HIPAA Final Rule: Enforcement: Willful Neglect

February 20, 2013. Today, we begin examination of HITECH Act modifications of HIPAA Enforcement, focusing on the meaning and consequences of willful neglect in the Final Rule: Modifications to the HIPAA Privacy, Security, Enforcement, and Breach Notification Rules Under the Health Information Technology for Economic and Clinical Health Act [HITECH Act] and the Genetic Information Nondiscrimination Act; Other Modifications of the HIPAA Rules, which was published in the Federal Register on January 25, 2013. The effective date of the Final Rule is March 26, 2013, and covered entities and business associates must comply by September 23, 2013. Willful neglect is defined as “conscious, intentional failure or reckless indifference to the…

Ed JonesAmerican Recovery and Reinvestment Act, Enforcement, Health IT and HITECH, HIPAA Law, Privacy, SecurityAdministrative Simplification, business associate, civil money penalty, complaint, Complaint Investigations, compliance date, compliance reviews, covered entity, discretion, effective date, Enforcement, Enforcement Rule, Federal Register, formal enforcement, HIPAA complaints, HIPAA enforcement, HIPAA Final Rule, HIPAA rules, HITECH Act, investigation, March 26 2013, Modifications, noncompliance, October 30 2009, penalty, possible violation, preliminary review, required investigation, Secretary, section 1176(c), September 23 2013, Social Security Act, STAT., violation, voluntary corrective action, will investigate, willful neglectLeave a comment

HIPAA Final Rule: Genetic Information Nondiscrimination Act: Manifestation or Manifested

February 19, 2013. Today, we finish examination of modifications of HIPAA Privacy under the Genetic Information Nondiscrimination Act (GINA), by focusing on the definition: manifestation or manifested. The modifications of HIPAA Privacy are in the Final Rule: Modifications to the HIPAA Privacy, Security, Enforcement, and Breach Notification Rules Under the Health Information Technology for Economic and Clinical Health Act [HITECH Act] and the Genetic Information Nondiscrimination Act; Other Modifications of the HIPAA Rules, which was published in the Federal Register on January 25, 2013. The effective date of the Final Rule is March 26, 2013, and covered entities and business associates must comply by September 23, 2013. We presented in…

Ed JonesAmerican Recovery and Reinvestment Act, Enforcement, Health Care Reform, Health IT and HITECH, PrivacyAffordable Care Act, compliance date, contribution, covered entity, create, definition, Disclose, disease, effective date, Enforcement, family medical history, family member, Federal Register, Final rule, genetic information, Genetic Information Nondiscrimination Act, genetic test, GINA, Health Care Provider, health plan, HIPAA Final Rule, HITECH Act, HMO, maintain, manifestation, manifested, March 20 2010, March 26 2013, medical appropriateness of a benefit, preamble, premium, Privacy Rule, receive, September 23 2013, Treatment, underwriting purposesLeave a comment

HIPAA Final Rule: Genetic Information Nondiscrimination Act: Underwriting Prohibitions

February 18, 2013. Today, we examine underwriting prohibitions as they relate to modifications of the HIPAA Privacy Rule required under the Genetic Information Nondiscrimination Act (GINA). These modifications are in the Final Rule: Modifications to the HIPAA Privacy, Security, Enforcement, and Breach Notification Rules Under the Health Information Technology for Economic and Clinical Health Act [HITECH Act] and the Genetic Information Nondiscrimination Act; Other Modifications of the HIPAA Rules, which was published in the Federal Register on January 25, 2013. The effective date of the Final Rule is March 26, 2013, and covered entities and business associates must comply by September 23, 2013. The Final Rule states: “The final rule…

Ed JonesGINA, Health IT and HITECH, HIPAA Law, Privacycompliance date, coverage, covered entity, Disclose, effective date, eligibility, enrollment, Federal Register, Genetic Information Nondiscrimination Act, GINA, health risk assessment, HIPAA Final Rule, HIPAA PRIVACY RULE, long-term care insurance market, long-term care plan, March 26 2013, Modifications, premium differential mechanism, privacy interest, prohibited uses and disclosures, protected health information, required or permitted, September 23 2013, underwriting, underwriting prohibition, underwriting purposes, wellness programLeave a comment

HIPAA Final Rule: Genetic Information Nondiscrimination Act (GINA) Definitions

February 15, 2013. Today, we present several new definitions relating to the Genetic Information Nondiscrimination Act (GINA), which addressed the application of the HIPAA Privacy Rule to genetic information. The definitions are in the Final Rule: Modifications to the HIPAA Privacy, Security, Enforcement, and Breach Notification Rules Under the Health Information Technology for Economic and Clinical Health Act [HITECH Act] and the Genetic Information Nondiscrimination Act; Other Modifications of the HIPAA Rules, which was published in the Federal Register on January 25, 2013. The effective date of the Final Rule is March 26, 2013, and covered entities and business associates must comply by September 23, 2013. The Final Rule states: …

Ed JonesGINA, Health IT and HITECH, HIPAA Law, Privacybusiness associate, compliance date, contributions, covered entity, definition, effective date, eligibility, employment, family member, FERPA, Final rule, genetic information, Genetic Information Nondiscrimination Act, genetic services, genetic testing, GINA, group coverage, health coverage, health information. enforcement rule, HIPAA PRIVACY RULE, HIPAAA Final Rule, HMO, immunization records, manifestation, manifested, March 26 2013, Medigap, nondiscrimination, premiums, privacy protections, Secretary of HHS, September 23 2013, Title I, Title II, underwritingLeave a comment

HIPAA Final Rule: Modification of Business Associate Definition, Part (6)–Exceptions

February 14, 2013. Today, we finish examining the business associate definition, focusing on exceptions, as modified by the Final Rule: Modifications to the HIPAA Privacy, Security, Enforcement, and Breach Notification Rules Under the Health Information Technology for Economic and Clinical Health Act [HITECH Act] and the Genetic Information Nondiscrimination Act; Other Modifications of the HIPAA Rules, which was published in the Federal Register on January 25, 2013. The effective date of the Final Rule is March 26, 2013, and covered entities and business associates must comply by September 23, 2013. Paragraph (4) of the modified definition outlines 4 exceptions (45 CFR 160.103, Definitions, as shown at 78 Federal Register 5688):…

Ed JonesHealth IT and HITECH, HIPAA Law, Privacy, Securityactivity, authorized by law, business associate, business associate contract, compliance date, covered entity, definition, Disclosure, effective date, eligibility, Enforcement, enrollment, entity, exceptions, Federal Register, function, government agency, government health plan, group health plan, Health Care Provider, health insurance issuer, HIPAA Final Rule, HIPAA rules, HMO, Individually Identifiable Health Information, March 26 2013, modification, organized health care arrangement, person, plan sponsor, protected health information, public benefits, September 23 2013, Subcontractor, TreatmentLeave a comment

HIPAA Final Rule: Modification of Business Associate Definition, Part (5)–Subcontractors

February 13, 2013. Today, we finish examining (3)—the third paragraph of four—of the business associate definition, as modified by the Final Rule: Modifications to the HIPAA Privacy, Security, Enforcement, and Breach Notification Rules Under the Health Information Technology for Economic and Clinical Health Act [HITECH Act] and the Genetic Information Nondiscrimination Act; Other Modifications of the HIPAA Rules, which was published in the Federal Register on January 25, 2013. The effective date of the Final Rule is March 26, 2013, and covered entities and business associates must comply by September 23, 2013. Here is the last of three parts of this paragraph: “(3) Business associate includes: (iii) A subcontractor that…

Ed JonesHealth IT and HITECH, HIPAA Law, Privacy, Securityactivity, business associate, business associate contract, CFR, compliance date, conduit, creates, definition, delegation, discovered breach, down the chain, effective date, Federal Register, function, health care functions, hierarchy of subcontractors, HIPAA Final Rule, HIPAA Security Rule, implementation specification, maintains, March 26 2013, modification, Organizational Requirements, other arrangements, person, protected health information, reasonable and appropriate safeguard, receives, satisfactory assurances, September 23 2013, service, Subcontractor, transmission services, transmits, workforceLeave a comment

HIPAA Final Rule: Modification of Business Associate Definition, Part (4)–Personal Health Record Vendor

February 12, 2013. Today, we examine the role of the personal health record vendor in paragraph (3)—the third paragraph of four—of the business associate definition, as modified by the Final Rule: Modifications to the HIPAA Privacy, Security, Enforcement, and Breach Notification Rules Under the Health Information Technology for Economic and Clinical Health Act [HITECH Act] and the Genetic Information Nondiscrimination Act; Other Modifications of the HIPAA Rules, which was published in the Federal Register on January 25, 2013. The effective date of the Final Rule is March 26, 2013, and covered entities and business associates must comply by September 23, 2013. Here is the second of three parts of this…

Ed JonesAmerican Recovery and Reinvestment Act, Health IT and HITECH, HIPAA Law, Privacy, Securityaccess, behalf of covered entities, business associate, compliance date, conduit, covered entity, data transmission services, definition, effective date, electronic health record, electronic means, enrollee, guidance, HIPAA, HIPAA Final Rule, HITECH Act, interoperability, March 26 2013, modification, patient, personal health record, personal health record vendor, September 23 2013, Subcontractor, written authorizationLeave a comment

HIPAA Final Rule: Modification of Business Associate Definition, Part (3)

February 11, 2013. Today, we start to examine (3)—the third paragraph of four—of the business associate definition, as modified by the Final Rule: Modifications to the HIPAA Privacy, Security, Enforcement, and Breach Notification Rules Under the Health Information Technology for Economic and Clinical Health Act [HITECH Act] and the Genetic Information Nondiscrimination Act; Other Modifications of the HIPAA Rules, which was published in the Federal Register on January 25, 2013. The effective date of the Final Rule is March 26, 2013, and covered entities and business associates must comply by September 23, 2013. Here is the first of three parts of this paragraph, (i), which is the subject of today’s…

Ed JonesAmerican Recovery and Reinvestment Act, Health IT and HITECH, HIPAA Law, Privacy, Securityaccess, access on a routine basis, business associate, compliance date, conduit, covered entity, creates, data storage, data transmission services, definition, digital, E-prescribing Gateway, effective date, electronic health information exchange, Federal Register, Final rule, guidance, hard copy, health information organization, HIPAA, HITECH Act, infrequent basis, maintains, March 26 2013, modification, person, personal health record vendor, protected health information, random access, receives, required by law, routine basis, September 23 2013, temporary storage, transient versus persistent, transmission, transmits, transmitted dataLeave a comment

HIPAA Final Rule: Modification of Business Associate Definition, Parts (1) & (2)

February 8, 2013. Today, we examine (1) and (2)—the first two parts of four—of the business associate definition, as modified by the Final Rule: Modifications to the HIPAA Privacy, Security, Enforcement, and Breach Notification Rules Under the Health Information Technology for Economic and Clinical Health Act [HITECH Act] and the Genetic Information Nondiscrimination Act; Other Modifications of the HIPAA Rules, which was published in the Federal Register on January 25, 2013. The effective date of the Final Rule is March 26, 2013, and covered entities and business associates must comply by September 23, 2013. As with its predecessor, the modified definition of business associate refers to “business associate means, with…

Ed JonesHealth IT and HITECH, HIPAA Law, Privacy, Security42 CFR 3.20, 45 CFR 160.103, accounting, accreditation, activity, actuarial, benefit management, billing, business associate, claims administration, claims processing, consulting, covered entity, creates, data aggregation, data analysis, definition, Disclosure, financial services, function, HIPAA Final Rule, HIPAA rules, Individually Identifiable Health Information, legal, maintains, Modifications, organized health care arrangement, patient safety activities, Patient Safety Organization, Patient Safety Rule, person, practice management, protected health information, PSQIA, quality assurance, receives, repricing, subchapter, transmits, utilization review, workforce memberLeave a comment

HIPAA Final Rule: Business Associate Definition

February 7, 2013. Today, we provide the business associate definition, as modified by the Final Rule: Modifications to the HIPAA Privacy, Security, Enforcement, and Breach Notification Rules Under the Health Information Technology for Economic and Clinical Health Act [HITECH Act] and the Genetic Information Nondiscrimination Act; Other Modifications of the HIPAA Rules, which was published in the Federal Register on January 25, 2013. The effective date of the Final Rule is March 26, 2013, and covered entities and business associates must comply by September 23, 2013. Business Associate: Definition (78 Federal Register 5688)– “(1) Except as provided in paragraph (4) of this definition, business associate means, with respect to a…

Ed JonesHealth IT and HITECH, HIPAA Law, Privacy, SecurityBreach Notification, business associate, business associate definition, compliance date, covered entity, creates, Disclosure, E-presribing Gateway, effective date, Enforcement, Federal Register, Genetic Information Nondiscrimination Act, Health Care Provider, health information organization, HIPAA Final Rule, HITECH Act, January 25 2013, March 26 2013, Modifications, organized health care arrangement, patient safety, plan sponsor, Privacy, protected health information, publication date, receives, Security, September 23 2013, Subcontractor, transmits, workforceLeave a comment