software, networking and security needs, staff, IT support, clinic layouts, identification of hardware needs, tablet/notebook and licenses, wireless drops, phone jacks, and so forth. Please [contact us](http://www.hipaa.com/contact/?ref=hipaa.com) for a free copy of our IT Technical Infrastructure Checklist. ### Word of the Day: Site Visit URL: https://hipaa.com/word-of-the-day-site-visit/ Last updated: 2009-04-30T17:00:50.000Z **Site Visit**: A scheduled three- to five-hour visit at a location determined by the vendor and host site that allows the practice purchasing the same software to see that software and interfaces in action. Most purchasers want to observe the new workflows, how well the interfaces work, and learn implementation tips. ### Red Flags Rules Compliance Countdown: 1 day URL: https://hipaa.com/red-flags-rules-compliance-countdown-1-day/ Last updated: 2009-04-30T13:00:34.000Z The Federal Trade Commission's (FTC's) red flags rules for financial institutions and creditors to fight identity theft require compliance by most healthcare providers on Friday, May 1, 2009. See [this post](http://www.hipaa.com/2009/04/ftcs-red-flags-rule-to-prevent-identity-theft-requires-compliance-by-healthcare-providers-on-friday-may-1-2009/?ref=hipaa.com) for more information on how to prepare for tomorrow's deadline. ### Get Your Team Prepared for the EHR, Part Three URL: https://hipaa.com/get-your-team-prepared-for-the-ehr-part-three/ Last updated: 2009-04-30T13:00:21.000Z **EHR Selection Preparedness: Data Management** In the third of our readiness assessments or "environmental scans," evaluate what kind of data you collect, how data are gathered, and where it is stored. Old paper storage habits (a file here, another there) can easily translate into a messy and over-loaded server as well. Start by knowing what data is collected? A typical list of health information in a medical record includes the following. Clinical data: » H & P's» Medication lists» Encounter Notes» Procedure reports» Pathology reports» Other labs reports» Imaging results/reports» Treatment Plans» Diagnosis based documentation and treatment templates» External Care (notes, reports, inpatient care) Non-clinical Data : » Demographics Sheet» Insurance information» Driver's license» Consent and authorization forms» Emergency contacts You are going to love how the EHR organizes all of these content fields for you. All of these content areas are housed in data fields so they are searchable. In EHR training, you learn how to put the right information in the right place so that the right person can access it at the right time. All of us develop storage habits while functioning in the paper world - most of them we don't want to carry over into the EHR. In a data management assessment, look for the following: How often does the same lab result get filed into the patient record? How many times do you duplicate a patient record when you can't find the original? And do you know which file is the original? How often does health information get filed into the wrong folder? As paper comes in to the practice, is it stored chronologically, or is it indexed? The next assessment area is to know how you document the encounter. **How Do You Collect Data?** Paper records have been both a point of contention (Who has Mrs. Jones' file?) as well as a comfort zone for physicians who are accustomed to writing. The traditional pen and paper process of capturing clinical notes does not have to be a major challenge for the staff and physicians during the transition. Start by making a list of how your providers prefer to create content. Most likely this includes handwritten notes, typing, and dictation. In an EHR, clinical information still goes into the medical record, but it now is captured electronically in one or more of the following ways: » Point and click templates using drop down menus» Free text (typing)» Handwriting recognition (using a stylus)» Medical imaging and graphics (drawings built in the software for markup with a stylus)» Speech recognition using software» Digital voice dictation using a transcriptionist The physician leadership may say, "we're all going to learn to type," but to the typical visual learner, that means hunt and peck - head down focused on the keyboard rather than maintaining eye contact with the patient - lost productivity. Instead, start with where you are. For clinicians who want to continue dictation, consider voice recognition software or electronic dictation. Physicians who want to keep writing can learn how to use a stylus instead of a pen. Other physicians type the encounter into the EHR outside the exam room where you also may be generating lab orders and writing prescriptions. Point and click and/or drop down templates and free text are standard in all EHRs, but handwriting, speech recognition and digital dictation require additional licensing fees for the software, well worth the cost to maintain the clinician's productivity. ### Word of the Day: Evidence-Based Practice Center URL: https://hipaa.com/word-of-the-day-evidence-based-practice-center/ Last updated: 2009-04-29T17:00:40.000Z **Evidence-Based Practice Center**: Institution contracted under Agency for Healthcare Research and Quality (AHRQ) to develop evidence reports and technology assessments on topics relevant to clinical, social science/behavioral, economic, and other health care organization and delivery issues. ### Facility Access Controls: Maintenance Records-What to Do and How to Do It URL: https://hipaa.com/facility-access-controls-maintenance-records-what-to-do-and-how-to-do-it/ Last updated: 2009-04-29T13:00:35.000Z In our series on the HIPAA Administrative Simplification Security Rule, this is the fourth implementation specification for the Physical Safeguard Standard, Facility Access Controls. This implementation specification is addressable. Remember, addressable does not mean “optional.” Rather, an addressable implementation specification means that a covered entity must use reasonable and appropriate measures to meet the standard. As we have noted in earlier postings on HIPAA.com, business associates of covered entities will be required to comply with the Security Rule safeguard standards, beginning February 17, 2010\. This requirement is one of the HITECH Act provisions of the American Recovery and Reinvestment Act ARRA, signed by President Obama on February 17, 2009. **What to Do** Implement policies and procedures to document repairs and modifications to the physical components of a facility which are related to security (for example, hardware, walls, doors, and locks). **How to Do It** The Security Official is responsible for ensuring that this implementation specification is in place. The Security Official should create and maintain a log and a description of repairs or modifications made to the covered entity’s physical security components. The log should document in writing any action taken in that regard. The Security Rule requires that that log be maintained for a period of six years after completion of each maintenance action regarding physical security. The log may be maintained in electronic format, but the log retention time requires that electronic logs be routinely backed up. ### Red Flags Rules Compliance Countdown: 2 days URL: https://hipaa.com/red-flags-rules-compliance-countdown-2-days/ Last updated: 2009-04-29T13:00:06.000Z The Federal Trade Commission's (FTC's) red flags rules for financial institutions and creditors to fight identity theft require compliance by most healthcare providers on Friday, May 1, 2009. See [this post](http://www.hipaa.com/2009/04/ftcs-red-flags-rule-to-prevent-identity-theft-requires-compliance-by-healthcare-providers-on-friday-may-1-2009/?ref=hipaa.com) for more information on how to prepare for Friday's deadline. ### Word of the Day: PHR URL: https://hipaa.com/word-of-the-day-phr/ Last updated: 2009-04-28T18:00:57.000Z **Personal health record (PHR)**: The health care consumer's health information record, which they own and manage. Sharing or allowing access is based on the patient's consent/permission. ### Facility Access Controls: Access Control and Validation Procedures-What to Do and How to Do It URL: https://hipaa.com/facility-access-controls-access-control-and-validation-procedures-what-to-do-and-how-to-do-it/ Last updated: 2009-04-28T13:30:58.000Z In our series on the HIPAA Administrative Simplification Security Rule, this is the third implementation specification for the Physical Safeguard Standard, Facility Access Controls. This implementation specification is addressable. Remember, addressable does not mean “optional.” Rather, an addressable implementation specification means that a covered entity must use reasonable and appropriate measures to meet the standard. As we have noted in earlier postings on HIPAA.com, business associates of covered entities will be required to comply with the Security Rule safeguard standards, beginning February 17, 2010\. This requirement is one of the HITECH Act provisions of the American Recovery and Reinvestment Act ARRA, signed by President Obama on February 17, 2009. **What to Do** Implement procedures to control and validate a person’s access to facilities based on their role or function, including visitor control, and control of access to software programs for testing and revision. **How to Do It** The Security Official is responsible for ensuring that this implementation specification is in place. The covered entity should establish a plan that identifies who controls access to the covered entity’s facility, and which persons have authorized access to software and systems that contain electronic protected health information. In most covered entities, the plan will define access based on function and need. Again, function and need will be outcomes of the risk analysis, and will be inputs to workforce members’ job descriptions that are part of the Security Rule’s Administrative Safeguard Procedures. Scalability is a factor in determining function and need, as covered entities with small workforces may have broader function and need assignments than large covered entities with workforce members who specialize in narrower tasks. Vendors—especially software and hardware vendors—may play key roles in the business operations of a covered entity, such as maintaining and updating systems periodically. It is essential that such vendors operate under a business associate agreement with the covered entity. The covered entity’s Security Official is responsible for ensuring that such vendors are aware of and adhere to the covered entity’s security policies and procedures. As mentioned above, business associates will be required to comply with the Security Rule beginning February 17, 2010. At a minimum, a covered entity should adopt the following procedures to meet this implementation specification: » Institute a visitor sign-in and badge system for the covered entity. » Verify a person’s authorization to access the covered entity’s electronic systems that contain electronic protected health information. » Escort visitors in areas containing access to electronic protected health information if there is a reason for visitors (e.g., business associate vendors) to be in such areas. » Control workforce member access and movement within the covered entity in areas containing access to electronic protected health information. ### Red Flags Rules Compliance Countdown: 3 days URL: https://hipaa.com/red-flags-rules-compliance-countdown-3-days/ Last updated: 2009-04-28T13:00:43.000Z The Federal Trade Commission's (FTC's) red flags rules for financial institutions and creditors to fight identity theft require compliance by most healthcare providers on Friday, May 1, 2009. See [this post](http://www.hipaa.com/2009/04/ftcs-red-flags-rule-to-prevent-identity-theft-requires-compliance-by-healthcare-providers-on-friday-may-1-2009/?ref=hipaa.com) for more information on how to prepare for Friday's deadline. ### Word of the Day: Integrated System URL: https://hipaa.com/word-of-the-day-integrated-system/ Last updated: 2009-04-27T19:00:38.000Z **Integrated System**: In an EMR, the vendor builds the system using the same characteristics arranged in the broad categories of data issues, application issues, presentation issues, and operational issues. Systems built in this way are often referred to as a Single Source solution. ### FTC's "Red Flags" Rule to Prevent Identity Theft Requires Compliance by Healthcare Providers on Friday, May 1, 2009 URL: https://hipaa.com/ftcs-red-flags-rule-to-prevent-identity-theft-requires-compliance-by-healthcare-providers-on-friday-may-1-2009/ Last updated: 2026-10-24T21:35:23.000Z The Federal Trade Commission's (FTC's) "red flags" rules for financial institutions and creditors to fight identity theft require compliance by most healthcare providers on Friday, May 1, 2009\. HIPAA.com recommends that healthcare providers examine three documents, which we have available at HIPAA.com, to determine their responsibilities with respect to compliance with the red flag rules. These documents are: » [Identity Theft Red Flag Flags and Address Discrepancies Under the Fair and Accurate Credit Transactions Act of 2003](https://hipaa.com/content/files/2026/10/071109redflags.pdf "Identity Theft Red Flags and Address Discrepancies Under the Fair and Accurate Credit Transacations Act of 2003; Final Rule"); Final Rule, published in the Federal Register on November 9, 2007\. The preamble of the Final Rule, which discusses the purpose, intent, and scope of coverage, appears on pages 63718-63733\. Of particular importance are pages 63771-63774, which is the text of the FTC Final Rule. » [Fighting Fraud With the Red Flags Rule: A How-To Guide for Business](https://hipaa.com/content/files/2026/10/bus23.pdf "Fighting Fraud with the Red Flags Rule"), published by the FTC in March 2009.\* The 'Red Flags' Rule: What Health Care Providers Need to Know About Complying with New Requirements for Fighting Identity Theft, published by the FTC's Steven Toporoff, Attorney, FTC's Division of Privacy and Identity Protection, in April 2009. The following is an excerpt from [Toporoff's The 'Red Flags' Rule article](http://www.ftc.gov/bcp/edu/pubs/articles/art11.shtm?ref=hipaa.com), in the section entitled: Who Must Comply, that discusses conditions under which healthcare providers would be covered by the Rule: "Every healthcare organization and practice must review its billing and payment procedures to determine if it's covered by the Red Flags Rule. Whether the law applies to you isn't based on your status as a healthcare provider, but rather on whether your activities fall within the law's definition of two key terms: 'creditor' and 'covered account.' "Healthcare providers may be subject to the Rule if they are 'creditors.' Although you may not think of your practice as a 'creditor' in the traditional sense of a bank or mortgage company, the law defines 'creditor' to include any entity that regularly defers payments for goods or services or arranges for the extension of credit. For example, you are a creditor if you regularly bill patients after the completion of services, including for the remainder of medical fees not reimbursed by insurance. Similarly, healthcare providers who regularly allow patients to set up payment plans after services have been rendered are creditors under the Rule. Healthcare providers are also considered creditors if they help patients get credit from other sources—for example, if they distribute and process applications for credit accounts tailored to the healthcare industry. "On the other hand, healthcare providers who require payment before or at the time of service are not creditors under the Red Flags Rule. In addition, if you accept only direct payment from Medicaid or similar programs where the patient has no responsibility for the fees, you are not a creditor. Simply accepting credit cards as a form of payment at the time of service does not make you a creditor under the Rule. "The second key term—'covered account'—is defined as a consumer account that allows multiple payments or transactions or any other account with a reasonably foreseeable risk of identity theft. The accounts you open and maintain for your patients are generally 'covered accounts' under the law. If your organization or practice is a 'creditor' with 'covered accounts,' you must develop a written identity Theft Prevention Program to identify and address the red flags that could indicate identity theft in those accounts." Now, we refer you to the endnotes in Fighting Fraud With the Red Flags Rule business guide for definitions of identity theft and identifying information: » Identity Theft. "\[A\] fraud committed or attempted using the identifying information of another person without authority. » Identifying Information. "'\[A\]ny name or number that may be used, alone or in conjunction with any other information, top identify a specific person, including any— 1\. Name, Social Security number, date of birth, official State or government issued driver's license or identification number, alien registration number, government passport number, employer or taxpayer identification number; 2\. Unique biometric data, such as fingerprint, voice print, retina or iris image, or other unique physical representation; 3\. Unique electronic identification umber, address, or routing code; or 4\. Telecommunication identifying information or access device (as defined in 18 U.S.C. 1029(e)).'" If you are familiar with the HIPAA Administrative Simplification Privacy and Security Rules, you will note that these identifiers also are pertinent to the definition of protected health information in oral, written, or electronic formats. Again, we refer you to the Fighting Fraud With the Red Flags Rule business guide for an outline of a Four Step Process for compliance with the red flags rule. These steps, outlined here and in more detail in the business guide, are: 1\. Identify Relevant Red Flags. Identify the red flags of identity theft you're likely to come across in your business. 2\. Detect Red Flags. Set up procedures to detect those red flags in your day-to-day operations. 3\. Prevent and mitigate identity theft. If you spot the red flags you've identified, respond appropriately to prevent and mitigate the harm done. 4\. Update your Program. The risks of identity theft can change rapidly, so it's important to keep your Program current and educate your staff. As a healthcare covered entity, you will note that these steps accord with the risk analysis that a covered entity is required to complete and update periodically as part of the HIPAA Security Rule. As such, for information on conducting a risk analysis, HIPAA.com recommends that you consult the excellent An Introductory Resource Guide for Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule, National Institute of Standards and Technology (NIST) Special Publication 800-66 Revision 1 (October 2008), which is available for download on HIPAA.com under "Security". ### Identity Theft Red Flags and Address Discrepancies URL: https://hipaa.com/identity-theft-red-flags-and-address-discrepancies/ Last updated: 2009-04-27T14:33:26.000Z DEPARTMENT OF THE TREASURY 12 CFR Part 41, 222, 334, 364, 571 and 717 16 CFR Part 681 Idendity Theft Red Flags and Address Discrepancies Under the Fair and Accurate Credit Transactions Act of 2003 AGENCY: Office of the Secretary, HHS. ACTION: Joint Final Rules and Guidelines. - [Download](http://www.hipaa.com/wp-content/uploads/2009/04/071109redflags.pdf?ref=hipaa.com) (Requires [Acrobat Reader](http://get.adobe.com/reader/?ref=hipaa.com)) ### Facility Access Controls: Facility Security Plan-What to Do and How to Do It URL: https://hipaa.com/facility-access-controls-facility-security-plan-what-to-do-and-how-to-do-it/ Last updated: 2009-04-27T13:00:17.000Z In our series on the HIPAA Administrative Simplification Security Rule, this is the second implementation specification for the Physical Safeguard Standard, Facility Access Controls. This implementation specification is addressable. Remember, addressable does not mean “optional.” Rather, an addressable implementation specification means that a covered entity must use reasonable and appropriate measures to meet the standard. As we have noted in earlier postings on HIPAA.com, business associates of covered entities will be required to comply with the Security Rule safeguard standards, beginning February 17, 2010\. This requirement is one of the HITECH Act provisions of the American Recovery and Reinvestment Act ARRA, signed by President Obama on February 17, 2009. **What to Do** Implement policies and procedures to safeguard the facility and the equipment therein from unauthorized physical access, tampering, and theft. **How to Do It** The Security Official is responsible for ensuring that this implementation specification is in place. The covered entity must develop procedures to protect its facility and systems from “unauthorized physical access, tampering, and theft.” These policies and procedures are outcomes of the covered entity’s risk analysis pertaining to unauthorized access to its facility. Unauthorized access includes access to building exteriors and interiors, tampering, theft, intrusions, and deliberate impairment of systems, including computers and electricity supply. The facility security plan should include procedures to safeguard these and other unauthorized access threats and vulnerabilities identified in the risk analysis. Safeguards could include locks, alarm systems, identification systems (e.g., passcard or biometric systems), anti-intrusion systems, suitable to the covered entity’s business environment and operations. Appropriate procedures do not “preclude the use of electronic security systems in lieu of, or in combination with, physical security systems.” \[68 Federal Register 8353\] After hours, a covered entity in a single business dwelling may find an electronic detection, alarm, and lock system sufficient, whereas a covered entity in a multiple business office dwelling with entrance guard security may find strong locks on the doors sufficient. During business hours, workforce members strategically placed may be sufficient safeguards of a covered entity’s facility. Remember, in any business environment, the receptionist plays a key role in detecting access—authorized and unauthorized—to physical facility systems and ensuring that only authorized persons have access to electronic protected health information. Whatever the solution, if should be an outcome of the risk analysis. ### Word of the Day: Security Incident URL: https://hipaa.com/word-of-the-day-security-incident/ Last updated: 2009-04-24T18:03:05.000Z **Security Incident:** The attempted or successful unauthorized access, use, disclosure, modification, or destruction of information or interference with system operations in an information system. ### Facility Access Controls: Contingency Operations-What to Do and How to Do It URL: https://hipaa.com/facility-access-controls-contingency-operations-what-to-do-and-how-to-do-it/ Last updated: 2009-04-24T14:00:31.000Z In our series on the HIPAA Administrative Simplification Security Rule, this is the first implementation specification for the Physical Safeguard Standard, Facility Access Controls. This implementation specification is addressable. Remember, addressable does not mean “optional.” Rather, an addressable implementation specification means that a covered entity must use reasonable and appropriate measures to meet the standard. As we have noted in earlier postings on HIPAA.com, business associates of covered entities will be required to comply with the Security Rule safeguard standards, beginning February 17, 2010\. This requirement is one of the HITECH Act provisions of the American Recovery and Reinvestment Act ARRA, signed by President Obama on February 17, 2009. **What to Do** Establish (and implement as needed) procedures that allow facility access in support of restoration of lost data under the disaster recovery plan and emergency mode operations plan in the event of an emergency. **How to Do It** The Security Official is responsible for ensuring that this implementation specification is in place. The covered entity must develop procedures to restore electronic protected health information should it experience a disaster or an emergency related to its physical premises. The covered entity should coordinate these procedures with the disaster and emergency operations plans as part of the Contingency Plan—the seventh Administrative Safeguard standard of the Security Rule. In its risk analysis, the covered entity should catalog and prioritize the types of threats and vulnerabilities that might impact facility access, and develop procedures to mitigate those threats and vulnerabilities. These procedures, as outputs of the risk analysis, will provide inputs to the Contingency Operations implementation specification. For example, in the event of a fire, what would your covered entity have as emergency procedures? Where would your covered entity relocate in temporary offices? As another example, what would your covered entity do in the event of a power failure that damaged your covered entity’s computer systems? How and where would your covered entity restore power and access to electronic protected health information? The key consideration is, in response to an emergency affecting internal or external parts of a covered entity’s premises, is restoration of systems and access to electronic protected health information. Accordingly, the contingency operations plan related to facilities should include designation of key personnel from the workforce and business associates, as appropriate, to handle the emergency or disaster, and ensuring that such personnel have access to emergency facilities to restore business operations and systems. Remember, safeguarding electricity is the key element in providing access to electronic protected health information. Contingency operations, as reflected in this implementation specification, must focus on this safeguard and restoring electrical power if it is lost. ### Facility Access Controls: What This HIPAA Security Rule Physical Safeguard Standard Means URL: https://hipaa.com/facility-access-controls-what-this-hipaa-security-rule-physical-safeguard-standard-means/ Last updated: 2009-04-23T13:30:36.000Z This is the first Physical Safeguard Standard of the HIPAA Administrative Simplification Security Rule. It has four implementation specifications: contingency operations; facility security plan; access control and validation procedures; and maintenance records. Each of these implementation specifications is addressable. Addressable does not mean “optional.” Rather, an addressable implementation specification means that a covered entity must use reasonable and appropriate measures to meet the standard. As we have noted in earlier postings on HIPAA.com, business associates of covered entities will be required to comply with the Security Rule safeguard standards, beginning February 17, 2010\. This requirement is one of the HITECH Act provisions of the American Recovery and Reinvestment Act ARRA, signed by President Obama on February 17, 2009. The Security Official is responsible for ensuring that this implementation specification is in place. Facility access controls require that a covered entity implements policies and procedures to limit physical access to its electronic protected health information systems and the facility or facilities in which they are housed, while ensuring that properly authorized access is allowed. The policies and procedures should control access to and within the physical premises of the covered entity. The four implementation specifications listed above, each of which will be covered in a separate posting, are “applicable to an entity’s business location or locations,” and the facility at each location “includes physical premises and the interior and exterior of a building.” \[68 Federal Register 8353 and 8354, respectively\] A covered entity will develop and apply policies and procedures for each of the addressable implementation specifications based on outcomes of the covered entity’s risk analysis and other factors, such as how each physical safeguard facility access controls implementation specification relates to technical and administrative safeguards policies and procedures, and especially to the covered entity’s disaster recovery plan. Another factor for consideration relates to whether a covered entity’s premises are located in single business dwellings or in a multiple business office dwellings. A covered entity in a single business dwelling must implement the standard so that the physical premises are protected, internally and externally. Covered entities in multiple business office structures must implement the standard, taking into consideration, that it “retains responsibility for considering facility security even where it shares space within a building with other organizations. Facility security measures taken by a third party must be considered and documented in the covered entity’s facility security plan, when appropriate.” \[68 Federal Register 8353\] Accordingly, a covered entity in a multiple business office structure should acquire a copy of the landlord’s building security plan and include it in the covered entity’s security plan as an exhibit or appendix item. The covered entity’s physical security plan should incorporate provisions of the landlord’s building security plan by reference. ### Physical Safeguard Standards of the HIPAA Administrative Simplification Security Rule URL: https://hipaa.com/physical-safeguard-standards-of-the-hipaa-administrative-simplification-security-rule/ Last updated: 2009-04-22T14:00:03.000Z There are four physical safeguard standards: facility access controls, workstation use, workstation security, and device and media controls. Each standard has implementation specifications, which can be required or addressable. Remember, addressable does not mean “optional.” Rather, an addressable implementation specification means that a covered entity must use reasonable and appropriate measures to meet the standard. As we have noted in earlier postings on HIPAA.com, business associates of covered entities will be required to comply with the Security Rule safeguard standards, beginning February 17, 2010\. This requirement is one of the HITECH Act provisions of the American Recovery and Reinvestment Act ARRA, signed by President Obama on February 17, 2009. Physical safeguard standards pertain to a covered entities physical location (facility), who has access to the facility and when, how hardware and software systems are protected and used in the facility, how electronic protected health information is safeguarded on hardware in the facility, how records of electronic protected health information are properly disposed of, and how media containing such records are used and reused after disposal of records of electronic protected health information. We cover the four physical safeguard standards and their 10 implementation specifications in 12 postings. ### FTC Posts NPRM on Breach Notification Rule for e-Health Information URL: https://hipaa.com/ftc-posts-nprm-on-breach-notification-rule-for-e-health-information/ Last updated: 2026-10-24T21:35:25.000Z On April 17, 2009, the Federal Trade Commission issued a notice of proposed rulemaking that requires vendors of personal health records and related entities such as non-profit organizations that offer PHRs, to notify individuals when the security of their individually identifiable health information is breached. The NPRM seeks to conform with rules from HHS that safeguard protected health information, but the FTC proposed rule applies to non HIPAA-covered entities that are not subject to HIPAA privacy and security requirements. Of the many comments the FTC seeks is to identify entities that would fall under this ruling. We believe this rule will strengthen the trust consumers/patients have in sharing information in their PHRs with their health care providers. Major players entering the PHR market such as Google and Microsoft in March 2009 said HIPAA Privacy and Security Rules did not apply to them, but comments on the FTC's NPRM may assist in helping the technology giants rethink compliance with privacy and security. What do you think? You can read the NPRM [here](https://hipaa.com/content/files/2026/10/r911002healthbreach.pdf). Make comments to the NPRM [here](https://secure.commentworks.com/ftc-healthbreachnotification/?ref=hipaa.com): **FTC Publishes Proposed Breach Notification Rule for Electronic Health Information** The American Recovery and Reinvestment Act of 2009 (the Recovery Act) includes provisions to advance the use of health information technology and, at the same time, strengthen privacy and security protections for health information. ARRA recognized new types of Web-based entities that collect or handle consumers' sensitive health information. Some offer personal health records, which consumers can use as an electronic, individually controlled repository for their medical information, a real plus for patients managing chronic illnesses such as diabetes and heart conditions. Other online applications help consumers track and manage information in their personal health records, such as connecting a pedometer to computers and uploading miles traveled, heart rate, and other data. Patients with cancer can enter chemotherapy regimens, scheduled appointments, tumor staging, and recovery plans, a critical tool for cancer survivors. These innovations have the potential to provide numerous benefits for consumers, which can only be realized if they have confidence that the security and confidentiality of their health information will be maintained. In keeping with the Recovery Act, the proposed rule requires vendors of personal health records and related entities to provide notice to consumers following a breach. The proposed rule also stipulates that if a service provider to one of these entities experiences a breach, it must notify the entity, which in turn must notify consumers of the breach. The proposed rule contains additional requirements governing the standard for what triggers the notice, as well as the timing, method, and content of notice. It also requires entities covered by the proposed rule to notify the FTC of any breaches. The FTC can then post information about the breaches on its Web site, and notify the Secretary of Health and Human Services. With respect to the scope of the proposed rule, the Commission seeks comment on (1) the nature of entities to which its proposed rule would apply; (2) the particular products and services they offer; (3) the extent to which vendors of personal health records, PHR related entities, and third party service providers may be HIPAA-covered entities or business associates of HIPAA-covered entities; (4) whether some vendors of personal health records may have a dual role as a business associate of a HIPAA-covered entity and a direct provider of personal health records to the public; and (5) circumstances in which such a dual role might lead to consumers' receiving multiple breach notices or receiving breach notices from an unexpected entity, and whether and how the rule should address such circumstances. ### Evaluation-What This HIPAA Security Rule Administrative Safeguard Standard Means URL: https://hipaa.com/evaluation-what-this-hipaa-security-rule-administrative-safeguard-standard-means/ Last updated: 2009-04-20T13:00:21.000Z This is the eighth Administrative Safeguard Standard of the HIPAA Administrative Simplification Security Rule. Its implementation specification is embodied in the language of the standard itself, and it is required of covered entities. Further, as HIPAA.com has noted earlier, business associates also will be required to comply with the Security Rule standards, effective February 17, 2010, as provided for in the HITECH Act provisions of the American Recovery and Reinvestment Act, signed by President Obama on February 17, 2009. **What is Required** Perform a periodic technical and non-technical evaluation, based initially upon the standards implemented under this rule and subsequently, in response to environmental or operational changes affecting the security of electronic protected health information, that establishes the extent to which an entity's security policies and procedures meet the requirements of Security Standards for the Protection of Electronic Protected Health Information. **Implementation Specification** Periodically evaluate the covered entity's technical and non-technical security policies and procedures. **What This Means for the Covered Entity** The covered entity must be proactive in analyzing risks to electronic protected health information and its business operations as risks and its business environment changes. For example, if a covered entity updates its electronic hardware from a single workstation to multiple workstations on a network, its risk profile likely will change. Evaluation and vigilance on a regular basis are key attributes of risk mitigation. A covered entity should evaluate its security policies and procedures at least annually and when it experiences a change in its electronic systems and their configuration. The goal is for the covered entity to consistently maintain acceptable levels of risk related to safeguarding of electronic protected health information, based on the covered entity's evaluation of risks. If the covered entity determines that levels of risk are not acceptable, the covered entity is required to initiate changes to achieve acceptable levels of risk. **What to Do** A covered entity must decide how it will perform its evaluation responsibilities under the Security Rule. It could do the evaluation internally or outsource that responsibility to a third party business associate, such as an accreditation entity. **How to Do It** The covered entity's Security Official should prepare an evaluation plan. The plan format can be based on the risk analysis format used in the initial required risk assessment. This format also can be used for subsequent evaluations of risk exposures and changes in risk due to changes in electronic systems or business operations. For an internal evaluation, the Security Official can create an evaluation committee of workforce members and designate evaluative tasks and functions to key committee members for scheduled review to ensure compliance with the Security Rule evaluation standard. The Security Rule recognizes in the preamble to the final rule that cost may be a consideration in how a covered entity chooses to evaluate its protection of electronic protected health information. This may be an important consideration for relatively small covered entities, but it does not eliminate the requirement to comply. An important resource to use for the covered entity to use for its internal evaluation, or to recommend to a third party business associate for use in an external evaluation, is from the National Institute of Standards and Technology (NIST): [*An Introductory Resource Guide for Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule*, NIST Special Publication 800-66, Revision 1\. October 2008](http://static.hipaa.com/documents/SP-800-66-Revision1.pdf?ref=hipaa.com). Remember, acceptable levels of risk in one covered entity may be unacceptable in another covered entity. Hence, evaluation underpins the initial risk analysis and ongoing assessment of risks, and is the means for a covered entity to ensure that it safeguards its electronic protected health information at an acceptable risk level. ### HITECH Guidance & RFI URL: https://hipaa.com/hitech-guidance-rfi/ Last updated: 2026-10-24T21:35:28.000Z HITECH GUIDANCE & RFI 45 CFR Parts 160 and 164 AGENCY: Office of the Secretary, Department of Health and Human Services. - [Download](https://hipaa.com/content/files/2026/10/hitechrfi.pdf) (Requires [Acrobat Reader](http://get.adobe.com/reader/?ref=hipaa.com)) ### Pay attention to HITECH Act Definition of Breach: Lost Customers Big Cost Factor URL: https://hipaa.com/pay-attention-to-hitech-act-definition-of-breach-lost-customers-big-cost-factor/ Last updated: 2009-04-16T12:38:58.000Z The April 2009 issue of Baseline magazine has an article by Corinne Bernstein entitled: "The Cost of Data Breaches," which is available online at [www.baselinemag.com](http://www.baselinemag.com/c/a/Security/The-Cost-of-Data-Breaches-380742/?ref=hipaa.com). We recommended that covered entities and business associates review this article, based on a Ponemon Institute study of incidents and costs incurred at 43 organizations in 17 industry sectors. Here are several highlights: » "Lost business accounted for nearly 70 percent of a data breach in 2008\. » "\[S\]ectors suffering the highest customer losses were health care...and financial services. » "The biggest cause of breaches...is insider negligence...88% of all cases in 2008\. » "The number of breaches involving third-party organizations continues to climb." The article concludes with the following quotation: "'Organizations are getting better at detecting breaches,' says the institute's Larry Ponemon. 'But to reduce the incidence of data breaches, they need to use better security technologies, such as encryption and identity access management, and they must provide more training to their employees.'" The HITECH Act, signed into law by President Obama on February 17, 2009, as part of the American Recovery and Reinvestment Act, has a new definition of "breach" and requires business associates of covered entities to comply fully with the HIPAA Administrative Simplification Security Rule beginning February 17, 2010\. The new definition of breach follows and the Security Rule is available on the HIPAA.com Web site. If you are a healthcare covered entity or business associate, you need to read and understand this April 2009 Baseline magazine article. A data breach will cost an affected organization big dollars, customer losses, and maybe the business as well. HITECH Act Definition of (1) Breach (A) In General. The term 'breach' means the unauthorized acquisition, access, use, or disclosure of protected health information which compromises the security or privacy of such information, except where an unauthorized person to whom such information is disclosed would not reasonably have been able to retain such information. (B) Exceptions. The term 'breach' does not include- (i) Any unintentional acquisition, access, or use of protected health information by an employee or individual acting under the authority of a covered entity or business associate if- (I) Such acquisition, access, or use was made in good faith and within the course and scope of the employment or other professional relationship of such employee or individual, respectively, with the covered entity or business associate; and (II) Such information is not further acquired, accessed, used, or disclosed by any person; or (ii) Any inadvertent disclosure from an individual who is otherwise authorized to access protected health information at a facility operated by a covered entity or business associate to another similarly situated individual at same facility; and (iii) Any such information received as a result of such disclosure is not further acquired, accessed, used, or disclosed without authorization by any person. ### Word of the Day: EHR URL: https://hipaa.com/word-of-the-day-ehr/ Last updated: 2009-04-15T18:53:06.000Z **Electronic health record** **(EHR):** A secure, real-time, interoperable point-of-care, patient-centric information resource for clinicians. The EHR aids clinicians in decision making by providing access to patient health record information where and when they need it and by incorporating evidence-based decision support. The EHR automates and streamlines the clinicians' workflow, closing loops in communication and response that result in delays or gaps in care. The EHR also supports the collection of data for uses other than direct clinical care, such as billing, quality management, outcomes reporting, resource planning, and public health disease surveillance and reporting. ### Kudos to DOQ-IT URL: https://hipaa.com/kudos-to-doq-it/ Last updated: 2009-04-14T13:00:49.000Z Praise goes out to the Doctors Office Quality - Information Technology (DOQ-IT) centers that worked tirelessly to assist physicians select and implement electronic health records. Effective April 16, 2009, DOQ-IT will end. Access to all DOQ-IT-related programming and resources on QualityNet (e.g., online registration, data submission, reports) will end **April 16, 2009**, at **5 p.m. Central Time**. We have had the pleasure of working with most of the DOQ-IT program leaders, building substantial friendships. We hope that their work will be a strong impetus to build on as physicians continue to select, implement and thrive in a health IT environment. ### Contingency Plan: Applications and Data Criticality Analysis-What to Do and How to Do It URL: https://hipaa.com/contingency-plan-applications-and-data-criticality-analysis-what-to-do-and-how-to-do-it/ Last updated: 2009-04-09T13:30:32.000Z In our series on the HIPAA Administrative Simplification Security Rule, this is the fifth implementation specification for the Administrative Safeguard Standard (Contingency Plan). This implementation specification is *addressable*. Remember, addressable does not mean "optional." Rather, an addressable implementation specification means that a covered entity must use reasonable and appropriate measures to meet the standard. As HIPAA.com has noted in earlier postings, with enactment of the American Recovery and Reinvestment Act of 2009 (ARRA) on February 17, 2009, business associates also will be required to comply with the Security Rule standards, effective February 17, 2010. **What to Do** Assess the relative criticality of specific applications and data in support of other contingency plan components. **How to Do It** A covered entity will assign priorities to its contingency plan decisions and actions. These priorities initially will be outputs of the risk analysis, and thereafter reviewed as part of periodic reassessment of threats and vulnerabilities. Priorities will be a function of the following: » What are the most important steps in safeguarding the covered entity's electronic systems and electronic protected health information. » Where are the covered entity's most vulnerable points with regard to electronic systems and electronic protected health information. » What are the covered entity's biggest threats to electronic systems and electronic protected health information. » What are steps and in priority order for the covered entity to achieve recovery of electronic systems, electronic protected health information, and business operations in the event of a contingency. The Security Official in the covered entity should establish criteria for assessing the relative importance of vulnerabilities and threats as part of the risk analysis, and should prioritize steps in data backup, disaster recovery, and emergency mode operation plans for recovery of operations and safeguarding the covered entity's electronic systems and electronic protected health information. Remember, the Security Rule covers safeguarding of *electronic* systems and *electronic* protected health information. As a result, loss of electricity is critical to the covered entity's applications and data and should have high priority in the covered entity's risk analysis outcomes and in its recovery plans. ### Contingency Plan: Testing and Revision Procedures-What to Do and How to Do It URL: https://hipaa.com/contingency-plan-testing-and-revision-procedures-what-to-do-and-how-to-do-it/ Last updated: 2009-04-08T13:30:07.000Z In our series on the HIPAA Administrative Simplification Security Rule, this is the fourth implementation specification for the Administrative Safeguard Standard (Contingency Plan). This implementation specification is *addressable*. Remember, addressable does not mean "optional." Rather, an addressable implementation specification means that a covered entity must use reasonable and appropriate measures to meet the standard. As HIPAA.com has noted in earlier postings, with enactment of the American Recovery and Reinvestment Act of 2009 (ARRA) on February 17, 2009, business associates also will be required to comply with the Security Rule standards, effective February 17, 2010. **What to Do** Implement procedures for periodic testing and revision of contingency plans. **How to Do It** Testing a revision procedures call for covered entities to develop and implement procedures for periodic testing and revision of the contingency plans discussed earlier for the Contingency Rule standard. The definition of *periodic*, relating to frequency of testing, will be an outcome of the covered entity's risk analysis. A covered entity that changes its electronic systems or requirements relatively often will need to test more frequently than a covered entity that has a more static technology environment. Similarly, a covered entity with a high turnover of workforce members or a relatively high frequency of emergency situations will need to test and review security safeguards more frequently than covered entities not experiencing those conditions. Testing is a measure of plan effectiveness. Testing should involve all workforce members, but should be conducted outside of normal business operation hours. During testing, the Security Official should document successes, identify any deficiencies that result in test failures for plan remediation and further workforce member training, and calculate response times to recovery plan provisions. After testing, the Security Official should revise the contingency plan to reflect any modifications, inform workforce members of modifications, and conduct necessary training. Testing of data backup, disaster recovery, and emergency mode operation plans should take place at least annually, with all actions documented in writing. The value of testing is that it permits the covered entity to evaluate the effectiveness of its recovery efforts, especially if previous modifications have been adequately accounted for in training, response times, timely restoration of business operations, and safeguarding of electronic protected health information. ### Contingency Plan: Emergency Mode Operation Plan-What to Do and How to Do It URL: https://hipaa.com/contingency-plan-emergency-mode-operation-plan-what-to-do-and-how-to-do-it/ Last updated: 2009-04-07T13:30:44.000Z In our series on the HIPAA Administrative Simplification Security Rule, this is the third implementation specification for the Administrative Safeguard Standard (Contingency Plan). This implementation specification is *required*. As HIPAA.com has noted in earlier postings, with enactment of the American Recovery and Reinvestment Act of 2009 (ARRA) on February 17, 2009, business associates also will be required to comply with the Security Rule standards, effective February 17, 2010. **What to Do** Establish (and implement as needed) procedures to enable continuation of critical business processes for protection of the security of electronic protected health information while operating in the emergency mode. **How to Do It** Covered entities are required to develop and implement procedures for continuation of business operations and protection of electronic protected health information while operating in an emergency mode. Such procedures would include, but not be limited to, a plan for accessing safeguarded information systems and workstations in a timely manner to ensure availability of electronic protected health information. The covered entity will determine method and timeliness as risk mitigation outcomes of its risk analysis. Examples of emergency mode operations plan procedures that the covered entity's Security Official would implement include, but are not limited to: » Maintaining an alternate site to perform data processing functions in the event of a disaster. » Ensuring hardware and software compatibility at primary and backup sites. » Providing backup electrical power and communications in the event of an emergency. » Appointing workforce members to the emergency mode operations team. » Ensuring that appropriate business associate hardware/software vendors are aware of the covered entity's emergency mode operation plan and engaged in helping the covered entity recover, if required, in the event of an emergency. » Training workforce members in the emergency mode operations plan, including determining extent of emergency, invoking the plan, informing customers and business associates, and restoring business operations. » Testing periodically the emergency mode operations plan and making modifications, as necessary, as outlined in the next implementation specification of Contingency Planning. » Ensuring that all actions are documented in writing. Remember, a covered entity's loss of electricity for a sustained period of time should be considered a disaster. Accordingly, the covered entity's emergency mode operations plan needs to focus on restoring power as a major consideration in its plan for restoring business operations and safeguarding electronic protected health information. ### Contingency Plan: Disaster Recovery Plan-What to Do and How to Do It URL: https://hipaa.com/contingency-plan-disaster-recovery-plan-what-to-do-and-how-to-do-it/ Last updated: 2026-10-24T21:35:29.000Z In our series on the HIPAA Administrative Simplification Security Rule, this is the second implementation specification for the Administrative Safeguard Standard (Contingency Plan). This implementation specification is *required*. As HIPAA.com has noted in earlier postings, with enactment of the American Recovery and Reinvestment Act of 2009 (ARRA) on February 17, 2009, business associates also will be required to comply with the Security Rule standards, effective February 17, 2010. **What to Do** Establish (and implement as needed) procedures to restore any loss of data. **How to Do It** The content and procedures of a covered entity's disaster recovery plan will be » Outcomes of the covered entity's identification of vulnerabilities and potential threats in the risk analysis. » Safeguards adopted by the covered entity to mitigate risks associated with those vulnerabilities and threats. » Responsibilities of the covered entity's key workforce members assigned by the Security Official to recover should a loss become a reality and a disaster occur. The covered entity should prepare a comprehensive, usable, and effective disaster recovery plan, which will take time and involve the entire workforce. A covered entity's loss of electricity for a sustained period of time should be considered a disaster, for which the covered entity has a plan for restoring business operations and safeguarding electronic protected health information. "The final \[Security\] rule calls for covered entities to consider how natural disasters could damage systems that contain electronic protected health information and develop policies and procedures for responding to such situations. We \[HHS\] consider this to be a reasonable precautionary step to take since in many cases the risk would be deemed to be low." \[68 *Federal Register* 8351\] Even though the probability of occurrence may be low, a covered entity should consider potential loss regarding any vulnerability or threat from a worst-case scenario. The next implementation specification focuses on an *emergency mode operation plan*. The disaster recovery plan should include how operations would be conducted in an emergency and which workforce members would be responsible for carrying out those operations. [Wikipedia](http://en.wikipedia.org/wiki/Disaster%5Frecovery?ref=hipaa.com) identifies resources to begin disaster recovery planning. Also, visit the National Institute of Standards and Technology Web site for disaster recovery planning help with NIST's *Contingency Planning Guide for Information Technology Systems*, available from [NIST](https://hipaa.com/content/files/2026/10/sp800-34.pdf). ### Direct Data Entry-No Change in the 5010 Final Rule URL: https://hipaa.com/direct-data-entry-no-change-in-the-5010-final-rule/ Last updated: 2009-04-03T13:00:34.000Z In the August 17, 2000 Final Rule for Standards for Electronic Transactions, direct data entry was defined as “direct entry of data (for example, using dumb terminals or web browsers) that is immediately transmitted into a health plan’s computer.” \[65 Federal Register 50367\] An exception for direct data entry was articulated in the August 17, 2000, Final Rule: A health care provider electing to use direct data entry offered by a health plan to conduct a transaction for which a standard has been adopted under this part must use the applicable data content and data condition requirements of the standard when conducting the transaction. The health care provider is not required to use the format requirements of the standard.” \[65 Federal Register 50369\] The Modifications to the Health Insurance Portability and Accountability Act (HIPAA) Final Rules, published January 16, 2009, which adopted Versions 5010 and D.0 of the Transactions Standard, for compliance by all healthcare covered entities January 1, 2012, addressed direct data entry, but did not alter the definition and exception for use quoted above. The January 16, 2009, Final Rule provided the following response in the preamble: “One commenter requested that we address expectations related to \[CFR\] Section 162.925\[b\] regarding health plan incentives to health care providers for using direct data entry (DDE) transactions. The commenter said there are instances where health plans offer more information about eligibility and benefit information on Web sites than they do through the standard X12 270/271 transactions, which the commenter believes is an incentive for a provider to conduct a transaction using some means other than the standard transaction. The commenter requested clarification regarding the offer of more information through a non-standard transaction, even though the standard transaction contains the required amount of information. Since we \[HHS\] did not address this issue in the proposed rule, we \[HHS\] do not respond here, but may provide additional direction in a future Frequently Asked Question \[FAQ\] on the CMS Web site.” \[74 Federal Register 3310\] Also, the HIPAA references in the HITECH provisions of the American Recovery and Reinvestment Act (ARRA) signed by President Obama on February 17, 2009, also did not further address direct data entry. Stay tuned! ### Contingency Plan: Data Backup-What to Do and How to Do It URL: https://hipaa.com/contingency-plan-data-backup-what-to-do-and-how-to-do-it/ Last updated: 2009-04-02T18:00:03.000Z In our series on the HIPAA Administrative Simplification Security Rule, this is the first implementation specification for the Administrative Safeguard Standard (Contingency Plan). This implementation specification is required. As HIPAA.com has noted in earlier postings, with enactment of the American Recovery and Reinvestment Act of 2009 (ARRA) on February 17, 2009, business associates also will be required to comply with the Security Rule standards, effective February 17, 2010. **What to Do** Establish and implement procedures to create and maintain retrievable exact copies of electronic protected health information. **How to Do It** Covered entities must backup electronic protected health information on a regular basis. When a computer system fails, it may be relatively easy to reinstall computer programs and recover software applications. However, it may be relatively difficult to recover or recreate electronic data that are lost from files that are damaged or from files whose filenames are detached from underlying data. A covered entity should consult with its computer and software vendors on implementing appropriate data backup routines. Prudence dictates having backup located offsite from the covered entity, even if the covered entity’s software accommodates exact-copy backup capability or it has an onsite data safe that is fire resistant and designed to protect electronic media from damage due to magnetism, heat, water, and air-borne contaminants such as smoke and dust. A covered entity’s choice of a backup system will depend on the size of the covered entity and the number of its business locations. Each facility is required to have its own backup plan implementation, which may be part of an overall covered entity strategy. A large covered entity may use a complex procedure, such as real-time encrypted data streaming or periodic batch duplicate download to a secure offsite location. A small covered entity might do a daily tape, CD, or DVD backup and maintain the electronic media offsite in a secure location. Outputs of the risk analysis will provide guidance on the type of data backup plan, which should be reviewed periodically. The covered entity should take into consideration that electronic data storage capacities grow, the relative costs of such storage decline, and the penalties for failure under the Security Rule were increased as part of the HITECH provisions in the American Recovery and Reinvestment Act (ARRA) signed by President Obama on February 17, 2009. ### Contingency Plan: Sample Policy and Procedures URL: https://hipaa.com/contingency-plan-sample-policy-and-procedures/ Last updated: 2009-04-02T13:02:45.000Z This is the seventh Administrative Safeguard Standard of the HIPAA Administrative Simplification Security Rule. It has five implementation specifications: Data backup plan; Disaster recovery plan; Emergency mode operation plan; Testing and revision procedures; and Applications and data criticality analysis. The first three are required; the last two are addressable. Addressable does not mean optional. Rather, an addressable implementation specification means that a covered entity must use reasonable and appropriate measures to meet the standard. Further, as HIPAA.com has noted earlier, business associates also will be required to comply with the Security Rule standards, effective February 17, 2010. HIPAA.com will outline What to do and How to do it for each of the five contingency plan implementation specifications. Here, we describe sample policy and procedures for contingency plan. The inputs for your contingency plan and each of the implementation specifications will be outputs of your covered entity’s risk analysis. **Sample Policy** Our covered entity responds to emergencies that may impair our computer systems and electronic protected health information. Workforce members are responsible for complying with these policies and procedures. **Sample Procedures** Our covered entity’s Security Official has identified key elements of our contingency plan. These are: Contingency Planning Group Our covered entity’s Security Official defines the mission of this contingency planning group, chairs the group, and assigns workforce members to the group. Operating Environment and Core Applications Examples may include, but are not limited to: electronic protected health information; application and database servers; telephone and other communication systems; operational business systems (e.g., patient scheduling systems, practice management systems, e-prescribing systems, claims adjudication systems, clearinghouse systems); internet systems and applications; email exchange servers; desktop systems; workstations, laptops, tablets, and personal data assistants (PDAs); network servers, scanners, and printers. Facility Locations Covered entity physical location(s) and contingency recovery sites, including secure offsite application, electronic protected health information database, and hardware locations. Key Covered Entity Workforce Members Responsible for Achieving Contingency Recovery Names and contact information for 24/7 accessibility; name of party or parties responsible for declaring a contingency and invoking contingency recovery plan; and outline of steps to achieve contingency recovery. ### Contingency Plan-What This HIPAA Security Rule Administrative Safeguard Standard Means URL: https://hipaa.com/contingency-plan-what-this-hipaa-security-rule-administrative-safeguard-standard-means/ Last updated: 2009-04-01T13:18:38.000Z This is the seventh Administrative Safeguard Standard of the HIPAA Administrative Simplification Security Rule. It has five implementation specifications: Data backup plan; Disaster recovery plan; Emergency mode operation plan; Testing and revision procedures; and Applications and data criticality analysis. The first three are *required*; the last two are *addressable*. Addressable does not mean optional. Rather, an addressable implementation specification means that a covered entity must use reasonable and appropriate measures to meet the standard. Further, as HIPAA.com has noted earlier, business associates also will be required to comply with the Security Rule standards, effective February 17, 2010. If a fire swept through a covered entity’s facility, the covered entity would need a plan to recover patient and billing files and to contact workforce members, patients, and business associate vendors to inform them of how it would stay in business. This standard requires covered entities to establish contingency plans to respond to emergencies that could adversely impact electronic protected health information. The list of potential emergencies needs to be compiled during the covered entity’s required risk analysis, and may include, but is not limited to, power outage, vandalism, system failure, theft, disk crash, fire, chemical spill, and natural disasters such as tornado, earthquake, flood, and hurricane. Contingency plans focus on safeguarding electronic protected health information and recovery for systems that may be impaired as the result of an emergency. With growing use of electronic business systems by covered entities, increasing attention must not only be placed on having a contingency plan, but also periodically testing and updating the plan. This Contingency Plan standard reflects the importance of that attention, to say nothing of the increased penalties for failure that are included in the HITECH provisions that were enacted as part of the American Recovery and Reinvestment Act (ARRA) signed by President Obama on February 17, 2009. The Contingency Plan standard requires covered entities to develop and implement data backup, disaster recovery, and emergency mode operation plans. Even in the absence of the required Contingency Plan standard of the Security Rule, it would be prudent business practice to do such development and implementation with electronic business systems. During the risk assessment, for preparation of the Contingency Plan by a covered entity, key questions would be: » What are likely losses that could occur, and from what source? » How would the covered entity’s customers be affected? » What impact would there be on a covered entity’s reputation from a loss? » What are likely costs associated with any loss? » What are efforts, costs, and time needed to recover? » What is the impact on the covered entity’s *viability as a business*? In general, the following steps will assist any covered entity develop and implement a Contingency Plan: » The covered entity establishes a contingency planning group in the covered entity, chaired by the Security Official. » The planning group assesses threats and vulnerabilities as part of the covered entity’s required risk analysis. » The planning group assigns priorities to threats and vulnerabilities that may impact computer systems and electronic protected health information. » The Security Official, with assistance of the planning group, develops policies and procedures for contingency recovery strategies. » The Security Official implements contingency recovery plans, discusses these plans with workforce members, trains key workforce members to implement plan provisions in the event of a contingency, and periodically tests workforce member compliance and performance with plan provisions. » The Security Official reviews and updates the covered entity’s contingency plans periodically. ### Business Associate To-Do List URL: https://hipaa.com/business-associate-to-do-list/ Last updated: 2009-03-17T14:00:28.000Z What are Business Associates Required to Do to Meet HIPAA Requirements? With passage of the American Recovery and Reinvestment Act (ARRA), privacy and security compliance increased significantly with business associates immediately required to comply directly with many of HIPAA’s rules. It also dramatically expanded other remedial actions (such as increasing federal government audits; granting attorneys fees in some HIPAA lawsuits; and allowing a method for individuals to recover penalties under HIPAA). Business associates also are subject to civil and criminal penalties , including a provision that allows individuals to receive financial compensation for the violation. If you are a business associate, your “To-Do” list looks similar to the list the covered entities complied with in 2004\. These tasks include: appointing a Security Official; developing written policies and procedures, including physical safeguards, (such as locking computers that contain EPHI), and technical safeguards (such as encrypting emails); and training workforce on how to protect electronic protected health information (“EPHI”). Also, effective immediately: » You are required to notify each individual affected by a security breach by mail, or if specified as preference, by email. » If you don’t have contact information for that individual, you may be required to post notice of the breach on your website, in newspapers, or other broadcast media. » For breaches involving more than 500 residents in one area, you must notify a “prominent media outlet.” » You also must contact the Department of Health and Human Services. DHHS is establishing a website listing these breaches. There is an exception for certain unintentional breaches. Consult a health law attorney if you have any questions or concerns about building your policies and procedures, or tasks assigned to the Security Official. Penalties for ePHI Violations | Violation | Penalty per Violation | Maximum per Year | | ------------------------------------- | --------------------- | ---------------- | | Reasonable cause, not willful neglect | $1,000 | | | Reasonable cause, corrected | $25,000 | $250,000 | | Reasonable cause, uncorrected | $50,000 | $1,500,000 | ### 5010/D.0 Effective Date Tuesday, March 17, 2009; Compliance Date January 1, 2012 URL: https://hipaa.com/5010d0-effective-date-tuesday-march-17-2009-compliance-date-january-1-2012/ Last updated: 2009-03-16T13:00:06.000Z The version modification to the HIPAA Administrative Simplification transaction standards becomes effective Tuesday, March 17, 2009\. Here are several critical things to know, drawn directly from the final rule published in the Federal Register on January 16, 2009\. The final rule is available for download on the HIPAA.com site. Effective Date: The effective date \[March 17, 2009\] is the date that the policies set forth in this final rule take effect, and new policies are considered to be officially adopted. \[74 Federal Register 3302\] Compliance Date: On January 1, 2012, all covered entities will have reached Level 2 compliance, and must be fully compliant in using Versions 5010 and D.0 exclusively. While we \[U.S. Department of Health and Human Services (HHS)\] have authorized contingency plans in the past, we do not intend to do so in this case, as such an action would likely adversely impact ICD\-10 implementation activities \[effective date, also March 17, 2009; compliance date, October 1, 2013\]. HIPAA gives us \[HHS\] authority to invoke civil money penalties against covered entities who do not comply with the standards, and we have been encouraged by industry to use our authority on a wider scale. \[74 Federal Register 3303\] ### New Director of Office of Recovery Act Coordination URL: https://hipaa.com/new-director-of-office-of-recovery-act-coordination/ Last updated: 2009-03-10T18:00:54.000Z Dennis Williams has been selected to be HHS’ Deputy Assistant Secretary for Recovery Act Coordination. Mr. Williams most recently served as Health Resources and Services Administration’s (HRSA) Deputy Administrator, a post he held from 2002-2009\. Prior to joining HRSA, Williams served as acting Assistant Secretary in HHS’ Office of the Assistant Secretary for Management and Budget (OASMB, currently ASRT) from 2001 to 2002\. From 1985-2001 he served as Deputy Assistant Secretary for Budget in OASMB. The Office of Recovery Act Coordination, which reports to the Assistant Secretary for Resources and Technology (ASRT), will ensure that the Act’s requirements and OMB’s guidance are followed, including: » Making sure that reporting due dates are met, » Maintaining a repository of official HHS ARRA information, » Establishing and tracking performance outcomes, mitigating risks, and » Keeping the public constantly informed through the web and other means of communication. This Office will coordinate and oversee all ARRA activities for the Department, and convene those involved in ARRA implementation to accomplish tasks in a timely manner. The Office will report to the Assistant Secretary for Resources and Technology (ASRT), since many of the Offices with which it needs to coordinate are within ASRT. Leadership will be provided by a new Deputy Assistant Secretary for Recovery Act Coordination. Most Recovery Act work will be completed by HHS Operating Divisions and the Office of the Secretary Staff Divisions, but this Office will have a dedicated staff to coordinate among the various organizations and prepare reports, updates, and compile official HHS Recovery Act material. ### One Week from Today: 5010/D.0 Final Rule Effective Date URL: https://hipaa.com/one-week-from-today-5010d0-final-rule-effective-date/ Last updated: 2009-03-10T14:20:45.000Z They’re coming: the Ides of March (the 14th); NCAA Basketball Tournament Announcement (the 15th); St. Patrick’s Day (the 17th); and 5010/D.0 Final Rule Effective Date (the 17th). If you are a covered entity, Level 1 testing begins Tuesday, March 17, 2009\. Here are five things you need to do to start. **Conduct a Gap Analysis.** What do I need to do to become compliant on January 1, 2012? That date sounds far off, but it will be here before you know it. Unlike previous transaction contingency periods for covered entities and their trading partners, HHS has indicated that there will be no tolerance for those not ready. Read the final rule, which is on the HIPAA.com site for your convenience. **Contact Your Software Vendor.** What is my vendor’s plan, in writing, for achieving internal Level 1 testing by December 31, 2010, and external Level 2 testing with my trading partners by December 31, 2011? HIPAA.com covered the requirements of Level 1 and Level 2 testing, which is available on the HIPAA.com site for your convenience. **Contact Your Trading Partners.** What are my trading partners’ plans for achieving Level 1 and Level 2 testing? The final rule permits covered entity-to-trading partner testing and production of new transactions using 5010/D.0 when each is ready, prior to the January 1, 2012 compliance date. Determine the advantages of doing so, such as potential cost savings from implementing electronic remittance and claim status transactions. **Inform Your Workforce Members That Change is Coming.** Over the next five years, healthcare covered entities, business associates, and stakeholders will see significant change, not only from 5010/D.0, but also implementation of ICD\-10 (also March 17, 2009 effective date and October 1, 2013 compliance date) and new HITECH Act requirements embodied in the February 17, 2009, enactment of the American Recovery and Reinvestment Act (“ARRA”). All workforce members must be onboard to ensure successful implementations and compliance. **Make a Plan.** We started with a Gap Analysis to determine what was required to achieve compliance with 5010/D.0\. You need another plan, a long-range workflow and competitive analysis. How will my business look like with all of the aforementioned changes? How do workflows change as we introduce more electronic business processes? What new policies and procedures must we adopt? What impact will all of these changes have on my business constituencies and customers? What are the impacts on costs and revenues of my business? In short, now is the time to start your short- and long-term game plans for adopting new electronic business processes and adapting your workflows. HIPAA.com will provide resources to help you along the way. ### Medicare Incentives for Physicians URL: https://hipaa.com/medicare-incentives-for-physicians/ Last updated: 2009-03-09T14:00:29.000Z Amounts shown are per physician. To participate in the incentives, you must be a meaningful user. | **Incentive** | **Year Adopted** | | | | | | -------------------- | ---------------- | ------------- | ----------- | ----------- | ----- | | | 2011 | 2012 | 2013 | 2014 | 2015+ | | 2011 | $18,000 | \-- | \-- | \-- | \-- | | 2012 | $12,000 | $18,000 | \-- | \-- | \-- | | 2013 | $8,000 | $12,000 | $15,000 | \-- | \-- | | 2014 | $4,000 | $8,000 | $12,000 | $12,000 | \_\_ | | 2015 | $2,000 | $4,000 | $8,000 | $8,000 | 0 | | 2016 | 0 | $2,000 | $4,000 | $4,000 | 0 | | 2017 | 0 | 0 | 0 | 0 | 0 | | Total | $44,000 | $44,000 | $39,000 | $24,000 | 0 | | Health Shortage Area | \+ 10%$48,400 | \+ 10%$48,400 | +10%$42,900 | +10%$26,400 | | As defined by the HITECH Act, a physician meaningful user is one using software that supports computerized provider order entry, uses ePrescribing, submits information to HHS on clinical quality measures, and demonstrates to HHS that they are using a certified EHR technology in a meaningful manner. Certification is not defined as CCHIT certification in the HITECH Act. Qualified EHR software has the capacity to do the following: Provide clinical decision support, Support physician order entry, Capture and query information relevant to healthcare quality, and Exchange electronic health information with, and integrate such information from other sources. ### CMS Confirms 5010 and ICD-10 Rules' Effective Dates URL: https://hipaa.com/cms-confirms-5010-and-icd-10-rules-effective-dates/ Last updated: 2009-03-08T17:30:42.000Z In notification to the U.S. House and Senate on Thursday, March 5, 2009, Don Johnson, Acting Director, Office of Legislation of the Centers for Medicare & Medicaid Services (CMS), notified the Congress that "\[i\]n accordance with the White House Chief of Staff's memorandum of January 20, 2009 entitled 'Regulatory Review,' a determination has been made that the effective date will not be extended and the comment period will not be reopened for either of these rules." The effective date for each of the rules is March 17, 2009\. The memorandum CMS sent to Congress follows. Beginning next Monday, March 9, HIPAA.com will have a posting daily through March 17, 2009, related to the 5010 Final Rule. Earlier, this week, HIPAA.com outlined the Level 1 and Level 2 requirements of the 5010 rule. "To: Senate Finance Committee, House Ways and Means Committee, House Energy and Commerce Committee, House and Senate Appropriations Committees, House and Senate Budget Committees, Other Interested Hill Staff From: Don Johnson, Acting Director, Office of Legislation, Centers for Medicare & Medicaid Services Re: Update on ICD-10 and Electronic Transaction Standards Final Rules On January 15, the U.S. Department of Health and Human Services released two final rules that will facilitate the United States' ongoing transition to an electronic health care environment through adoption of an updated set of diagnosis and procedures codes and updated standards for electronic health care and pharmacy transactions. In Accordance with the White House Chief of Staff's memorandum of January 20, 2009 entitled 'Regulatory Review,' a determination has been made that the effective date will not be extended and the comment period will not be reopened for either of these rules. The first rule \[ICD-10\] finalizes new code sets to be used for reporting diagnoses and procedures on health care transactions. This final rule replaces the ICD-9-CM code sets, developed nearly 30 years ago, with greatly expanded ICD-10 code sets. The second final rule adopts updated versions of the standards governing electronic transactions under the authority of the Health Insurance Portability and Accountability Act of 1996\. The updated versions replace the current standards and will promote greater use of electronic transactions. In response to public comments suggesting that more time would be need for effective industry inplementation, the final rules include later compliance dates. More specifically, the final rules provide compliance dates of Jan. 1, 2012, for the transactions standards and October 1, 2013, for the ICD-10 code set." ### Security Incident Procedures Response and Reporting: What to Do and How to Do It URL: https://hipaa.com/security-incident-procedures-response-and-reporting-what-to-do-and-how-to-do-it/ Last updated: 2009-03-04T14:00:30.000Z This is the sixth Administrative Safeguard Standard of the HIPAA Administrative Simplification Security Rule. This is its one implementation specification, Response and Reporting, which is required for compliance. As we have noted in earlier postings, with enactment of the American Recovery and Reinvestment Act of 2009 ("ARRA") on February 17, 2009, business associates also will be required to comply with the Security Rule standards, effective February 17, 2010. **What to Do** This standard requires that the covered entity implement response and reporting policies to address security incidents. A security incident is defined as "the attempted or successful unauthorized access, use, disclosure, modification, or destruction of information or interference with system operations in an information system." \[68 Federal Register 8376\] As a covered entity, you are required to identify, respond to, and to mitigate any harmful effects of security incidents, and to document the incidents, actions taken, and outcomes. **How to Do It** The covered entity’s Security Official is responsible for identifying, containing, mitigating, and documenting a security incident. A security incident might be leaving electronic protected health information on a computer that is donated to a local organization. The Security Official would determine the extent of the damage that occurred if the electronic protected health information were accessed by unauthorized persons, and implement measures to mitigate the damage, such as immediately recovering the computer. The Privacy Official, if different from the Security Official, may be called in to help mitigate the breach, as a security incident is called in the Privacy Rule, if the breach results in an unauthorized disclosure of electronic protected health information. Another example of a security incident could be the destruction of or damage to electronic protected health information caused by a system intrusion, such as a suspect email or virus. Failure to report and respond to the incident could create a serious problem if electronic protected health information, such as patient records, were altered or destroyed. The requirements of this implementation specification are met by information compiled and analyzed as part of the covered entity’s required risk analysis. In the risk analysis, the covered entity will identify vulnerabilities and potential threats. As part of contingency and disaster recovery planning, the covered entity will identify responses that will mitigate those risks. The Security Official is responsible for documenting the security incident in writing, and maintaining the documentation in written or electronic format for at least six years. Lessons learned are important outcomes of the documentation process, so the covered entity should review the security incident documentation periodically as part of updating the risk analysis. Each covered entity should prepare and maintain a Security Incident Report and a Security Incident Log. The Security Incident Report should contain the following information: » Description of Attempted or Actual Security Incident » Date, Time, and Location of the Incident » Person Who Discovered the Security Incident » How the Security Incident Was Discovered » Evidence of the Security Incident » Actions Taken to Mitigate Damages to Covered Entity’s Electronic Systems and Protected Health Information » Policy and Procedure Changes Implemented to Avoid Recurrence » Date of Security Incident Report » Name and Signature of Security Official For Each Line Entry in the Security Incident Log, Date, Location, Description, and Severity of the Security Incident, with Severity Ranked from 1 (Least Serious) to 5 (Most Serious) should be included. Remember, the covered entity must retain these documents at least six years from last entry. ### What should you expect from your HIPAA Security Official? URL: https://hipaa.com/what-should-you-expect-from-your-hipaa-security-official/ Last updated: 2009-03-03T20:00:31.000Z HIPAA's Security Rule requires covered entities to designate one person to be responsible for the development and implementation of policies and procedures that safeguard electronic protected health information. Nearly all organizations implemented measures to manage privacy in oral, written, and electronic media. However, as healthcare organizations and their business associates, inspired by the HITECH Act (stimulus package) respond to forthcoming financial incentives to adopt electronic health record (EHR) software, the need to beef up your security measures. So what should you look for in your Security Official? For starters, you need someone who understands clinical and billing workflows, recognizes that in the past some clinicians have communicated with patients via unsecure email such as AOL, Yahoo!, and Comcast, and also is skilled at shouldering broad responsibility while delegating assignments. Here, we've updated the a Get-Started plan originally published in HIPAA Plain & Simple (AMA), to include the following criteria. **What to Do** Conduct a risk assessment to determine the practice's security safeguards and vulnerabilities. **How to Do It** As you go through your risk assessment, assign a value from 1 to 5 for each risk/ Risks receiving a "1" value indicate the risk is probably low, but still needs attention; a risk given a "5" rating means the event, such as theft, breaking into the offices, fire, weather damage, has happened at least once, and is likely to happen again. For those risks given a 3 or 4 rating, assign an owner or owners to manage those risks. For example, you've decided to purchase EHR software, and you'll be purchasing new tablets for all the clinicians. Without even accessing a risk assessment, you can already build a list of potential problem areas, such as theft, malicious software, or damage from dropping. HIPAA's physical safeguard standard, (45 CFR 164.310{b}) requires that you implement policies and procedures that specify the proper functions to be performed, the manner in which those functions are to be performed, and the physical attributes of the surroundings of a specific workstation that can access electronic protected health information. You not only want to safeguard protected health information, you also want to safeguard your investment. The owners of this physical safeguard could be a lead physician, a nurse, and a lab technician. If you are the Security Official and have any concerns about your responsibilities, or if you'd like a copy of our risk assessment, give us a call or send us an email. We're here to help. ### Is Your Covered Entity Preparing for 5010/D.0 Testing? Part 2: Level 2 Testing URL: https://hipaa.com/is-your-covered-entity-preparing-for-5010d0-testing-part-2-level-2-testing/ Last updated: 2009-03-03T14:15:01.000Z On March 17, 2009, the Final Rules for Modifications to the Health Insurance Portability and Accountability Act (HIPAA) become effective. HIPAA.com has available for download the final rules for 5010/D.0 as published in the Federal Register on January 16, 2009 (pp.3295-3328). The effective date is "the date that the policies set forth in this final rule take effect, and new policies are considered to be officially adopted." \[p.3302\]. All covered entities are to be in compliance with 5010/D.0 on January 1, 2012\. Testing can occur "from the date of the final rule until the compliance date for Versions 5010 and D.0." \[p. 3306\] The Final Rules outline two levels of testing that covered entities are expected to undergo. Yesterday, March 2, we focused on Level 1 internal testing, which would commence March 17, and be completed no later than December 31, 2010\. Today, March 3, we abstract from the Final Rules issues related to Level 2 external testing, which must be completed by December 31, 2011, as compliance with 5010/D.0 begins for all covered entities on January 1, 2012. "When a covered entity has attained Level 1 compliance, it has completed all internal readiness activities and is fully prepared to initiate testing of the new versions in a test or production environment, pursuant to standard protocols for testing and implementing new software or data exchanges. The Level 2 testing period is the period during which covered entities are preparing to reach full production readiness with all trading partners. When a covered entity is in compliance with Level 2, it has completed end-to-end testing with each of its trading partners, and is able to operate in production mode with the new versions of the standards by the end of that period \[December 31, 2011\]. By "production mode," we \[U.S. Department of Health and Human Services, hereinafter "HHS"\] mean that covered entities can successfully exchange (accept and/or send) standard transactions and as appropriate, be able to process them successfully." \[pp.3302-3303\] "During Level 1 and Level 2 testing periods, either version of the standards may be used in production mode—Version 4010/4010A and/or version 5010, as well as Version 5.1 and/or Version D.0—as agreed to by trading partners. Covered entities should be prepared to meet Level 1 compliance by December 31, 2010, and Level 2 compliance by December 31, 2011\. After December 31, 2011, covered entities may not use Versions 4010/4010A and 5.1\. On January 1, 2012, all covered entities will have reached Level 2 compliance, and must be fully complaint in using Versions 5010 and D.0 exclusively." \[p.3303\] "We \[HHS\] anticipate that, since there was support for a phased-in schedule, health plans and clearinghouses will make every effort to be fully compliant on January 1, 2012\. Covered entities are urged to begin preparations now, to incorporate effective planning, collaboration and testing in their implementation strategies, and to identify and mitigate any barriers long before the deadline. While we have authorized contingency plans in the past, we do not intend to do so in this case, as such an action would likely adversely impact ICD-10 implementation activities. HIPAA gives us \[HHS\] authority to invoke civil money penalties against covered entities who do not comply with the standards, and we have been encouraged by industry to use our authority on a wider scale." \[p.3303\] HIPAA.com encourages covered entities to begin now to prepare for Level 1 testing, commencing on March 17, 2009\. If you use a software vendor to handle your HIPAA standard transactions, ask the vendor to provide you with a written statement of how the vendor is prepared to implement Level 1 testing during the March 17, 2009-December 31, 2010, Level 1 testing period and what are its implementation timelines and milestones. Do the same if your HIPAA standard transactions are conducted via an internal information technology (IT) application. Also, in either instance, ask your trading partners to respond in writing with their plans to implement Level 1 testing during that period, and any expectations at this point in time concerning Level 2 testing in 2011. HIPAA.com will outline HHS enforcement in an upcoming posting. Be sure to register for email updates from HIPAA.com. ### Security Incident Procedures: What This HIPAA Security Rule Administrative Safeguard Standard Means URL: https://hipaa.com/security-incident-procedures-what-this-hipaa-security-rule-administrative-safeguard-standard-means/ Last updated: 2009-03-02T19:45:03.000Z This is the sixth Administrative Safeguard Standard of the HIPAA Administrative Simplification Security Rule. It has one implementation specification: Response and Reporting, which is required for compliance. As we have noted in earlier postings, with enactment of the American Recovery and Reinvestment Act of 2009 ("ARRA") on February 17, 2009, business associates also will be required to comply with the Security Rule standards, effective February 17, 2010. This safeguard standard and its implementation specification require covered entities to establish policies and procedures to respond to security incidents and to report them. A security incident is defined as "the attempted or successful unauthorized access, use, disclosure, modification, or destruction of information or interference with system operations in an information system." \[68 Federal Register 8376\]. This definition is comprehensive, covering a wide variety of risks to information and systems that a covered entity may encounter. The definition also highlights the imperative for covered entities to consider in its risk analysis potential vulnerabilities and threats that could impact vulnerable information and system points in the absence of actions to mitigate those risks. On Tuesday, March 3, HIPAA.com will post a discussion of the Response and Reporting implementation specification for the Security Incident Procedures Safeguard Standard, and will include a sample Security Incident Report and Security Incident Log formats. ### Is Your Covered Entity Preparing for 5010/D.0 Testing? Part 1: Level 1 Testing URL: https://hipaa.com/is-your-covered-entity-preparing-for-5010d0-testing-part-1-level-1-testing/ Last updated: 2009-03-02T16:30:30.000Z On March 17, 2009, the Final Rules for Modifications to the Health Insurance Portability and Accountability Act (HIPAA) become effective. HIPAA.com has available for download the final rules for 5010/D.0 as published in the Federal Register on January 16, 2009 (pp.3295-3328). The effective date is "the date that the policies set forth in this final rule take effect, and new policies are considered to be officially adopted." \[p.3302\]. All covered entities are to be in compliance with 5010/D.0 on January 1, 2012\. Testing can occur "from the date of the final rule until the compliance date for Versions 5010 and D.0." \[p. 3306\] The Final Rules outline two levels of testing that covered entities are expected to undergo. Today, we focus on Level 1 internal testing, which would commence March 17, and be completed no later than December 31, 2010\. Tomorrow, March 3, we will outline Level 2 external testing. We abstract here issues related to testing, particularly Level 1 testing. "The Level 1 testing period is the period during which covered entities perform all of their internal readiness activities in preparation for testing the new versions of the standards with their trading partners \[Level 2 testing\]. When we \[U.S. Department of Health and Human Services, hereinafter "HHS"\] refer to compliance with Level 1, we mean that a covered entity can demonstrably create and receive compliant transactions, resulting from the completion of all design/build activities and internal testing. When a covered entity has attained Level 1 compliance, it has completed all internal readiness activities and is fully prepared to initiate testing of the new versions in a test or production environment, pursuant to its standard protocols for testing and implementing new software or data exchanges." \[p.3302\] "During Level 1 and Level 2 testing periods, either version of the standards may be used in production mode—Version 4010/4010A and/or version 5010, as well as Version 5.1 and/or Version D.0—as agreed to by trading partners. Covered entities should be prepared to meet Level 1 compliance by December 31, 2010…. On January 1, 2012, all covered entities … must be fully complaint in using Versions 5010 and D.0 exclusively…. We \[HHS\] anticipate that, since there was support for a phased-in schedule, health plans and clearinghouses will make every effort to be fully compliant on January 1, 2012\. Covered entities are urged to begin preparations now, to incorporate effective planning, collaboration and testing in their implementation strategies, and to identify and mitigate any barriers long before the deadline. While we have authorized contingency plans in the past, we do not intend to do so in this case, as such an action would likely adversely impact ICD-10 implementation activities. HIPAA gives us \[HHS\] authority to invoke civil money penalties against covered entities who do not comply with the standards, and we have been encouraged by industry to use our authority on a wider scale." \[p.3303\] HIPAA.com encourages covered entities to begin now to prepare for Level 1 testing, commencing on March 17, 2009\. If you use a software vendor to handle your HIPAA standard transactions, ask the vendor to provide you with a written statement of how the vendor is prepared to implement Level 1 testing during the March 17, 2009-December 31, 2010, Level 1 testing period and what are its implementation timelines and milestones. Do the same if your HIPAA standard transactions are conducted via an internal information technology (IT) application. Also, in either instance, ask your trading partners to respond in writing with their plans to implement Level 1 testing during that period. Tomorrow, Tuesday, March 3, we will outline Level 2 testing to be conducted during the period January 1-December 31, 2011. ### Information Access Management: Access Establishment and Modification-What to Do and How to Do It URL: https://hipaa.com/information-access-management-access-establishment-and-modification-what-to-do-and-how-to-do-it/ Last updated: 2009-02-27T19:00:17.000Z In our series on the HIPAA Administrative Simplification Security Rule, this is the third implementation specification for the Administrative Safeguard Standard (Information Access Management). This implementation specification is addressable. Remember, addressable does not mean “optional.” Rather, an addressable implementation specification means that a covered entity must use reasonable and appropriate measures to meet the standard. Further, as we have noted in a posting last week, with enactment of the American Recovery and Reinvestment Act of 2009 on February 17, 2009, business associates also will be required to comply with the Security Rule standards, effective February 17, 2010. **What to Do** Implement policies and procedures that, based upon the covered entity’s access authorization policies, establish, document, review, and modify a user’s right of access to a workstation, transaction, program, or process. **How to Do It** The covered entity should develop a procedure for periodically reviewing and modifying a workforce member’s right of access to workstations, transactions, programs, and processes of the covered entity that contain electronic protected health information. Such modifications should be based on changes in job responsibilities for workforce members of the covered entity. Any changes should be documented in writing, and all documentation should be maintained for at least six years from the date of any changes. The Security Official should be responsible for documenting and maintaining access authorization records of workforce members authorized access to systems containing electronic protected health information. The Security Official should be responsible for counseling and providing any discipline to workforce members who alter, modify, or in any way change electronic protected health information without authorization. The Security Official also should provide periodic reminders to the workforce pertaining to system access. The Security Official should ensure that any person outside of the workforce, such as a computer hardware or software vendor or consultant, with access to the covered entity’s systems containing electronic protected health information, should be subject to a business associate agreement and counseled on the covered entity’s security policies and procedures. ### Effective Dates for Modified HIPAA Administrative Simplification Transaction and Code Set Rules Coming in March URL: https://hipaa.com/effective-dates-for-modified-hipaa-administrative-simplification-transaction-and-code-set-rules-coming-in-march/ Last updated: 2009-02-27T15:23:42.000Z In less than three weeks, HIPAA Version 5010/D.0 transaction and ICD-10 code set rules become effective, and the clock starts running on testing in preparation for compliance several years hence. Next Monday, March 2, 2009, HIPAA.com will outline Level 1 testing requirements and opportunities for the 5010/D.0 transaction rule, and on Tuesday, March 3, 2009, outline testing requirements for ICD-10\. [Sign up for HIPAA.com email reminders](https://hipaa.com/subscribe/?phpMyAdmin=9a5c4b3388ddt4b052c02) for these and other HIPAA Administrative Simplification standards postings, as well as postings relating to the new Health Information Technology for Economic and Clinical Health Act and Medicare and Medicaid Health Information Technology ("HITECH Act") provisions of the American Recovery and Reinvestment Act ("ARRA") signed by President Obama on February 17, 2009. ### Information Access Management: Access Authorization-What to Do and How to Do It URL: https://hipaa.com/information-access-management-access-authorization-what-to-do-and-how-to-do-it/ Last updated: 2009-02-26T14:15:06.000Z In our series on the HIPAA Administrative Simplification Security Rule, this is the second implementation specification for the Administrative Safeguard Standard (Information Access Management). This implementation specification is addressable. Remember, addressable does not mean "optional." Rather, an addressable implementation specification means that a covered entity must use reasonable and appropriate measures to meet the standard. Further, as we have noted in a posting last week, with enactment of the American Recovery and Reinvestment Act of 2009 on February 17, 2009, business associates also will be required to comply with the Security Rule standards, effective February 17, 2010. **What to Do** Implement policies and procedures for granting access to electronic protected health information, for example, through access to a workstation, transaction, program, process, or other mechanism. **How to Do It** The covered entity should determine in the risk analysis which workforce members need access to electronic protected health information. Then, as an outcome of the risk analysis, the covered entity should define the covered entity’s policies for granting access to such information. An important component of the policies should be that workforce members who are granted access are only granted access to the minimum amount of electronic protected health information needed by a workforce member needed to complete assigned responsibilities. The covered entity should elaborate in each workforce member’s job description the need for access to electronic protected health information, responsibilities of such access, and any limits to such access. The size of a covered entity will have an impact on access authorization. For example, a small physician practice or dental office may require that each workforce member have access to electronic protected health information, whereas in a large health plan payer organization, access may be limited to workforce members adjudicating claims. The Security Official of the covered entity should jointly develop access authorization policies with the Privacy Official (if different) so that policies and procedures are consistent with the Security and Privacy Rules. In a small covered entity, the Security Official may be the person who authorizes access and establishes access (e.g., issues unique user ID and creates authentication requirements). In a large covered entity, the Security Official should authorize access, but information technology (IT) staff may establish access. The Security Official of the covered entity should document and maintain access authorization records, including which workforce members are authorized access to electronic protected health information, levels of and any changes in such access, and times of access. The Security Official should ensure that any person outside of the workforce, such as a computer hardware or software vendor or consultant, with access to the covered entity’s systems containing electronic protected health information, should be subject to a business associate agreement and counseled on the covered entity’s security policies and procedures. ### Information Access Management: Isolating Healthcare Clearinghouse Functions-What to Do and How to Do It URL: https://hipaa.com/information-access-management-isolating-healthcare-clearinghouse-functions-what-to-do-and-how-to-do-it/ Last updated: 2009-02-25T18:00:45.000Z In our series on the HIPAA Administrative Simplification Security Rule, this is the first implementation specification for the Administrative Safeguard Standard (Information Access Management). This implementation specification is required. **What to Do** If a healthcare clearinghouse is part of a larger organization, the clearinghouse must implement policies and procedures that protect the electronic protected health information of the clearinghouse from unauthorized access by the larger organization. Remember, a clearinghouse is defined as a covered entity, but also can serve in the role of a business associate to other covered entities, namely a health plan or healthcare provider. **How to Do It** This implementation specification is required, but is not likely to apply directly to health plans or to healthcare providers. A health plan and healthcare provider, as covered entities, must document in writing that they are not clearinghouses, so that this implementation specification does not apply. A health plan or healthcare provider covered entity must be aware of this implementation specification, which may impact the covered entity indirectly if either uses a clearinghouse, as a business associate, that is part of a larger organization. In that case, if the clearinghouse materially breaches its obligations to the covered entity under the business associate agreement by allowing an unauthorized person in the larger organization to access the covered entity’s protected health information, and the covered entity allows the breach to continue without terminating the contract, if feasible, or reporting the breach to the U.S. Department of Health and Human Services, if termination is not feasible, then the covered entity would be in violation of HIPAA Administrative Simplification Privacy or Security Rules, or both. Because clearinghouses also are covered entities, it is likely that clearinghouses would have policies and procedures in place to protect against the unauthorized disclosures covered by this implementation specification. Further, as we noted in a posting last week, with enactment of the American Recovery and Reinvestment Act of 2009 on February 17, 2009, business associates also will be required to comply with the Security Rule standards, effective February 17 , 2010\. As a result, the clearinghouse in its business associate role, reflected in a new business associate agreement with a health plan or healthcare provider covered entity, would have direct responsibility for a breach and reporting the breach to affected parties. Until then, as a covered entity health plan or healthcare provider, make sure in your business associate agreement that a clearinghouse that is part of a larger organization safeguards your protected health information from unauthorized persons in the organization who are not part of the clearinghouse operations. ### Information Access Management-What This HIPAA Security Rule Administrative Safeguard Standard Means URL: https://hipaa.com/information-access-management-what-this-hipaa-security-rule-administrative-safeguard-standard-means/ Last updated: 2009-02-25T14:00:32.000Z This is the fourth Administrative Safeguard Standard of the HIPAA Administrative Simplification Security Rule. It has three implementation specifications: Isolating Healthcare Clearinghouse Functions; Access Authorization; and Access Establishment and Modification. The first is required; the second and third are addressable. Addressable does not mean “optional.” Rather, an addressable implementation specification means that a covered entity must use reasonable and appropriate measures to meet the standard. Further, as we noted in a posting last week, with enactment of the American Recovery and Reinvestment Act of 2009 on February 17, 2009, business associates also will be required to comply with the Security Rule standards, effective February 17, 2010. The covered entity is required to implement policies and procedures for authorizing access to electronic protected health information that are consistent with the applicable requirements of the HIPAA Administrative Simplification Privacy Rule. The Information Access Management Administrative Safeguard ensures that a covered entity has a management system in place to authorize workforce members to have access to electronic protected health information via a “workstation, transaction, program, process, or other mechanism.” \[68 Federal Register 8377\] The required Isolating Healthcare Clearinghouse implementation specification may not have a direct relevance to a covered entity, but may have indirect relevance if the covered entity uses a clearinghouse under a business associate agreement. The two other implementation specifications of the Information Access Management Administrative Safeguard—Access Authorization and Access Establishment and Modification—recognize that there are alternatives to complying with this standard based on the covered entity’s size and degree of automation. ### Security Management Process: Information System Activity Review-What to Do and How to Do It URL: https://hipaa.com/security-management-process-information-system-activity-review-what-to-do-and-how-to-do-it/ Last updated: 2009-02-23T18:00:26.000Z In our series on the HIPAA Administrative Simplification Security Rule, this is the fourth implementation specification for the Administrative Safeguard Standard (Security Management Process). This implementation specification is required. **What to Do** Implement procedures to regularly review records of information of system activity, such as audit logs, access reports, and security incident tracking reports. **How to Do It** Size of the covered entity and complexity of the business operation will be key considerations in the risk analysis and in fulfilling the requirements of this implementation specification. First, r egularly review information system activity for inappropriate use or security incidents, such as unauthorized disclosure. Many computer systems now have built-in reporting functionality that will facilitate the review requirement. If the covered entity has a business associate vendor that provides a practice management system software solution, the covered entity should ask the vendor for help in utilizing automatic reporting functionality, establishing audit logs and access reports, and identifying and tracking security violations. As part of the risk analysis, and in preparing security policies and procedures, the covered entity should identify information and reporting requirements for: » Creating audit log entries. » Safeguarding all written documentation, including policies and procedures. » Establishing safe storage requirements for maintaining written documentation and for backup of electronic documentation for at least six years. The requirement to report, review, and document is the same for all covered entities, irrespective of size or business complexity. ### Security Management Process: Sanction Policy-What to Do and How to Do It URL: https://hipaa.com/security-management-process-sanction-policy-what-to-do-and-how-to-do-it/ Last updated: 2009-02-23T13:00:14.000Z In our series on the HIPAA Administrative Simplification Security Rule, this is the third implementation specification for the Administrative Safeguard Standard (Security Management Process). This implementation specification is required. **What to Do** Apply appropriate sanctions against workforce members who fail to comply with the security policies and procedures of the covered entity. **How to Do It** The covered entity must determine appropriate internal sanctions or penalties for violation of its security policies and procedures by workforce members. Sanctions should: » Deter noncompliant behavior, such as posting passwords on computer hardware or under a desk pad. » Serve as an incentive for compliance with security policies and procedures. The appropriate sanctions will be suggested by the results of the covered entity’s risk analysis. Sanctions should be in proportion to the covered entity’s estimate of harm that would be anticipated from specific security incidents. For example, posting or sharing a password may appear innocuous, but consider potential harms if an unauthorized user of the password gained access to electronic protected health information and disclosed it publicly. The covered entity should clearly articulate sanction policies, so that workforce members easily understand consequences of violations of security policies and procedures. Sanctions should apply equally to all workforce members. Workforce members should understand that consequences may include not only disciplinary action within the covered entity, but also civil and possibly criminal enforcement. The HIPAA Administrative Simplification Privacy Rule also includes an administrative, technical, and physical safeguard standard. The covered entity should make sure that the sanctions pertaining to each Rule are consistent. ### Security Management Process: Risk Management-What to Do and How to Do It URL: https://hipaa.com/security-management-process-risk-management-what-to-do-and-how-to-do-it/ Last updated: 2009-02-20T20:00:39.000Z In our series on the HIPAA Administrative Simplification Security Rule, this is the second implementation specification for the Administrative Safeguard Standard (Security Management Process). This implementation specification is required. **What to Do** Implement security measures sufficient to reduce risks and vulnerabilities to a reasonable and appropriate level to comply with the general requirements of the security standard as outlined in 45 CFR 306(a). The general requirements are: 1\. Ensure the confidentiality, integrity, and availability of all electronic protected health information the covered entity creates, receives, maintains, or transmits. 2\. Protect against any reasonably anticipated threats or hazards to the security or integrity of such information. 3\. Protect against any reasonably anticipated uses or disclosures of such information that are not permitted or required under \[the Privacy Rule\]. 4\. Ensure compliance with this subpart by its workforce. **How to Do It** This implementation specification requires the covered entity to develop and implement a plan to manage risks that it identified in its Risk Analysis. The risk management plan will provide the foundation for implementation of the covered entity’s security policies and procedures. In preparing the plan, the covered entity may take into consideration the following factors under the "flexibility of approach" general rule that underpins the Security Rule: » "The size, complexity, and capabilities of the covered entity." » "The covered entity’s technical infrastructure, hardware, and software security capabilities." » "The costs of security measures." » "The probability and criticality of potential risks to electronic protected health information." Risks change over time, so the covered entity must use ongoing efforts to ensure an acceptable level of risk. As an example, passwords must be changed on a regular basis to maintain an acceptable level of risk regarding unauthorized system access. ### ARRA's HITECH Privacy Provisions Apply HIPAA Security Rule to Business Associates URL: https://hipaa.com/arras-hitech-privacy-provisions-apply-hipaa-security-rule-to-business-associates/ Last updated: 2009-02-20T16:30:26.000Z President Obama signed into law the American Recovery and Reinvestment Act of 2009 (ARRA) on Tuesday, February 17, 2009\. The Health Information Technology for Economic and Clinical Health Act (HITECH) provisions of ARRA in Title XIII include important changes in Privacy (Subtitle D). Our focus in this posting is the change related to business associates under HIPAA Administrative Simplification that is specified in Section 13401: Application of Security Provisions and Penalties to Business Associates of Covered Entities. In this section, administrative, physical, and technical safeguards, and policy, procedure, and documentation requirements of the HIPAA Administrative Simplification Security Rule “shall apply to a business associate of a covered entity in the same manner that such sections apply to the covered entity. The additional requirements of this title that relate to security and that are made applicable with respect to covered entities shall also be applicable to such a business associate and shall be incorporated into the business associate agreement between the business associate and the covered entity." The additional requirements include civil and criminal penalties, notification provisions for a breach, and application of "guidance on the most effective and appropriate technical safeguards” as determined by the Secretary of Health and Human Services (HHS), amongst other requirements. These changes become effective one year after enactment of ARRA on February 17, 2010. Application of the Security Rule to business associates of covered entities is a significant change. Previously, if there were a breach involving a business associate of which the covered entity were aware, then the covered entity could just terminate the contract if the breach was not remedied. Responsibility and liability rested with the covered entity. With the change in the HITECH privacy provisions of ARRA, the business associate now has responsibility and liability directly for a breach. A breach requires notification, which is triggered when there is an incident of “unsecured protected health information.” The Secretary of HHS is required to issues guidance on what constitutes “unsecured protected health information” within 6o days of February 17, 2009\. In the absence of such guidance in the time specified, then a default definition pertaining to a failure of encryption as endorsed by the National Institute of Standards and Technology (NIST) of such information obtains. The notification provision requires both covered entities and business associates to notify affected parties directly and individually in a timely manner, and to use appropriate public media for cases involving over 500 individuals. This is a specification that was not defined under HIPAA Administrative Simplification. Increased penalties for a breach by a covered entity are immediately effective and will be outlined in a subsequent posting. Covered entities should notify their business associates of the security rule, notification, and enforcement penalty changes in ARRA, and begin working on a plan to revise their business associate contracts to reflect the changes. HIPAA.com has started a series that will review over the coming weeks each of the administrative, physical, and technical standards and implementation specifications of the Security Rule. Earlier this week, we discussed the risk analysis as part of the security management process, and complete discussion of that security standard with three additional implementation specifications of that standard. ### American Recovery and Reinvestment Act of 2009 URL: https://hipaa.com/american-recovery-and-reinvestment-act-of-2009/ Last updated: 2026-10-24T21:35:29.000Z ONE HUNDRED ELEVENTH CONGRESS of the UNITED STATES of AMERICA American Recovery and Reinvestment Act of 2009 Making supplemental appropriations for job preservation and creation, infrastructure investment, energy efficiency and science, assistance to the unemployed, and State and local fiscal stabilization, for the fiscal year ending September 30, 2009, and for other purposes. AGENCY: 111th US Congress. ACTION: Act. - [Download](https://hipaa.com/content/files/2026/10/arra%5F2009.pdf) (Requires [Acrobat Reader](http://get.adobe.com/reader/?ref=hipaa.com)) ### President Obama to Sign ARRA's HITECH provisions Tuesday, February 17, 2009, in Denver, CO URL: https://hipaa.com/president-obama-to-sign-arras-hitech-provisions-tuesday-february-17-2009-in-denver-co/ Last updated: 2009-02-17T13:30:26.000Z The Senate joined the House on Friday evening, February 13, 2009, in passing the American Recovery and Reinvestment Act, which includes provisions relating to Health Information Technology. Title XIII of Division A and Title IV of Division B together are known as the “Health Information Technology for Economic and Clinical Health Act” or the “HITECH Act.” We will be highlighting attributes of the HITECH Act through the end of February. Contrary to the political blather, this legislation is a significant step forward in providing funding and incentives to accelerate adoption of standardized and interoperable electronic business and clinical technologies in healthcare and in strengthening privacy safeguards for patients’ protected health information. The federal government will develop standards for HITECH, and the new HITECH law states that: ‘\[T\]he standards, implementation specifications, and certification criteria recommended under this subsection shall be consistent with the standards for information transactions and data elements adopted pursuant to section 1173 of the Social Security Act\[Standards to Enable Electronic Exchange\].” \[Section 3003(b)(1)(D)Consistency, Congressional Record—House, February 12, 2009, p.H1340\] The referenced standards include the Health Information Portability and Accountability Act (HIPAA) standards. It is important to note that when President Obama signs the American Recovery and Reinvestment Act, the clock starts running toward 2011, when incentives for Medicare providers, amongst others, begin. It is important to note that House and Senate conferees increased the potential incentive payment for meaningful Medicare users of qualified electronic health records in 2011 and 2012 from $15,000 to $18,000, and terminated incentives for first users after 2014\. The year 2011 is the first year that Baby Boomers begin to qualify for Medicare, and 2014 is the end of the “Decade of Health Information Technology” that was proclaimed by the Bush Administration in 2004\. ### Security Management Process: Risk Analysis-What to Do and How to Do It URL: https://hipaa.com/security-management-process-risk-analysis-what-to-do-and-how-to-do-it/ Last updated: 2009-02-13T20:30:05.000Z Security Management Process is the first administrative standard of the Security Rule, and Risk Analysis is the implementation specification. Each covered entity is required to conduct a risk analysis or assessment to determine vulnerabilities and threats and to identify and put in place risk mitigation measures for safeguarding electronic protected health information. Electronic protected health information is the content of the HIPAA Administrative Simplification Standard Transactions and of the expected growing adoption of clinically-based electronic health record systems. What to do: Conduct an accurate and thorough assessment of potential risks and vulnerabilities to the confidentiality, integrity, and availability of electronic protected health information held by the covered entity. How to do it: The risk analysis is the foundation of the Security Rule. The required risk analysis provides the covered entity with the opportunity to formally identify and document its security policies and procedures, evaluate their effectiveness, mitigate known vulnerability and threat risks. The covered entity must update the risk analysis, as appropriate for circumstances, and retain documentation in written or electronic form for at least six years, in accordance with HIPAA Administrative Simplification documentation requirements. Remember, under the HIPAA Administrative Simplification Security Rule, risks pertain to electronic protected health information received, sent, or held ("at rest") by the covered entity. The HIPAA Privacy Rule pertains to safeguarding not only electronic protected health information, but also to protected health information in oral or written form. The risk analysis provides the covered entity with the basis to develop security policies and procedures. Periodic review of the risk analysis provides the covered entity to measure effectiveness and update those policies and procedures as necessary to mitigate newly discovered risks. Reasonableness and scalability are key factors in the covered entity’s determining appropriateness of security methods and measures for implementation. The risk analysis must focus on risks and vulnerabilities as they relate to "confidentiality, integrity, and availability of electronic protected health information" received, sent, or held by the covered entity. These terms are the core properties of the Security Rule: » Confidentiality—Electronic protected health information is "not made available or disclosed to unauthorized persons or processes." » Integrity—Electronic protected health information has "not been altered or destroyed in an unauthorized manner." » Availability—Electronic protected health information is "accessible and usable upon demand by an authorized person." The National Institute of Standards and Technology (NIST), which is an organization in the U.S. Department of Commerce, has established useful guidelines for conducting a Security Rule risk analysis. NIST’s October 2008 publication: An Introductory Resource Guide for Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule NIST Special Publication 800-66 Revision 1) is available for download at HIPAA.com. Of particular interest is Appendix E (pp.E-1-E7), which discusses "How to Conduct the Risk Assessment" in nine steps. These steps are: 1\. Scope the Assessment2\. Gather Information3\. Identify Realistic Threats 4\. Identify Potential Vulnerabilities 5\. Assess Current Security Controls 6\. Determine the Likelihood and the Impact of a Threat Exercising a Vulnerability 7\. Determine the Level of Risk 8\. Recommend Security Controls 9\. Document the Risk Assessment Results. Here are relevant key terms defined by NIST » Risk—Potential impact that a threat can have on the confidentiality, integrity, and availability of electronic protected health information by exploiting a vulnerability. » Threats—Anything that can have a negative impact on electronic protected health information. Examples include malicious intent, or unintentional events such as a misconfigured server or data entry error. » Threat sources—Natural (e.g., floods, earthquakes, or storms); human (e.g., intentional, such as identify thieves, hackers; unintentional, such as data entry error or accidental deletion); or environmental (e.g., power surge or spike, hazmat contamination, pollution). » Vulnerabilities—Flaw or weakness in a system security procedure, design, implementation, or control that could be intentionally or unintentionally exercised by a threat. » Impact—Negative quantitative or qualitative assessment, or both, of a vulnerability being exercised on the confidentiality, integrity, and availability of electronic protected health information. The more time and attention that you give to the risk analysis the more the covered entity will benefit in two respects: (1) minimizing potential business disruptions resulting from a security incident or privacy breach concerning electronic protected health information, and (2) minimizing potential liabilities associated with such occurrences. ### Time to Review Your Security Risk Assessment URL: https://hipaa.com/time-to-review-your-security-risk-assessment/ Last updated: 2009-02-13T18:10:50.000Z With the March 17, 2009 effective dates for the new 5010 Version of HIPAA Administrative Simplification Transaction Standards and the move to the ICD-10 Code Set Standard rules, and the expected enactment of the HITECH provisions of the American Recovery and Reinvestment Act as early as next week, it is a good time now to begin reviewing your HIPAA Administrative Simplification Security safeguards. As mentioned earlier this week, creating and periodically reviewing your risk assessment or analysis is the foundation of achieving compliance with the HIPAA Administrative Simplification Security Rule and a key factor in having a successful business. Over the next week, HIPAA.com will review the Security Rule administrative, technical, and physical standards, and provide advice on what to do and how to do it in order to ensure that you—as a covered entity—are in compliance with each standard’s implementation specifications. As an overview of the Security Rule, here are ten key Security Rule attributes: 1\. The Security Rule is a set of standards and implementation specifications with which covered entities must comply by federal law. 2\. The Security Rule standards are always required for compliance, while implementation specifications can be required or addressable. 3\. The Security Rule is scalable, taking into consideration size of covered entity, and flexible, taking into consideration structure of covered entity, costs of security measures, and probability and criticality of potential risks. 4\. The Security Rule is reasonable, and permits the covered entity to implement security safeguards that are appropriate. 5\. The Security Rule is founded on principles of availability, confidentiality, and integrity of a patient’s medical information in electronic form: electronic protected health information. 6\. The Security Rule is technology neutral: a covered entity can choose its protection measures (inputs) as long as they achieve specified safeguard performance levels (outputs). 7\. The Security Rule is based on risk assessment and risk mitigation, namely, a covered entity identifying its potential vulnerabilities and threats, and taking measures to avoid them. 8\. The Security Rule is built on a foundation of safeguarding electronic protected health information, so maintaining availability of electricity is a key factor. 9\. The Security Rule formalizes in policies and procedures many of the practices that a prudent business would use in the course of its operations. 10\. The Security Rule is an investment in the future of a covered entity as a successful business. ### Are You Subject to HIPAA Privacy Rules when Publishing Confidential Health Information on a Social Network? URL: https://hipaa.com/are-you-subject-to-hipaa-privacy-rules-when-publishing-confidential-health-information-on-a-social-network/ Last updated: 2009-02-13T13:50:42.000Z It's unlikely the social networking sites are health care providers, so HIPAA's privacy rule doesn't apply; but other privacy business practices are likely to affect you. First, tackle the HIPAA Privacy question by responding to the following questions. » Are you a healthcare provider that conducts transactions electronically? » Are you a healthcare clearinghouse? (Do you process healthcare claims?) » Are you a health plan? (insurance payer) If you answered no to these questions, you are not a covered entity under HIPAA's Privacy Rule. That said, you probably are more concerned about users sharing health information online that if stolen, could be used in identity theft. Consumers (patients) often use social networking sites to keep friends and family members updated on health conditions. Or, using secure patient portals, patients (consumers) may create their own confidential and secure personal health records (PHR). These records typically contain information such as medications including dosages, allergies, health insurance plan, if applicable, emergency contact, current medical conditions – typically all the things you have to answer again and again on paper every time you see a doctor. Our nation is rapidly heading into an environment where consumers (patients) can store their health information on smart phones, online patient portals, or in portable devices, such as USB drives so that you can quickly provide information to an Emergency Room physician or your own doctor. Patients are not covered entities, but they are responsible for creating, maintaining and sharing their own health information, a very smart thing to do, but it should be done on a secure PHR service, not on social networking sites. To find PHR companies, search online using keywords, “Personal Health Record software.” Finally, we applaud social networking sites that demonstrate concern for their users privacy. With the rapid uptick in use, we recommend you put a notice on your site warning users to be cautious about providing identifiable information, such as date of birth (especially year), address, telephone number, or social security number. If you are considering offering a patient portal service, first consult the services of a health law attorney. ### House and Senate Agree on ARRA Provisions URL: https://hipaa.com/house-and-senate-agree-on-arra-provisions/ Last updated: 2009-02-12T18:04:54.000Z On Wednesday, February 11, 2009, House and Senate conferees reconciled the House and Senate versions of the American Recovery and Reinvestment (ARRA) plan, or so-called Stimulus bill. The House and Senate are expected to approve the final version this week and send it to President Obama for his signature. The total of the stimulus is just over $789 billion. The Wall Street Journal reported this morning that “$19 billion is set aside for health information technology. Physicians would get bonuses of between $44,000 and $64,000—and hospitals would get as much as $11 million—if they show they have computerized their medical-records systems. On the stick side of the equation, the measure included Medicare payment penalties for physicians and hospitals who are not using electronic health records by 2014.” \[p.A2\] The Congress is completing a final version of ARRA; HIPAA.com will outline and post the HITECH provisions of the bill signed by the President, as soon as they are available. ### Senate Passes American Recovery and Reinvestment Act of 2009 (ARRA) URL: https://hipaa.com/senate-passes-american-recovery-and-reinvestment-act-of-2009-arra/ Last updated: 2009-02-11T14:06:04.000Z Tuesday afternoon the Senate passed the American Recovery and Reinvestment Act, the so-called Economic Stimulus bill. Previously, the House of Representatives passed its version, H.R. 1\. Now, the joint House-Senate conference committee will resolve funding and language differences in the House and Senate versions of ARRA. As we have noted earlier, each of these versions contains incentives for adoption of health information technologies, which are described in the so-called HITECH provisions of the House and Senate versions. President Obama is expected to sign a reconciled bill in the near future, assuming that the Democrats in the Senate can achieve at least 60 votes in a procedural motion to move the bill to the floor of the Senate for a vote. Once signed into law, HIPAA.com will provide a detailed analysis of funding, language, and timeframe provisions of the reconciled HITECH provisions. In the meantime, we know that health information policy and privacy/security provisions will be included in the final version of the ARRA legislation. Accordingly, we believe that now is a good time to think about reviewing your security plan for securing electronic protected health information. Remember, this applies to all covered entities, who are required to safeguard electronic protected health information under the HIPAA Administrative Simplification Security Rule, and electronic, oral, and written protected health information under the HIPAA Administrative Simplification Privacy Rule. The definition of covered entity in a final ARRA bill may extend the definition and responsibilities of a covered entity to business associates. So, to get started, the first task would be to review your risk management program. Start by reviewing the 2008 Revision of NIST Guide for Implementing HIPAA Security Rule available at HIPAA.com, and your written risk assessment analysis that is required of covered entities. Risk management is the process of evaluating threats and vulnerabilities, and then designing a strategy for handling and mitigating those threats and vulnerabilities. The foundation of your security plan is based on conducting your risk assessment, and periodically reviewing and updating it. Three principles provide the foundation for security of electronic health information: » Integrity: information has not been altered or destroyed without proper authorization. » Confidentiality: information is only available or disclosed to persons authorized to receive it. » Availability: information is accessible and useable upon demand by authorized persons. » Each of these principles underlie security in administrative, technical, and physical standards. ### What Does the HITECH Act Mean to You? URL: https://hipaa.com/what-does-the-hitech-act-mean-to-you/ Last updated: 2009-02-06T18:15:39.000Z Even though the US Senate is likely to pass the stimulus package in the next day or two, the House and Senate still have to come to an agreement on their funding differences. The HITECH Act is still holding its own with some possible additions to the $20 billion agreed upon by the House. Key words used by both House and Senate are "meaningful use" and "shovel ready". In other words, everything is set in place ready to go, but just needs money to get it off the ground. You've made a decision on your health IT system, you've completed your readiness assessments, and you've built a strategy to move forward. All you need now is money. Where do you fit in the funding equation below? » $18 billion through the Medicare and Medicaid reimbursement systems for hospitals and physicians who are "meaningful users" of HIT. » $2 billion to the Office of the National Coordinator that must begin to be spent within 90 days of the legislation being signed into law on items such as the infrastructure necessary to allow for, and promote, the electronic exchange and use of health information for each individual in the United States; updating the Department of Health & Human Services’ technologies to allow for the electronic flow of information; integrating health IT education into the training of healthcare professionals; and, promoting interoperable clinical data repositories. » $1 billion to be made available for renovation and repair of health centers and for the acquisition of health IT systems. » $550 million for – among other things – the purchase of equipment and services including, but not limited to, health IT within Indian Health Service facilities. » $400 million for comparative effectiveness research on how use of electronic data impacts healthcare treatments and strategies. » $300 million to support regional and sub-national efforts towards health information exchange. » $40 million to be used by the Social Security Administration to use EMRs to submit disability claims. A good starting point is to complete a readiness and/or needs assessment. Several are available online, including [one from the California Community Clinics EHR Assessment and Readiness Project](http://www.chcf.org/topics/view.cfm?itemID=106553&ref=hipaa.com). ### What Should I Know About Interfaces? URL: https://hipaa.com/what-should-i-know-about-interfaces/ Last updated: 2009-02-05T20:30:43.000Z A key quality of care benefit of an EHR is its ability to create, send out and track the provider's orders and then electronically review and route the results of those orders into the patient's record. Due to many national efforts, HL7 standard language is used to create these interfaces. When the interfaces communicate back and forth with your EMR, results can be provided to the clinician for review prior to posting into the patient record. Some specialties receive as much as 70 percent of health care information from outside sources, including information from hospitals, labs, diagnostic imaging centers, payers, referring physicians, patients and pharmacies. The most common interfaces to manage that flow of patient information include: » Practice management system » In-house and outsourced Labs » Medication management (in house pharmacy or e-prescribing) » Pathology » PACS (picture archiving and communication system) » Inbound faxes (typically comes with the EMR) Step 1 - Build an Interface Schedule Lab interfaces take the most time to coordinate. Contact your lab representative at least 90 to 120 days before you plan to go live on the system. The vendor's e-prescribing component must be certified (such as by CCHIT or SureScripts/RxHub) for you to participate in CMS' e-prescribing Reimbursement Incentive program. You may want to use the e-prescribing component early in your training. Your EMR vendor will work with you to coordinate the interface with your PM system. Count on 60 days if they have interfaced with your PM system. Add 45 to 90 days if this is their first interface with your PM system. Step 2 - Test the Interfaces Fifteen to thirty days before training test the interfaces to see if you can: » Order a lab test from the EMR to the Lab » Receive results from the Lab into the EMR » Produce a billable encounter into your PM system. Lab systems often push multiple bills for the same encounter. Do NOT skip this step. Step 3 - Approve the Interfaces Zero to fifteen days before training approve the interface and move it into production. Step 4 - Move the Interface into Production Your vendor will work with you to move your interfaces into production for training and go-live. ### How Should We Run Background Checks on Our Staff? URL: https://hipaa.com/how-should-we-run-background-checks-on-our-staff/ Last updated: 2009-02-05T18:00:49.000Z Clearance and Background Checks is an addressable standard under HIPAA's Security Rule, which means that your organization may authorize a background check for any new employee or existing workforce member who engages in activities that cause the Security Official to question clearances. As part of your compliance activities, you already determined the risks your workforce presents to your practice, and you assigned one person to own/manage this risk As part of your clearance procedures, determine which of the following you will do: » Require a written application for employment. » Require written proof of citizenship or resident alien status. » Confirm prior employment history. » Request professional/personal references and contact those references. » Confirm educational history and practicing credentials. » Verify licenses. » Verify candidate's compliance history with any regulatory or medical requirements relevant to employment. » Conduct a criminal background check using a consulting service. » Confirm application statements, as appropriate. » Require up-to-date written documentation for Federal and state tax withholding and Social Security Numbers. Document all assigned security clearances, such as passwords, building entrance pass, and office key to each workforce member, as appropriate. Expect workforce members to acknowledge in writing receipt of clearances and immediately inform the Security Official of any change in job responsibilities. Authorize your Security Official to cancel immediately any clearances when notified that a member of the workforce’s employment has terminated for any reason. ### US House of Representatives Passes SCHIP URL: https://hipaa.com/us-house-of-representatives-passes-schip/ Last updated: 2009-02-05T14:21:34.000Z After earlier Senate passage, the US House of Representatives passed the State Children’s Health Insurance Program (SCHIP) Wednesday afternoon, and President Obama signed a reauthorized SCHIP into law a few hours later. SCHIP is expected to cover additional millions of uninsured children in coming years, funded by an increase in tobacco taxes. This law provides an opportunity to spur implementation of *health information technology* in pediatric practices by tying a requirement in the HITECH legislation presently before the Senate that pediatricians begin at a date in the near future (say January 2011) to electronically upload clinical records for newborn and infant SCHIP beneficiaries to a secure centralized database in each state receiving SCHIP funds. Thereafter, these young SCHIP beneficiaries would have physician generated clinical records available in an electronic longitudinal medical record that would be securely accessible by healthcare practitioners during encounters and to the patient in a read-only format, say on a secure personal health record. Can the US do this quickly and what are the advantages? It is overdue to develop a sense of urgency about implementing electronic health records (EHRs). A number of pediatric electronic health record systems have been certified as to functionality and security by the [Certification Commission for Electronic Health Records](http://www.cchit.org/?ref=hipaa.com), and with education, training, and federal financial assistance, certified EHRs can be deployed in just under two years time. The advantages of doing so are improvement in quality of care for SCHIP beneficiaries, reduction in medical errors, built-in alerts to ensure that appropriate medical procedures such as vaccinations are done in a timely manner, and lower costs of administering healthcare. As Newt Gingrich is fond of saying, we must as a nation move away from saying “No, because…” to “Yes, if….” ### What EMR System is Best for My Practice? URL: https://hipaa.com/what-emr-system-is-best-for-my-practice/ Last updated: 2009-02-04T13:12:03.000Z Your most important question in purchasing an EMR is to ask the vendor how many specialties your size and using your practice management system have purchased this software. EMR vendors know who would be a good customer. Some vendors, for example, are better suited for a practice of 25 to 75 physicians. Others specialize in the 3 to 8 physician groups, while others provide a solution for just one specialty. You can quickly learn whether the vendor is a good fit for you by asking them to respond to a one-page Request for Information (RFI). Send the RFI to your top five vendors and ask them to respond within 30 days. Do NOT use this RFI to "kick the tires" with vendors. An RFI is your way of saying you are ready to do business. Ask the vendor to explain costs for: licensing fees, ongoing service, technical support, maintenance fees, interface fees, training, and hardware costs. Your IT consultant can advise you on infrastructure enhancements you’ll need to make to your site. Participate in online demonstrations, then narrow your selection to two vendors and invite them to come to your practice. During the visit, watch for the following: **Documentation Entry**: How many clicks does it take to enter patient information? Does the documentation entry feel clumsy or does it seem logical? Does the system provide you with ample templates? Does the system support your documentation style–dictation, data entry (keyboarding), voice recognition, handwriting recognition? **Technical Support**: Ask how often the company schedules an update (typically to fix a coding issue) or upgrade (usually because doctors have requested a new feature)? During the onsite demonstration, present the sales person with a situation you often see in your practice. **Interfaces**: How many times has your EMR system interfaced with a practice management system used by gastroenterologists? How many times has your EMR interfaced with our laboratory information systems? For more information on vendor selection, consult the *Technical and Financial Guide to EHR Implementation*, published by the American Medical Association. ### Should Our Practice Hire an IT Person to Assist With our HIT Transition? URL: https://hipaa.com/should-our-practice-hire-an-it-person-to-assist-with-our-hit-transition/ Last updated: 2009-02-03T15:22:14.000Z Vendors will provide you with a list of implementation activities for which you are responsible to complete on time. During the next 24 months as more physicians participate in reimbursement incentives, it will be critical for you to stay on schedule, or even ahead of schedule and keep your go-live date in the queue. The rule of thumb is based on the principle of threes. If there are three or fewer physicians in your practice, you should hire a part time consultant to coach an internal person through the implementation process. After your implementation, the consultant can hand off the day-to-day IT management to an internal person who also should participate in the vendor’s user groups, blogs or chats. Contract with a local IT group to assist with hardware updates, wired and wireless service and backup support. Practices with four to nine physicians typically hire an IT consultant for a period of 18 months to help navigate the implementation process. This consultant is the physician advocate and holds the vendor accountable to contract terms, as well as to train an internal person to take over as part-time internal IT management. Practices with three or more specialties (OB-GYN, Cardiology, and Urology, for example) fit into this category. Practices with ten or more physicians—or with more than one location—should hire a full-time IT person. We recommend you hire this person on a consulting basis first, and then bring them on full time if, after six months, you still want to work with this consultant. When an event causes your server or the Internet to go down, your IT person or consultant will prove his or her worth times three. A good IT person will have a clinical or practice management background and understands clinical workflow in multiple specialties. ### Senate Appropriations Committee S.336 & HITECH Report URL: https://hipaa.com/senate-appropriations-committee-s336-hitech-report/ Last updated: 2026-10-24T21:35:30.000Z US SENATE APPROPRIATIONS COMMITTEE Senate Bill S.336 Report Recommendations for Discretionary Appropriations and Mandatory Appropriations to Assist in the Economic Recovery of and Reinvestment in America AGENCY: Appropriations Committee, US Senate, 111th Congress. ACTION: Report. - [Download](https://hipaa.com/content/files/2026/10/2009%5F01%5F28%5Famerican%5Frecovery%5Fand%5Freinvestment%5Fplan%5Freport.pdf) (Requires [Acrobat Reader](http://get.adobe.com/reader/?ref=hipaa.com)) ### Testing 5010 with Trading Partners URL: https://hipaa.com/testing-5010-with-trading-partners/ Last updated: 2009-01-30T15:12:22.000Z When the 5010 final rule becomes effective on March 17, 2009, health plans can begin testing with willing trading partners the 5010 standard transactions alongside the current 4010/4010A1 transactions standards. The improvements in the 5010 version 835 Health Care Payment and Remittance Advice transaction (835) for all claim types may benefit both health plans and healthcare providers. "Correct implementation of the X12 835 will reduce phone calls to health plans, reduce appeals due to incomplete information, eliminate unnecessary customer support, and reduce the cost of sending and processing paper remittance advices" \[74 Federal Register 3298\]. Remember, use of the 5010 version 835 transaction standard "in advance of the mandatory compliance date is permissible, based upon mutual agreement by trading partners" \[74 Federal Register 3310\]. ### Senate Appropriations Committee S.336 & HITECH Provisions URL: https://hipaa.com/senate-appropriations-committee-s336-hitech-provisions/ Last updated: 2026-10-24T21:35:30.000Z US SENATE APPROPRIATIONS COMMITTEE Senate Bill S.336 Recommendations for Discretionary Appropriations and Mandatory Appropriations to Assist in the Economic Recovery of and Reinvestment in America AGENCY: Appropriations Committee, US Senate, 111th Congress. ACTION: Bill. - [Download](https://hipaa.com/content/files/2026/10/2009%5F01%5F28%5Ftext%5Fof%5Fs336%5Fthe%5Famerican%5Frecovery%5Fand%5Freinvestment%5Fplan.pdf) (Requires [Acrobat Reader](http://get.adobe.com/reader/?ref=hipaa.com)) ### Why ICD-10? URL: https://hipaa.com/why-icd-10/ Last updated: 2009-01-29T15:33:31.000Z There were four main reasons that the federal government moved to ICD-10 as a code set standard: (1) ICD-9 dates to 1979 and its functionality has been "exhausted" and does not reflect "new and changing medical advancements"; (2) Parts of the ICD-9-CM were full, which required putting codes in "topically unrelated chapters," burdensome for healthcare providers in a move toward more efficiency; (3) Insufficient detail opportunities: "\[I\]n an age of electronic health records, it does not make sense to use a coding system that lacks specificity and does not lend itself well to updates...Emerging health care technologies, new and advanced terminologies, and the need for interoperability amid the increase in electron health records (EHRs) and personal health records (PHRs) require a standard code set that is expandable and sufficiently detailed to accurately capture current and future health care information"; (4) ICD-9-CM no longer supported by the World Health Organization: "As we become a global community, it is vital our health care data represent current medical conditions and technologies, and that they are compatible with the international version of ICD-10.... In addition to the need for precise diagnosis and procedure codes for payment purposes, detain and precision in coding are critical to the national and international health care community for mortality reporting, bio-surveillance, treatment of patients, hospital management, and research" \[73 Federal Register 49799-49800\]. ### Classification Coding Systems URL: https://hipaa.com/classification-coding-systems/ Last updated: 2009-01-29T13:06:06.000Z ICD-10 diagnosis and procedure codes are "classification coding systems" useful for conducting administrative transactions. SNOMED-CT® (Systematized Nomenclature of Medicine--Clinical Terms) is a "clinically complex terminology standard" designed for the primary documentation of clinical care that will enhance interoperability with electronic health record (EHR) systems. According to the preamble of the proposed ICD-10 rule published on August 22, 2008, "The benefits of using SNOMED-CT® increase if it is linked to a classification system such as ICD-10-CM and ICD-10-PCS for the purpose of generating health information that is necessary for statistical analysis and reimbursement. The use of both SNOMED-CT® and ICD-10-CM and ICD-10-PCS brings value to the development of interoperable electronic health records (EHRs). The linkage of these two different coding systems for multiple purposes is accomplished through mapping" \[73 Federal Register 49803\]. According to the final ICD-10 rule, "plans are underway" to "link SNOMED-CT® to ICD-10 code sets" \[74 Federal Register 3332\]. ### Migrating to ICD-10 URL: https://hipaa.com/migrating-to-icd-10/ Last updated: 2009-01-28T16:08:49.000Z Under the final ICD-10 rule, all healthcare providers will utilize ICD-10-CM to code diagnoses beginning October 1, 2013\. For procedure coding under the final ICD-10 rule, physicians and all healthcare providers other than inpatient hospitals will continue to use the current procedure coding standard: Current Procedural Terminology, 4th Edition (CPT-4) and the Healthcare Common Procedure Coding System (HCPCS). Inpatient hospital services procedures will be coded using ICD-10-PCS codes, which provide facility related procedure codes suitable to inpatient environments. ### HIPAA Administrative Simplification: Modifications to Medical Data Code Set Standards to Adopt ICD-10-CM and ICD-10-PCS URL: https://hipaa.com/hipaa-administrative-simplification-modifications-to-medical-data-code-set-standards-to-adopt-icd-10-cm-and-icd-10-pcs/ Last updated: 2009-01-26T13:17:28.000Z **Standards**. The final rule adopts modifications to two code set standards in the Transactions and Code Sets final rule that required compliance by covered entities on or after October 16, 2003\. The new final rule, published in the Federal Register on January 16, 2009, modifies standard medical data code sets for coding diagnoses (ICD-10-CM) and inpatient hospital procedures (ICD-10-PCS). ICD-10-CM means International Classification of Diseases, 10th Revision, Clinical Modification for diagnosis coding, including the Official ICD-10-CM Guidelines for Coding and Reporting, as maintained and distributed by the U.S. Department of Health and Human Services (HHS). ICD-10-PCS means International Classification of Diseases, 10th Revision, Procedure Coding System for inpatient hospital procedure coding, including the Official 1cd-10-PCS Guidelines for Coding and Reporting, as maintained and distributed by HHS. Non-inpatient (ambulatory) procedures continue to be coded under the existing and new final rules using Current Procedural Terminology, 4th Edition (CPT-4) and Healthcare Common Procedure Coding Systems (HCPCS). Modification of Transaction and Code Set Rule Diagnosis and Procedure Codes: | | Current Code Set | Modified Code Set | | ------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ----------------- | | All Diagnoses | International Classification of Diseases, 9th Revision, Clinical Modification, Volumes 1 and 2, including the Official ICD-9-CM Guidelines for Coding and Reporting, known as ICD-9-CM Volumes 1 and 2 | ICD-10-CM | | Inpatient Procedures | International Classification of Diseases, 9th Revision, Clinical Modification, Volume 3, including the Official ICD-9-CM Guidelines for Coding and Reporting, known as ICD-9-CM Volume 3 | ICD-10-PCS | | Non-Inpatient Procedures | CPT-4 and HCPCS | CPT-4 and HCP | Most of the standards reflect updates. The Medicaid pharmacy subrogation standard is newly adopted, and two standards are adopted for retail pharmacy supplies and professional services. **Effective Date**. The effective date is March 17, 2009\. What is an effective date? “The effective date is the date that the policies herein take effect, and new policies are considered to be officially adopted.” \[74 Federal Register 3328\] **Compliance Date**. The compliance date for the modification of the diagnosis and procedure code rule from ICD-9 to ICD-10 is October 1, 2013\. What is the compliance date? “The compliance date is the date on which entities are required to have implemented the policies adopted in this rule.” \[74 Federal Register 3328\] October 1 was chosen to coincide with the effective date of the annual Medicare Inpatient Prospective Payment System. The ICD-10 compliance date is 21 months after the compliance date for the 5010 rule. Based on healthcare industry input, “it appears that 24 months (2 years) is the minimum amount of time that the industry needs to achieve compliance with ICD-10 once Version 5010 has moved into external (Level 2) testing,” which commences January 1, 2011 (33 months before the ICD-10 compliance date). “HHS has concluded that it would be in the health care industry’s best interests if all entities \[emphasis added\] were to comply with the ICD-10 codes set standards at the same time to ensure the accuracy and timeliness of claims and transaction processing…. The availability and use of crosswalks, mappings and guidelines should assist entities in making the switchover from ICD-9 to ICD-10 code sets on October 1, 2013, without the need for the concurrent use of both code sets \[ICD-9 and ICD-10\] in claims processing, medical record and related systems with respect to claims for services provided on the same day…. HHS believes that different compliance dates based on the size of a health plan would also be problematic since a provider has no way of knowing if a health plan qualifies as a small health plan or not.” \[74 Federal Register 3335\] As is presently the case, coding before, on, or after the compliance date is based on the date of discharge. **Testing**. “HHS has not established dates for Level 1 and Level 2 testing compliance for ICD-10 implementation. We encourage all industry segments to be ready to test their systems with ICD-10 as soon as it is feasible.” \[74 Federal Register 3336\] Recalling the definitions of Level 1 and 2 testing from the 5010 rule: » Level 1 Testing: “The level 1 testing period is the period during which covered entities perform all of their internal readiness activities in preparation for testing the new versions of the standards with their trading partners. When we refer to compliance with Level 1, we mean that a covered entity can demonstrably create and receive compliant transactions, resulting from the completion of all design/build activities and internal testing.” » Level 2 Testing: “The Level 2 testing period is the period during which covered entities are preparing to reach full production readiness with all trading partners. When a covered entity is in compliance with Level 2, it has completed end-to-end testing with each of its trading partners, and is able to operate in production mode with the new versions of the standards by the end of that period. By ‘production mode,’ we mean that covered entities can successfully exchange (accept and/or send) standard transactions and as appropriate, be able to process them successfully.” **Crosswalks**. HHS acknowledges that crosswalks or mappings of data element code values between ICD-9 and ICD-10 “will be critical.” HIPAA Administrative Simplification requires under Section 1174(b)(2)(B)(ii) of the Act that “if a code set is modified under this subsection, the modified code set shall include instructions on how data elements of health information that were encoded prior to the modification may be converted or translated so as to preserve the informational value of the data elements that existed before the modification…and in a manner that minimizes the disruption and cost of complying with such modification.” \[74 Federal Register 3337\] Bi-directional crosswalks that can translate from the old code to the new or from the new to the old are referred to General Equivalency Mappings. The National Center for Health Statistics (NCHS) of the Centers for Disease Control and Prevention (CDC) has developed a bi-directional mapping between ICD-9-CM diagnosis codes and ICD-10-CM, which is available on line at the [CDC website](http://www.cdc.gov/nchs/about/otheract/icd9/icd10cm.htm?ref=hipaa.com). The Centers for Medicare and Medicaid Services (CMS) has developed bi-directional mappings between ICD-9-CM Volume 3 and ICD-10-PCS and a guide for using the mappings, which is available [here](http://www.cms.hhs.gov/ICD10/01m%5F2009%5FICD10PCS.asp?ref=hipaa.com). ### Companion Guides URL: https://hipaa.com/companion-guides/ Last updated: 2009-01-23T11:50:36.000Z HHS notes that "the improvements to Version 5010 should minimize dependence on companion guides... and "strongly discourage\[s\] health plans from having companion guides unless they are focused significantly on the basics for continuity, trading partner arrangements, and use of situational data elements.... \[I\]f companion guides contradict the implementation guides, the transaction will not be compliant." \[74 FR 3307-3308\] ### Dual Use of Existing Standards URL: https://hipaa.com/dual-use-of-existing-standards/ Last updated: 2009-01-22T19:22:55.000Z Note that HHS permits the dual use of existing standards (4010/4010A1 and 5.1) and the new standards (5010 and D.0) from the March 17, 2009, effective date until the January 1, 2012 compliance date, to facilitate testing and subject to trading partner agreement. ### New HIPAA Standard Transaction Rules Released URL: https://hipaa.com/new-hipaa-standard-transaction-rules-released/ Last updated: 2009-01-22T03:26:47.000Z On Friday, January 16, 2009, the Office of the Secretary of the Department of Health and Human Services published in the Federal Register final rules pertaining to: Health Insurance Reform; [*Modifications to the Health Insurance Portability and Accountability Act (HIPAA) Electronic Transaction Standards (74 Federal Register 3295-3328)*](http://www.hipaa.com/2009/01/final-5010-rule/?ref=hipaa.com); and, [HIPAA Administrative Simplification: Modifications to Medical Data Code Set Standards to Adopt ICD-10-CM and ICD-10-PCS (74 Federal Register 3328-3362)](http://www.hipaa.com/2009/01/final-icd-10-rule/?ref=hipaa.com). **Health Insurance Reform; Modifications to the Health Insurance Portability and Accountability Act (HIPAA) Electronic Transaction Standards** **Standards**. This final rule adopts Accredited Standards Committee (ASC) X12 Version 5010 and National Council for Prescription Drug Programs (NCPDP) Versions D.0, 3.0, and 5.1 standards for electronic transactions, as reproduced from Table 1 in the final rule pp. (3296-3297): | ASC X12 837D | Health care claims—Dental | | -------------------------- | ------------------------------------------------------------------------------------------------------- | | ASC X12 837P | Health care claims—Professional | | ASC X12 837I | Health care claims—Institutional | | NCPDP D.0 | Health care claims—Retail pharmacy drug | | ASC X12 837P and NCPDP D.0 | Health care claims—Retail pharmacy supplies and professional services | | NCPDP D.0 | Coordination of Benefits—Retail pharmacy drug | | ASC X12 837D | Coordination of benefits—Dental | | ASC X12 837P | Coordination of benefits—Professional | | ASC X12 837I | Coordination of benefits—Institutional | | ASC X12 270/271 | Eligibility for a health plan (request and response)—Dental, professional, and institutional | | NCPDP D.0 | Eligibility for a health plan (request and response)—Retail pharmacy drugs | | ASC X12 276/277 | Health care claim status (request and response) | | ASC X12 834 | Enrollment and dis-enrollment in a health plan | | ASC X12 835 | Health care payment and remittance advice | | ASC X12 820 | Health plan premium payment | | ASC X12 278 | Referral certification and authorization (request and response)—Dental, professional, and institutional | | NCPDP D.0 | Referral certification and authorization (request and response)—Retail pharmacy drugs | | NCPDP 5.1 and NCPDP D.0: | Retail pharmacy drug claims (telecommunication and batch standards) | | NCPDP 3.0 | Medicaid pharmacy subrogation (batch standard | Most of the standards reflect updates. The Medicaid pharmacy subrogation standard is newly adopted, and two standards are adopted for retail pharmacy supplies and professional services. **Effective Dates**. There are two effective dates for this final rule. For all of the standards except the Medicaid pharmacy subrogation transaction, the effective date is March 17, 2009\. For the Medicaid pharmacy subrogation transaction standard, the effective date is January 1, 2010\. What is an effective date? “\[T\]he effective date is the date that the policies set forth in this final rule take effect, and new policies are considered to be officially adopted (p.3302).” **Compliance Dates**. With one exception, all covered entities must comply with the standards in the final rule by January 1, 2012\. The exception is that small health plans have an additional year to January 1, 2013 to comply with the Medicaid pharmacy subrogation standard. Please note the following discussion in the preamble to the final rule on page 3303: “Covered entities are urged to begin preparations now, to incorporate effective planning, collaboration and testing in their implementation strategies, and to identity and mitigate any barriers long before the deadline. While we have authorized contingency plans in the past, we do not intend to do so in this case, as such an action would likely adversely impact ICD-10 implementation activities. HIPAA gives us \[HHS\] authority to invoke civil money penalties against covered entities who do not comply with the standards, and we have been encouraged by industry to use our authority on a wider scale.” \[emphasis added\] **Testing Dates**. Again, referring to the preamble of this final rule (pp.3302-3303), HHS outlines expectations for covered entities to conduct two levels of testing of the standard transactions. To facilitate testing from the effective date of the final rule (March 17, 2009) until the compliance date (January 1, 2012), HHS permits, subject to trading partner agreement, “dual use of standards during that timeframe, so that either Version 4010/4010A1 or Version 5010, and either Version 5.1 or D.0, may be used.” Level 1 Testing: “The level 1 testing period is the period during which covered entities perform all of their internal readiness activities in preparation for testing the new versions of the standards with their trading partners. When we refer to compliance with Level 1, we mean that a covered entity can demonstrably create and receive compliant transactions, resulting from the completion of all design/build activities and internal testing.” » January 2009: Begin Level 1 testing period activities (gap analysis, design, development, internal testing) for Versions 5010 and D.0. » January 2010: Begin internal testing for Versions 5010 and D.0\. » December 31, 2010: Achieve Level 1 compliance (Covered entities have completed internal testing and can send and receive compliant transactions) for Versions 5010 and D.0. Level 2 Testing: “The Level 2 testing period is the period during which covered entities are preparing to reach full production readiness with all trading partners. When a covered entity is in compliance with Level 2, it has completed end-to-end testing with each of its trading partners, and is able to operate in production mode with the new versions of the standards by the end of that period. By ‘production mode,’ we mean that covered entities can successfully exchange (accept and/or send) standard transactions and as appropriate, be able to process them successfully.” » January 2011: Begin Level 2 testing period activities (end-to-end testing with trading partners, achieve production mode exchange of appropriate standard transactions with trading partners). » January 1, 2012: “\[A\]ll covered entities will have reached Level 2 compliance, and must be fully compliant in using Versions 5010 and D.0 exclusively. ### 5010 Testing URL: https://hipaa.com/5010-testing/ Last updated: 2009-01-21T14:41:13.000Z HHS recommends that the first of two testing levels of Version 5010 and D.0 begin now for all covered entities to achieve compliance beginning January 1, 2012\. HHS expects no contingency period beyond that date and may impose civil penalties for non-compliance. ### Final 5010 Rule URL: https://hipaa.com/final-5010-rule/ Last updated: 2009-01-19T23:21:12.000Z DEPARTMENT OF HEALTH AND HUMAN SERVICES 45 CFR Part 162 | \[CMS–0009–F\] | RIN 0938–AM50 Health Insurance Reform; Modifications to the Health Insurance Portability and Accountability Act (HIPAA) Electronic Transaction Standards AGENCY: Office of the Secretary, HHS. ACTION: Final rule. - [Download](http://www.hipaa.com/wp-content/uploads/2009/01/e9-740.pdf?ref=hipaa.com) (Requires [Acrobat Reader](http://get.adobe.com/reader/?ref=hipaa.com)) ### Final ICD-10 Rule URL: https://hipaa.com/final-icd-10-rule/ Last updated: 2026-10-24T21:35:33.000Z DEPARTMENT OF HEALTH AND HUMAN SERVICES 45 CFR Part 162 | \[CMS–0013–F\] | RIN 0958–AN25 HIPAA Administrative Simplification; Modifications to the Medical Data Code Set Standards to Adopt ICD-10-CM and ICD-10-PCS AGENCY: Office of the Secretary, HHS. ACTION: Final rule. - [Download](https://hipaa.com/content/files/2026/10/e9-743.pdf) (Requires [Acrobat Reader](http://get.adobe.com/reader/?ref=hipaa.com)) ### NIST Guide for Implementing HIPAA Security Rule URL: https://hipaa.com/nist-guide-for-implementing-hipaa-security-rule/ Last updated: 2009-01-19T18:21:54.000Z US DEPARTMENT OF COMMERCE National Institute of Standards and Technology NIST Special Publication 800–66 Revision 1 - [Download](http://www.hipaa.com/wp-content/uploads/2009/01/sp-800-66-revision1.pdf?ref=hipaa.com) (Requires [Acrobat Reader](http://get.adobe.com/reader/?ref=hipaa.com)) ### Personal Health Records (PHRs) and the HIPAA Privacy Rule URL: https://hipaa.com/personal-health-records-phrs-and-the-hipaa-privacy-rule/ Last updated: 2026-10-24T21:35:35.000Z U.S. Department of Health and Human Services, Office for Civil Rights - [Download](https://hipaa.com/content/files/2026/10/phr.pdf) (Requires [Acrobat Reader](http://get.adobe.com/reader/?ref=hipaa.com)) ### The HIPAA Privacy Rule's Right of Access and Health Information Technology URL: https://hipaa.com/the-hipaa-privacy-rules-right-of-access-and-health-information-technology/ Last updated: 2026-10-24T21:35:35.000Z U.S. Department of Health and Human Services, Office for Civil Rights - [Download](https://hipaa.com/content/files/2026/10/eaccess.pdf) (Requires [Acrobat Reader](http://get.adobe.com/reader/?ref=hipaa.com)) ### Privacy and Security Framework: Accountability Principle and FAQs URL: https://hipaa.com/privacy-and-security-framework-accountability-principle-and-faqs/ Last updated: 2026-10-24T21:35:36.000Z U.S. Department of Health and Human Services, Office for Civil Rights - [Download](https://hipaa.com/content/files/2026/10/accountabilityprinciple.pdf) (Requires [Acrobat Reader](http://get.adobe.com/reader/?ref=hipaa.com)) ### Privacy and Security Framework: Safeguards Principle and FAQs URL: https://hipaa.com/privacy-and-security-framework-safeguards-principle-and-faqs/ Last updated: 2026-10-24T21:35:36.000Z U.S. Department of Health and Human Services, Office for Civil Rights - [Download](https://hipaa.com/content/files/2026/10/safeguardsprinciple.pdf) (Requires [Acrobat Reader](http://get.adobe.com/reader/?ref=hipaa.com)) ### Privacy and Security Framework: Collection, Use, and Disclosure Limitation Principle and FAQs URL: https://hipaa.com/privacy-and-security-framework-collection-use-and-disclosure-limitation-principle-and-faqs/ Last updated: 2026-10-24T21:35:37.000Z U.S. Department of Health and Human Services, Office for Civil Rights - [Download](https://hipaa.com/content/files/2026/10/collectionusedisclosure.pdf) (Requires [Acrobat Reader](http://get.adobe.com/reader/?ref=hipaa.com)) ### Privacy and Security Framework: Individual Choice Principle and FAQs URL: https://hipaa.com/privacy-and-security-framework-individual-choice-principle-and-faqs/ Last updated: 2026-10-24T21:35:37.000Z U.S. Department of Health and Human Services, Office for Civil Rights - [Download](https://hipaa.com/content/files/2026/10/individualchoiceprinciple.pdf) (Requires [Acrobat Reader](http://get.adobe.com/reader/?ref=hipaa.com)) ### Privacy and Security Framework: Openness and Transparency Principle and FAQs URL: https://hipaa.com/privacy-and-security-framework-openness-and-transparency-principle-and-faqs/ Last updated: 2026-10-24T21:35:38.000Z U.S. Department of Health and Human Services, Office for Civil Rights - [Download](https://hipaa.com/content/files/2026/10/opennesstransparencyprinciple.pdf) (Requires [Acrobat Reader](http://get.adobe.com/reader/?ref=hipaa.com)) ### Privacy and Security Framework: Correction Principle and FAQs URL: https://hipaa.com/privacy-and-security-framework-correction-principle-and-faqs/ Last updated: 2026-10-24T21:35:38.000Z U.S. Department of Health and Human Services, Office for Civil Rights - [Download](https://hipaa.com/content/files/2026/10/correctionprinciple.pdf) (Requires [Acrobat Reader](http://get.adobe.com/reader/?ref=hipaa.com)) ### Privacy and Security Framework: Introduction URL: https://hipaa.com/privacy-and-security-framework-introduction/ Last updated: 2009-01-19T17:20:31.000Z U.S. Department of Health and Human Services, Office for Civil Rights - [Download](http://www.hipaa.com/wp-content/uploads/2009/01/introduction.pdf?ref=hipaa.com) (Requires [Acrobat Reader](http://get.adobe.com/reader/?ref=hipaa.com)) ### Final HIPAA Enforcement Rule URL: https://hipaa.com/final-hipaa-enforcement-rule/ Last updated: 2026-10-24T21:35:40.000Z DEPARTMENT OF HEALTH AND HUMAN SERVICES Office of the Secretary 45 CFR Parts 160 and 164 | RIN 0991–AB29 HIPAA Administrative Simplification: Enforcement AGENCY: Office of the Secretary, HHS. ACTION: Final rule. - [Download](https://hipaa.com/content/files/2026/10/enforcementrule.pdf) (Requires [Acrobat Reader](http://get.adobe.com/reader/?ref=hipaa.com)) ### Proposed Rule for Electronic Claims Attachments URL: https://hipaa.com/proposed-rule-for-electronic-claims-attachments/ Last updated: 2026-10-24T21:35:41.000Z DEPARTMENT OF HEALTH AND HUMAN SERVICES Office of the Secretary 45 CFR Part 162 | \[CMS–0050–P\] | RIN 0938–AK62 HIPAA Administrative Simplification: Standards for Electronic Health Care Claims Attachments AGENCY: Office of the Secretary, HHS. ACTION: Proposed rule. - [Download](https://hipaa.com/content/files/2026/10/proposedruleclaimsattachments.pdf) (Requires [Acrobat Reader](http://get.adobe.com/reader/?ref=hipaa.com)) ### Provider's Guide to Privacy Rule URL: https://hipaa.com/providers-guide-to-privacy-rule/ Last updated: 2026-10-24T21:35:41.000Z A HEALTH CARE PROVIDER’S GUIDE TO THE HIPAA PRIVACY RULE US Department of Health and Human Services, Office for Civil Rights - [Download](https://hipaa.com/content/files/2026/10/provider%5Fffg.pdf) (Requires [Acrobat Reader](http://get.adobe.com/reader/?ref=hipaa.com)) ### Patient's Guide to Privacy Rule URL: https://hipaa.com/patients-guide-to-privacy-rule/ Last updated: 2026-10-24T21:35:41.000Z A PATIENT’S GUIDE TO THE HIPAA PRIVACY RULE U.S. Department of Health and Human Services, Office for Civil Rights - [Download](https://hipaa.com/content/files/2026/10/consumer%5Fffg.pdf) (Requires [Acrobat Reader](http://get.adobe.com/reader/?ref=hipaa.com)) ### National Provider Identifier Final Rule URL: https://hipaa.com/national-provider-identifier-final-rule/ Last updated: 2026-10-24T21:35:42.000Z DEPARTMENT OF HEALTH AND HUMAN SERVICES Office of the Secretary 45 CFR Part 162 | \[CMS–0045–F\] | RIN 0938–AH99 HIPAA Administrative Simplification: Standard Unique Health Identifier for Health Care Providers AGENCY: Centers for Medicare & Medicaid Services, HHS. ACTION: Final rule. - [Download](https://hipaa.com/content/files/2026/10/npifinalrule.pdf) (Requires [Acrobat Reader](http://get.adobe.com/reader/?ref=hipaa.com)) ### Privacy Summary URL: https://hipaa.com/privacy-summary/ Last updated: 2026-10-24T21:35:43.000Z SUMMARY OF THE HIPAA PRIVACY RULE HIPAA Compliance Assistance AGENCY: Office for Civil Rights, HHS. - [Download](https://hipaa.com/content/files/2026/10/privacysummary.pdf) (Requires [Acrobat Reader](http://get.adobe.com/reader/?ref=hipaa.com)) ### Privacy Guidance URL: https://hipaa.com/privacy-guidance/ Last updated: 2026-10-24T21:35:43.000Z STANDARDS FOR PRIVACY OF INDIVIDUALLY IDENTIFIABLE HEALTH INFORMATION 45 CFR Parts 160 and 164 AGENCY: Office for Civil Rights, HHS. - [Download](https://hipaa.com/content/files/2026/10/guidanceallsections.pdf) (Requires [Acrobat Reader](http://get.adobe.com/reader/?ref=hipaa.com)) ### Final Security Rule URL: https://hipaa.com/final-security-rule/ Last updated: 2026-10-24T21:35:44.000Z DEPARTMENT OF HEALTH AND HUMAN SERVICES Office of the Secretary 45 CFR Parts 160, 162, and 164 | \[CMS–0049–F\] | RIN 0938–AI57 Health Insurance Reform: Security Standards AGENCY: Centers for Medicare & Medicaid Services (CMS), HHS. ACTION: Final rule. - [Download](https://hipaa.com/content/files/2026/10/securityfinalrule.pdf) (Requires [Acrobat Reader](http://get.adobe.com/reader/?ref=hipaa.com)) ### Final Privacy Rule URL: https://hipaa.com/final-privacy-rule/ Last updated: 2026-10-24T21:35:44.000Z DEPARTMENT OF HEALTH AND HUMAN SERVICES Office of the Secretary 45 CFR Parts 160 and 164 | RIN 0991–AB14 Standards for Privacy of Individually Identifiable Health Information AGENCY: Office for Civil Rights, HHS. ACTION: Final rule. - [Download](https://hipaa.com/content/files/2026/10/privrulepd.pdf) (Requires [Acrobat Reader](http://get.adobe.com/reader/?ref=hipaa.com)) ### Employer Identifier Final Rule URL: https://hipaa.com/employer-identifier-final-rule/ Last updated: 2026-10-24T21:35:45.000Z DEPARTMENT OF HEALTH AND HUMAN SERVICES Office of the Secretary 45 CFR Parts 160 and 162 | \[CMS–0047–F\] | RIN 0938–AI59 Health Insurance Reform: Standard Unique Employer Identifier AGENCY: Centers for Medicare and Medicaid Services (CMS), HHS. ACTION: Final rule. - [Download](https://hipaa.com/content/files/2026/10/empidfinal.pdf) (Requires [Acrobat Reader](http://get.adobe.com/reader/?ref=hipaa.com)) ### Final Transactions Rule Corrections URL: https://hipaa.com/final-transactions-rule-corrections/ Last updated: 2009-01-19T15:29:07.000Z DEPARTMENT OF HEALTH AND HUMAN SERVICES Office of the Secretary 45 CFR Parts 160 and 162 | \[HCFA0149CN\] | RIN 0938AI58 Health Insurance Reform: Standards for Electronic Transactions; Correction AGENCY: Office of the Secretary, HHS. ACTION: Correction of final rule. - [Download](http://www.hipaa.com/wp-content/uploads/2009/01/standardsforelectronictransactions-corrections.pdf?ref=hipaa.com) (Requires [Acrobat Reader](http://get.adobe.com/reader/?ref=hipaa.com)) ### Final Transactions Rule URL: https://hipaa.com/final-transactions-rule/ Last updated: 2009-01-19T15:28:33.000Z DEPARTMENT OF HEALTH AND HUMAN SERVICES Office of the Secretary 45 CFR Parts 160 and 162 | \[HCFA–0149–F\] | RIN 0938–AI58 Health Insurance Reform: Standards for Electronic Transactions AGENCY: Office of the Secretary, HHS. ACTION: Final rule. - [Download](http://www.hipaa.com/wp-content/uploads/2009/01/txfinal.pdf?ref=hipaa.com) (Requires [Acrobat Reader](http://get.adobe.com/reader/?ref=hipaa.com)) ### HIPAA Law, Administrative Simplification Provisions URL: https://hipaa.com/hipaa-law-administrative-simplification-provisions/ Last updated: 2026-10-24T21:35:47.000Z HEALTH INSURANCE PORTABILITY AND ACCOUNTABILITY ACT OF 1996 Public Law 104-191 104th Congress - [Download](https://hipaa.com/content/files/2026/10/hipaalaw.pdf) (Requires [Acrobat Reader](http://get.adobe.com/reader/?ref=hipaa.com)) ### Proposed 5010 Rule URL: https://hipaa.com/proposed-5010-rule/ Last updated: 2026-10-24T21:35:48.000Z DEPARTMENT OF HEALTH AND HUMAN SERVICES 45 CFR Part 162 | \[CMS–0009–P\] | RIN 0938–AM50 Health Insurance Reform; Modifications to the Health Insurance Portability and Accountability Act (HIPAA) Electronic Transaction Standards AGENCY: Office of the Secretary, HHS. ACTION: Proposed rule. - [Download](https://hipaa.com/content/files/2026/10/e8-192961.pdf) (Requires [Acrobat Reader](http://get.adobe.com/reader/?ref=hipaa.com)) ### Proposed ICD-10 Rule URL: https://hipaa.com/proposed-icd-10-rule/ Last updated: 2026-10-24T21:35:49.000Z DEPARTMENT OF HEALTH AND HUMAN SERVICES Office of the Secretary 45 CFR Parts 160 and 162 | \[CMS–0013–P\] | RIN 0958–AN25 HIPAA Administrative Simplification: Modification to Medical Data Code Set Standards To Adopt ICD–10–CM and ICD–10–PCS AGENCY: Office of the Secretary, HHS. ACTION: Proposed rule. - [Download](https://hipaa.com/content/files/2026/10/e8-19298.pdf) (Requires [Acrobat Reader](http://get.adobe.com/reader/?ref=hipaa.com)) ### HIPAA Administrative Simplification: Standards for Electronic Health Care Claims Attachments URL: https://hipaa.com/hipaa-administrative-simplification-standards-for-electronic-health-care-claims-attachments/ Last updated: 2026-10-24T21:35:55.000Z HIPAA ADMINISTRATIVE SIMPLIFICATION: STANDARDS FOR ELECTRONIC HEALTH CARE CLAIMS ATTACHMENTS 45 CFR Parts 162 AGENCY: Office of the Secretary, Department of Health and Human Services. ACTION: Proposed Rule. - [Download](https://hipaa.com/content/files/2026/10/05-18927.pdf) (Requires [Acrobat Reader](http://get.adobe.com/reader/?ref=hipaa.com)) ### Standards for Privacy of Individually Identifiable Health Information URL: https://hipaa.com/standards-for-privacy-of-individually-identifiable-health-information/ Last updated: 2026-10-24T21:35:56.000Z STANDARDS FOR PRIVACY OF INDIVIDUALLY IDENTIFIABLE HEALTH INFORMATION 45 CFR Parts 16 and 164 AGENCY: Office of the Secretary, Department of Health and Human Services. ACTION: Final Rule. - [Download](https://hipaa.com/content/files/2026/10/prdecember2000all8parts.pdf) (Requires [Acrobat Reader](http://get.adobe.com/reader/?ref=hipaa.com))