February 7, 2013. Today, we provide the business associate definition, as modified by the Final Rule: Modifications to the HIPAA Privacy, Security, Enforcement, and Breach Notification Rules Under the Health
February 6, 2013. Today, we cover the business associate Administrative Safeguard (b) of the Security Rule, as modified by the Final Rule: Modifications to the HIPAA Privacy, Security, Enforcement, and
The 2013 Final Rule extended the Security Rule’s general requirements and administrative safeguards to business associates. What changed in 45 CFR 164.306 and 164.308(a), from risk analysis to workforce termination procedures.
Before 2013, business associates only promised contractual safeguards. The HITECH Act and the Final Rule made them directly subject to the Security Rule’s administrative, physical, and technical safeguards, along with its penalties.
February 1, 2013. Today, we wrap up discussion of breach notification in the Final Rule: Modifications to the HIPAA Privacy, Security, Enforcement, and Breach Notification Rules Under the Health Information
Key breach notification changes in the 2013 Final Rule: risk assessments now required for limited data sets, who notifies when a business associate has the breach, why a website press release doesn’t count as media notice, and the deadlines for reporting to HHS.
PHI that’s encrypted or destroyed according to HHS guidance isn’t “unsecured,” so an impermissible disclosure doesn’t trigger breach notification. How the Final Rule defines unsecured PHI and why encryption is your best safe harbor.
Under the Final Rule, an impermissible use or disclosure of PHI is presumed to be a breach unless a risk assessment shows a low probability of compromise. The four factors you must weigh, with examples from the rule.
The 2013 Final Rule replaced the “harm” standard with a presumption of breach. The new definition, its three exclusions, the end of the limited data set exception, and why the burden of proof now sits with you.
January 25, 2013. The Final Rule is published, at last! Modifications to the HIPAA Privacy, Security, Enforcement, and Breach Notification Rules Under the Health Information Technology for Economic and Clinical
January 18, 2013. On January 16, 2013, the Office of Management and Budget (OMB) completed its EO 12866 regulatory review of RIN: 0945-AA03, and the long-awaited release of
ONC’s 10-step plan for meeting meaningful use privacy and security requirements, from appointing privacy and security officials to the security risk analysis that every attestation depends on. Attest only after the work is done.
