September 23, 2013 marked the deadline for covered entities, business associates, and their subcontractors to be in compliance with the new Health Insurance Portability and Accountability Act (HIPAA) Omnibus regulations.
New regulations, published in January 2013, expanded federal health care privacy and security laws and also extended their application. These new regulations have modified the HIPAA Privacy, Security and Enforcement rules relating to the Health Information Technology for Economic and Clinical Health Act (HITECH Act) and mark the most extensive changes to the HIPAA Privacy and Security Rules since they were first implemented.
As of September 23, 2013, covered entities should be aware of, and in compliance with, the following key elements of the Omnibus Final Rule:
- Business associates are now directly liable for compliance with HIPAA Privacy and Security Rules.
- Stronger limitations now exist on the use and disclosure of Protected Health Information (PHI) for marketing and fundraising purposes.
- Providers must comply with a patient’s request that PHI not be disclosed to a health plan for purposes of payment if the patient paid out-of-pocket, in full, for that item or service.
- The standard used for determining whether a breach of unsecured PHI has occurred was substantially lowered and has been modified to include a “low probability of compromise” standard.
- “Protected health information” now expressly excludes the health information of a person who has been deceased for more than fifty (50) years.
- Providers may now disclose, with consent, proof of immunization to schools if the school is required by state, or other law, to have proof of immunization prior to student admission.
The Omnibus Rules enhance patient privacy rights and protections, and also strengthen the ability of the Office for Civil Rights (OCR) to enforce the HIPAA privacy and security protections.
Review the final rules to ensure your organization is in compliance.