When a HIPAA breach hits, delay costs money. Build your response team before you need it: a data privacy attorney first (to help protect the investigation under privilege), then forensic and IT consultants, media relations, and HR.
Key breach notification changes in the 2013 Final Rule: risk assessments now required for limited data sets, who notifies when a business associate has the breach, why a website press release doesn’t count as media notice, and the deadlines for reporting to HHS.
PHI that’s encrypted or destroyed according to HHS guidance isn’t “unsecured,” so an impermissible disclosure doesn’t trigger breach notification. How the Final Rule defines unsecured PHI and why encryption is your best safe harbor.
Under the Final Rule, an impermissible use or disclosure of PHI is presumed to be a breach unless a risk assessment shows a low probability of compromise. The four factors you must weigh, with examples from the rule.
The 2013 Final Rule replaced the “harm” standard with a presumption of breach. The new definition, its three exclusions, the end of the limited data set exception, and why the burden of proof now sits with you.
Five things every covered entity and business associate should do: a current risk analysis, documented policies and procedures, workforce training, encryption of mobile devices, and investing in safeguards before a breach costs far more.
May 16, 2012. The Department of Health and Human Services' (HHS) HIPAA/HITECH Act privacy and security enforcement arm, Office for Civil Rights (OCR), is responsible under the HITECH
On March 7, 2012, the Centers for Medicare & Medicaid Services (CMS) published in the Federal Register its 132-page notice of proposed rule making (NPRM): Medicare and Medicaid Programs;
Under the Health Information Technology for Economic and Clinical Health Act (HITECH Act), enacted as part of the American Recovery and Reinvestment Act of 2009, covered entities are required to
Under the Health Information Technology for Economic and Clinical Health Act (HITECH Act), enacted as part of the American Recovery and Reinvestment Act of 2009, covered entities are required to
Under the Health Information Technology for Economic and Clinical Health Act (HITECH Act), enacted as part of the American Recovery and Reinvestment Act of 2009, covered entities are required to
December 2, 2010.M
Under the Health Information Technology for Economic and Clinical Health Act (HITECH Act), enacted as part of the American Recovery and Reinvestment Act of 2009, covered
