HHS Introduces Proposed Modifications to the HIPAA Rules

On July 14, 2010, the United States Department of Health and Human Services ("HHS") published notice in the Federal Register of proposed rulemaking aimed at strengthening the Health Insurance Portability and Accountability Act of 1996 ("HIPAA") privacy, security and enforcement regulations and as required by the Health Information Technology for Economic and Clinical Health Act ("HITECH Act"), which was enacted as a part of the American Recovery and Reinvestment Act of 2009. Upon introducing the proposed rule, Secretary Sebelius emphasized that as health information technology systems assist the United States in moving the health care system forward, "the privacy and security of personal health data is at the core of all our work."

Although the proposed rules were only expected to implement changes required by the HITECH Act, HHS took the opportunity to make changes in several areas that were not require by law. HHS states that the changes were based on its experience and the feedback received on the privacy, security and enforcement regulations since the original drafting, as well as changes in other laws- including the Patient Safety and Quality Improvement Act of 2005.

The proposed rule includes, among other things, numerous additions to the requirements for business associates and their downstream "subcontractors," several helpful examples of "willful neglect" and the penalties associated with HIPAA violations, important changes to individual rights requirements, and changes to notices of privacy practices content provisions. While the proposed rule has yet to become final, Medicaid providers should remain vigilant in monitoring the issue and reviewing their own HIPAA compliance plans as developments unfold.

The proposed rule is available in the Federal Register, Vol. 75, No. 134. The issues mentioned above are only some areas that are addressed in the proposed rule. For more comprehensive analysis, please contact Jill Shotzberger at jsberger@jeylaw.com or 404.995.6792.