HHS's Proposed Modifications to HIPAA Privacy, Security, and Enforcement Rules



Like staying current? Never miss a beat!

The U.S. Department of Health and Human Services (HHS) has published a proposed rule to modify the HIPAA Privacy Rule, Security Rule, and Enforcement Rule under the HITECH Act. The proposed rules generally pertain to the HITECH Act provisions that went into effect on February 18, 2010 (in some cases, a later effective date applies). In light of the difficulties associated with complying with the statutory requirements until after HHS has finalized its changes to the HIPAA Rules, however, HHS has indicated that it intends to give Covered Entities and Business Associates 180 days beyond the effective date of the final rule to comply with most of the rule's provisions. The proposed rules are subject to a comment period, so it is not presently certain when final rules will become effective.

In anticipation of the finalization of the rule, Covered Entities and Business Associates should monitor the status of these Rules and may wish to review their agreements (e.g., Business Associate Agreements) and documentation (e.g., Notices of Privacy Practices, authorizations) along with their uses and disclosures of PHI to determine the extent to which they may need to make modifications as the Rules are finalized. Business Associates may also wish to identify the subcontractors from whom they will need to obtain satisfactory assurances of the protection of the information if the Rules are finalized in their present form. 

Click here for additional information about the proposed changes.

HHS Withdraws Final Breach Notification Rule from OMB Review
In a late July 2010 Security Breach Notification Final Rule Update, HHS stated that it had withdrawn its final Security Breach Notification Rule from review by the Office of Management and Budget to allow for further consideration. In the Update, HHS stated that it intended to publish a final rule in the coming months. In the meantime, the interim final rule, effective in September 2009, remains in effect.


Of Counsel
(304) 526-8131
Huntington, WV