Stimulus Bill Greatly Expands HIPAA Requirements
By Jacqueline Darrah & Kelsey Brodsho,
Halleland Lewis Nilan & Johnson
The American Recovery and Reinvestment Act of 2009 (ARRA) dramatically expands existing privacy and security requirements of the Health Insurance Portability and Accountability Act of 1996 (HIPAA) for Covered Entities and Business Associates. Moreover, civil and criminal penalties for violations of the Act have been expanded and increased. Following are some of the significant provisions of ARRA and implications for health care organizations.
Business Associates will be held directly accountable for existing HIPAA privacy and security standards and new ARRA requirements (previously, Business Associates were contractually held to select requirements of the privacy and security standards). In addition, the scope of organizations that are considered to be business associates has expanded. Implications. Business Associates, who may not be typical health care organizations, must review practices, policies and procedures to ensure compliance with all HIPAA requirements, including those in ARRA. Covered Entities will be required to amend all business associate agreements in order to include the additional requirements.
Covered Entities, Business Associates, and other vendors of personal health records will be required to notify the public, the Secretary of Health and Human Services (the “Secretary”) or the Federal Trade Commission, and in some cases the media of any disclosure of “unsecured” protected health information. The scope of the notification requirement varies with the number of individuals involved in the disclosure. Implications. This is a new federal requirement; therefore, Covered Entities and Business Associates will need to identify whether they are maintaining information that is “unsecured” and, if so, create systems and train employees to identify breaches and implement the notification requirements.
CMS has specific authority to audit compliance with privacy and security requirements. Moreover, civil monetary penalties are expanded and the amount penalized is increased. Civil Monetary Penalties may be imposed on Business Associates. Implications. Covered Entities, and now Business Associates, are more vulnerable to audit and penalties. Therefore, both should be conducting internal compliance assessments to evaluate any gaps in privacy and security that need corrective action.
Higher protections on protected health information have been imposed. The sale of protected health information is expressly prohibited for covered entities using electronic health records without an authorization from the individual, except in limited circumstances. In addition, the definition of marketing activities has been expanded to require authorization of the individual for previously unrestricted activities. Implications. Covered Entities and Business Associates should map protected health information flows and determine the purpose of disclosures to understand whether authorization for the disclosure is now required.
State Attorneys General have the ability to bring a civil action and receive damages if privacy or security requirements are breached. Implications. The potential involvement of state officials in the event of a privacy or security concern underscores the need for both Covered Entities and Business Associates to audit practices, policies and procedures and correct any deficiencies. An individual may now pay for treatment and require that no protected health care information about the treatment submitted to an insurance company for purposes of payment or health care operations. Implications. Health providers and plans will need to adopt systems that ensure the patient’s payment is recognized and claims are not processed.
A covered entity using an electronic health record (and its business associate) must now provide an accounting of disclosures to individuals for disclosures made in the course of treatment, payment and health care operations. Implications. Disclosure accounting systems must be modified to capture disclosures made in the furtherance of treatment, payment and health care operations.
Halleland Lewis Nilan & Johnson is a 50 attorney firm located in Minneapolis. FEMA contact, Joe Schmitt has assisted members over the last six years with labor and employment issues. Members are entitled to a 30 minute free consultation with Mr. Schmitt at no cost as a benefit of their membership.