When a HIPAA breach hits, delay costs money. Build your response team before you need it: a data privacy attorney first (to help protect the investigation under privilege), then forensic and IT consultants, media relations, and HR.
I am asked that question almost weekly. While the answer has traditionally been “no,” the legal landscape is shifting and the risk of being sued continues to increase.
Let’s
A party’s responsibilities under HIPAA generally come from two sources - the law itself and the business associate agreement entered into between the covered entity (the health care provider or
June 7, 2013. Today, HHS published in the Federal Register "Technical Corrections to the HIPAA Privacy, Security, and Enforcement Rules" that were published on January 25, 2013, as
The Final Rule took effect March 26, 2013, with 180 days to comply. How the 180-day rule works for future HIPAA changes, which deadlines didn’t move, and the longer transition for existing business associate agreements.
How the 2013 Final Rule changed delivery of the Notice of Privacy Practices: when health plans must post or mail a revised notice after a material change, what stays the same for providers, and how to keep notices accessible.
March 22, 2013. Today, we continue going through the HIPAA Privacy Rule, section by section, as modified in the Final Rule: Modifications to the HIPAA Privacy, Security, Enforcement, and Breach
Providers may share a deceased patient’s PHI with family members or others who were involved in their care or payment, limited to what’s relevant and never against the patient’s known wishes. The Final Rule’s change, with examples.
The Final Rule limits Privacy Rule protection of a deceased person’s PHI to 50 years after death. Why HHS chose 50 years, how stricter state laws still apply, and why it isn’t a record-retention requirement.
What every business associate contract must include under the Final Rule: permitted uses, required safeguards, breach reporting, subcontractor terms, and return or destruction of PHI at termination, plus the alternatives for government entities.
A covered entity may share PHI with a business associate once it has written assurance the PHI will be protected. The Final Rule extends that chain to subcontractors: each business associate must get the same assurances from its own.
A covered entity or business associate can’t sell PHI without patient authorization. What counts as a “sale” under the Final Rule (including licenses and nonfinancial perks), what doesn’t, and the exceptions for research, public health, and mergers.
