HIPAA Amendments, To Take Effect February 17, 2010
The Health Information Technology for Economic and Clinical Health (HITECH) Act, enacted as part of the American Recovery and Reinvestment Act of 2009, was signed into law on February 17, 2009. The new provisions address the privacy and security concerns associated with the electronic transmission of health information, in part, through several provisions that strengthen the civil and criminal enforcement of the HIPAA rules. Â
Previously, HIPAA’s strict confidentiality and computer security requirements applied only to covered entities (defined as a health plan, a health care clearinghouse, or a health care provider who transmits any health information in electronic form in connection with identified transactions), which could choose to enter into “business associate agreements” with any company to which they disclosed patient or employee health information. These business associates (defined as an individual or corporate person that performs on behalf of the covered entity any function or activity involving the authority to access, maintain, retain, modify, record, store, destroy, or otherwise hold, use, or disclose protected health information) promised the covered entity that they would keep the patient information confidential, but were not directly subject to HIPAA’s regulations or penalties.Â
Under the recent HIPAA amendments, effective, February 17, 2010, HIPAA’s security requirements and financial penalties apply directly to both business associates and covered entities. As a result, business associates must now comply with HIPAA’s strict confidentiality and computer security requirements. Violators are subject to a tier of penalties imposed by the Secretary of Health and Human Services, with a maximum fine of $1.5 million if the violations are willful and continue for more than 30 days.
Â
Please find additional information at, www.hhs.gov
