HIPAA Security Enforcement

On August 3, 2009, the Office for Civil Rights (OCR) announced that the Secretary of Health and Human Services has delegated to the Director of OCR the authority to administer and enforce the HIPAA Security Rule. This means that the privacy and security rules of HIPAA will be enforced by the same agency. CMS retains its enforcement authority for these other HIPAA rules, including Unique Identifiers and Transactions and Codes Sets.

View the Federal Register notice of the Delegation of Authority at http://www.hhs.gov/ocr/privacy/srdelegationofauthority2009.pdf

And the Secretary’s press release at http://www.hhs.gov/news/press/2009pres/08/20090803a.html.

It is important to remember that the American Recovery and Reinvestment Act of 2009 has additional HIPAA implications – including:

• New security breach notification requirements
• More on Accounting of Disclosures
• HIPAA security rule compliance for business associates who handle PHI and contract revisions between covered entities and business associates
• Definition of "unsecure protected health information"
• Expanded criminal penalties and higher monetary penalties
• Power to state attorneys general to pursue HIPAA civil cases
• Restricted access to some PHI
• Additional rules on Marketing/Sale of PHI
• Additional information on Limited Data Set/Minimum Necessary