The U.S. Department of Health and Human Services (HHS) has issued an interim final rule that strengthens its enforcement of the rules under the Health Insurance Portability and Accountability Act (HIPAA).
For a Limited Time receive a
FREE HR Report "Top 10 Best Practices in HR Management." This comprehensive special report will give you the information you need to know about these current HR challenges and how to most effectively manage them in your workplace.
Download NowThe Health Information Technology for Economic and Clinical Health (HITECH) Act significantly increased the penalties HHS may impose for violations of the HIPAA rules and encouraged prompt corrective action. The interim final rule conforms the HIPAA enforcement regulations to the revisions made by the HITECH Act.
Prior to the HITECH Act, the maximum penalty was $100 for each violation or $25,000 for all identical violations of the same provision. A covered healthcare provider, health plan, or clearinghouse could also avoid the imposition of a fine by demonstrating that it did not know that it violated the HIPAA rules.
The HITECH Act strengthened the enforcement program by establishing tiered ranges of increasing minimum penalty amounts, with a maximum penalty of $1.5 million for all violations of an identical provision. In addition, a covered entity can no longer prevent the imposition of a fine for an unknown violation unless it corrects the violation within 30 days of discovery.
This strengthened penalty scheme will encourage health care providers, health plans and other health care entities required to comply with HIPAA to ensure that their compliance programs are effectively designed to prevent, detect and quickly correct violations of the HIPAA rules,” says Georgina Verdugo, the director of HHS Office for Civil Rights (OCR) “Such heightened vigilance will give consumers greater confidence in the privacy and security of their health information and in the industry's use of health information technology.”
The rule will become effective on November 30, 2009, and HHS will consider all comments received by December 29, 2009.
This interim final rule with request for comments is the first of several steps HHS is taking to implement the HITECH Act's enforcement provisions. The department says the remaining provisions, which have yet to become effective, will be addressed in the next few months in forthcoming rulemakings.
Link