ARRA’s HITECH Privacy Provisions Apply HIPAA Security Rule to Business Associates

President Obama signed into law the American Recovery and Reinvestment Act of 2009 (ARRA) on Tuesday, February 17, 2009. The Health Information Technology for Economic and Clinical Health Act (HITECH) provisions of ARRA in Title XIII include important changes in Privacy (Subtitle D). Our focus in this posting is the change related to business associates under HIPAA Administrative Simplification that is specified in Section 13401: Application of Security Provisions and Penalties to Business Associates of Covered Entities. In this section, administrative, physical, and technical safeguards, and policy, procedure, and documentation requirements of the HIPAA Administrative Simplification Security Rule “shall apply to a business associate of a covered entity in the…

Ed JonesAmerican Recovery and Reinvestment ActARRA, business associates, covered entities, health information technology, Health Information Technology for Economic and Clinical Health Act, health IT, HHS, HIPAA Administrative Simplification, HIT, HITECH, Obama, Privacy, Security Rule, unsecured protected health informationLeave a comment

American Recovery and Reinvestment Act of 2009

ONE HUNDRED ELEVENTH CONGRESS of the UNITED STATES of AMERICA American Recovery and Reinvestment Act of 2009 Making supplemental appropriations for job preservation and creation, infrastructure investment, energy efficiency and science, assistance to the unemployed, and State and local fiscal stabilization, for the fiscal year ending September 30, 2009, and for other purposes. AGENCY: 111th US Congress. ACTION: Act. Download (Requires Acrobat Reader)

Ed JonesAmerican Recovery and Reinvestment Act2011, American Recovery and Reinvestment Act, ARRA, Baby Boomers, certification criteria, Congressional Record, Consistency, data elements, Decade of Health Information Technology., Division A, Division B, Health Information Portability and Accountability, health information technology, Health Information Technology for Economic and Clinical Health Act, HIPAA, HITECH, HITECH Act, house, House and Senate Conferees, interoperable, Meaningful, Medicare, President Obama, privacy safeguards, protected health information, qualified electronic health record, Section 1173, Senate, Social Security Act, standard, Standards, Title IV, Title XIII, transactionsLeave a comment

President Obama to Sign ARRA’s HITECH provisions Tuesday, February 17, 2009, in Denver, CO

The Senate joined the House on Friday evening, February 13, 2009, in passing the American Recovery and Reinvestment Act, which includes provisions relating to Health Information Technology. Title XIII of Division A and Title IV of Division B together are known as the “Health Information Technology for Economic and Clinical Health Act” or the “HITECH Act.” We will be highlighting attributes of the HITECH Act through the end of February. Contrary to the political blather, this legislation is a significant step forward in providing funding and incentives to accelerate adoption of standardized and interoperable electronic business and clinical technologies in healthcare and in strengthening privacy safeguards for patients’ protected health…

Ed JonesHealth IT and HITECH2011, American Recovery and Reinvestment Act, ARRA, Baby Boomers, certification criteria, Congressional Record, Consistency, data elements, Decade of Health Information Technology., Division A, Division B, Health Information Portability and Accountability, health information technology, Health Information Technology for Economic and Clinical Health Act, HIPAA, HITECH, HITECH Act, house, House and Senate Conferees, interoperable, Meaningful, Medicare, President Obama, privacy safeguards, protected health information, qualified electronic health record, Section 1173, Senate, Social Security Act, standard, Standards, Title IV, Title XIII, transactionsLeave a comment

Security Management Process: Risk Analysis-What to Do and How to Do It

Security Management Process is the first administrative standard of the Security Rule, and Risk Analysis is the implementation specification. Each covered entity is required to conduct a risk analysis or assessment to determine vulnerabilities and threats and to identify and put in place risk mitigation measures for safeguarding electronic protected health information. Electronic protected health information is the content of the HIPAA Administrative Simplification Standard Transactions and of the expected growing adoption of clinically-based electronic health record systems. What to do: Conduct an accurate and thorough assessment of potential risks and vulnerabilities to the confidentiality, integrity, and availability of electronic protected health information held by the covered entity. How to…

Ed JonesHealth IT and HITECHadministrative standard, appropriateness, availability, confidentiality, covered entity, electronic health record systems, electronic protected health information, HIPAA Administrative Simplification, HIPAA PRIVACY RULE, How to do it, impact, implementation specification, integrity, liabilities, National Institute of Standards and Technology, NIST, privacy breach, reasonableness, risk, Risk Analysis, risk mitigation measures, safeguarding, scalability, security incident, Security Management Process, security methods and measures, security policies and procedures, Security Rule, threat risks, threat sources, threats, Transaction Standards, vulnerabilities, What to doLeave a comment

Time to Review Your Security Risk Assessment

With the March 17, 2009 effective dates for the new 5010 Version of HIPAA Administrative Simplification Transaction Standards and the move to the ICD-10 Code Set Standard rules, and the expected enactment of the HITECH provisions of the American Recovery and Reinvestment Act as early as next week, it is a good time now to begin reviewing your HIPAA Administrative Simplification Security safeguards. As mentioned earlier this week, creating and periodically reviewing your risk assessment or analysis is the foundation of achieving compliance with the HIPAA Administrative Simplification Security Rule and a key factor in having a successful business. Over the next week, HIPAA.com will review the Security Rule administrative,…

Ed JonesHealth IT and HITECHhealth information technology, HIT, implementation specifications, policies, procedures, Risk Analysis, risk mitigation measures, StandardsLeave a comment

Are You Subject to HIPAA Privacy Rules when Publishing Confidential Health Information on a Social Network?

It’s unlikely the social networking sites are health care providers, so HIPAA’s privacy rule doesn’t apply; but other privacy business practices are likely to affect you. First, tackle the HIPAA Privacy question by responding to the following questions. » Are you a healthcare provider that conducts transactions electronically? » Are you a healthcare clearinghouse? (Do you process healthcare claims?) » Are you a health plan? (insurance payer) If you answered no to these questions, you are not a covered entity under HIPAA’s Privacy Rule. That said, you probably are more concerned about users sharing health information online that if stolen, could be used in identity theft. Consumers (patients) often use…

Carolyn HartleyEnforcement, Health IT and HITECH, Privacycovered entity, electronic health record systems, electronic health records, electronic medical records, electronic transactions, EMR, facebook, health information technology, health plans, healthcare, HIT, Internet, myspace, network, PHR, portals, Privacy, social networking, twitterLeave a comment

House and Senate Agree on ARRA Provisions

On Wednesday, February 11, 2009, House and Senate conferees reconciled the House and Senate versions of the American Recovery and Reinvestment (ARRA) plan, or so-called Stimulus bill. The House and Senate are expected to approve the final version this week and send it to President Obama for his signature. The total of the stimulus is just over $789 billion. The Wall Street Journal reported this morning that “$19 billion is set aside for health information technology. Physicians would get bonuses of between $44,000 and $64,000—and hospitals would get as much as $11 million—if they show they have computerized their medical-records systems. On the stick side of the equation, the measure…

Ed JonesAmerican Recovery and Reinvestment Act, Health IT and HITECHAmerican Recovery and Reinvestment Act of 2009, ARRA, EHR, electronic health records, health informationt technology, HIT, house, Medicare, President Obama, SenateLeave a comment

Senate Passes American Recovery and Reinvestment Act of 2009 (ARRA)

Tuesday afternoon the Senate passed the American Recovery and Reinvestment Act, the so-called Economic Stimulus bill. Previously, the House of Representatives passed its version, H.R. 1. Now, the joint House-Senate conference committee will resolve funding and language differences in the House and Senate versions of ARRA. As we have noted earlier, each of these versions contains incentives for adoption of health information technologies, which are described in the so-called HITECH provisions of the House and Senate versions. President Obama is expected to sign a reconciled bill in the near future, assuming that the Democrats in the Senate can achieve at least 60 votes in a procedural motion to move the…

Ed JonesAmerican Recovery and Reinvestment Acteconomic stimulus, H.R. 1, health information technology, HIT, HITECH, Obama, risk assesmentLeave a comment

What Does the HITECH Act Mean to You?

Even though the US Senate is likely to pass the stimulus package in the next day or two, the House and Senate still have to come to an agreement on their funding differences. The HITECH Act is still holding its own with some possible additions to the $20 billion agreed upon by the House. Key words used by both House and Senate are “meaningful use” and “shovel ready”. In other words, everything is set in place ready to go, but just needs money to get it off the ground. You’ve made a decision on your health IT system, you’ve completed your readiness assessments, and you’ve built a strategy to move…

Carolyn HartleyHealth IT and HITECHAmerican Recovery and Reinvestment Act of 2009, Appropriations Committee, health information technology, HIT, HITECH, House of Representatives, S.336, SenateLeave a comment

What Should I Know About Interfaces?

A key quality of care benefit of an EHR is its ability to create, send out and track the provider’s orders and then electronically review and route the results of those orders into the patient’s record. Due to many national efforts, HL7 standard language is used to create these interfaces. When the interfaces communicate back and forth with your EMR, results can be provided to the clinician for review prior to posting into the patient record. Some specialties receive as much as 70 percent of health care information from outside sources, including information from hospitals, labs, diagnostic imaging centers, payers, referring physicians, patients and pharmacies. The most common interfaces to…

Carolyn HartleyHealth IT and HITECHCCHIT, CMS, e-prescribing, EHR, EHR interfaces, EMR, EMR interfaces, EMR selection, EMR vendor, eprescribing, health information technology, health IT, HIT, HITECH, HL7, interfaces, PACSLeave a comment