Key breach notification changes in the 2013 Final Rule: risk assessments now required for limited data sets, who notifies when a business associate has the breach, why a website press release doesn’t count as media notice, and the deadlines for reporting to HHS.
PHI that’s encrypted or destroyed according to HHS guidance isn’t “unsecured,” so an impermissible disclosure doesn’t trigger breach notification. How the Final Rule defines unsecured PHI and why encryption is your best safe harbor.
Under the Final Rule, an impermissible use or disclosure of PHI is presumed to be a breach unless a risk assessment shows a low probability of compromise. The four factors you must weigh, with examples from the rule.
The 2013 Final Rule replaced the “harm” standard with a presumption of breach. The new definition, its three exclusions, the end of the limited data set exception, and why the burden of proof now sits with you.
January 25, 2013. The Final Rule is published, at last! Modifications to the HIPAA Privacy, Security, Enforcement, and Breach Notification Rules Under the Health Information Technology for Economic and Clinical
January 18, 2013. On January 16, 2013, the Office of Management and Budget (OMB) completed its EO 12866 regulatory review of RIN: 0945-AA03, and the long-awaited release of
September 5, 2012. Today, the Federal Register published the Centers for Medicare & Medicaid Services (CMS) Final Rule: Administrative Simplification: Adoption of a Standard for a Unique Health Plan Identifier;
September 4, 2012. The Department of Health and Human Services (HHS) entities: Centers for Medicare & Medicaid Services (CMS) and Office of the National Coordinator for Health Information Technology (ONC)
August 24, 2012. Today, the Office of Management and Budget (OMB) completed review and sent to the Federal Register for publication on September 5, 2012, the Centers for Medicare &
April 17, 2012. The Office of the Secretary of the Department of Health and Human Services (HHS) published today in the Federal Register its Notice of Proposed Rule Making (NPRM)
April 10, 2012. Yesterday, the Office of the Secretary of the Department of Health and Human Services (HHS) promulgated a notice of proposed rule making (NPRM) entitled: Administrative Simplification: Adoption
March 24, 2012. Today, the Office of Information and Regulatory Affairs at the Office of Management and Budget (OMB) in the Executive Office of the President showed that it had
