Changes to the Health Insurance Portability and Accountability Act (HIPAA) Rules are here,[i] and covered entities and business associates have until September 23, 2013 to comply with them. Many changes have been made to the Enforcement Rule, as well as the Privacy and Breach Notification Rules. One of the most significant changes to the Enforcement Rule for providers is that a covered entity is now liable for the violations of its business associate if the business associate is acting as an agent of the covered entity.
Enforcement Rule
There are four modifications to the Enforcement Rule that generally affect the investigation of HIPAA Rule violations and imposition of civil monetary penalties (CMPs). First, the Secretary of the U.S. Health and Human Services (HHS) is required to formally investigate allegations of HIPAA Rule violations that are due to willful neglect, and impose CMPs upon findings such violations. Second, business associates are now liable for CMPs for certain HIPAA Rule violations. Third, the Secretary is required to determine the amount of CMPs to be imposed based on the nature and extent of harm caused by the violation. Finally, the Secretary’s authority to impose CMPs will be restrained only where a criminal penalty has actually been imposed with regard to the HITECH Act; previously, the Secretary was prohibited from imposing CMPs in cases where the offense was criminally punishable under the HITECH Act. Accordingly, the Secretary has broader authority to impose CMPs on violations of the HITECH Act.
Read more ›