HITECH UPDATE: Check your current system against HHS draft guidance
HIPAA Weekly Advisor, April 27, 2009
Want to receive articles like this one in your inbox? Subscribe to HIPAA Weekly Advisor!
In case you missed it, HHS issued a proposal April 17 for security breach notification in a 20-page report that defines acceptable conditions for covered entities and business associates to encrypt or destroy their private patient data to secure PHI and prevent a breach.
The guidance includes the technologies and methods specified by the Secretary of HHS that render PHI “unusable, unreadable, or indecipherable to unauthorized individuals.” The American Recovery and Reinvestment Act of 2009 (ARRA) required the draft guidance by Saturday, April 18, according to an HHS press release.
Covered entities and business associates are not required to follow the guidance. However, if they do, it creates a “safe harbor” and protects them from the notification requirements when a security breach occurs, according to the new HHS report.
Though not final yet, covered entities and business associates should pay close attention to the guidance because it will help determine whether their facility had a breach of patient privacy.
“Keep in mind, this is a new federal requirement which overlaps with security breach notification laws already on the books in almost every state, and personal information disposal laws on the books in many states," says John R. Christiansen, of Christiansen IT Law, in Seattle. "... We’re going to have to analyze state laws specifically to figure out if there are places where the state law is stronger. It probably isn’t worth doing a definitive analysis until the final guidance comes out.”
Want to receive articles like this one in your inbox? Subscribe to HIPAA Weekly Advisor!
Related Products
-
Guide to HIPAA Auditing, Second Edition
This new edition of a best-selling book delivers the hands-on tools and guidance you need to conduct effective in-house...
-
HIPAA Training Handbook for Business Associates
Train all of your staff members with this handbook and others in the 2009 HIPAA Handbook Series. Ensure they understand...
-
HIPAA Handbook for Executive, Administrative and Corporate Staff
Train all of your staff members with this handbook and others in the 2009 HIPAA Handbook Series. Ensure they understand...
-
The No-Hassle Guide to HIPAA Policies: A Privacy and Security Toolkit
HIPAA regulations require extensive documentation—likely more than you've done in the past. Changing the way you look...
-
The HIPAA and HITECH Toolkit
The HIPAA and HITECH Toolkit is a valuable resource that helps both CEs and BAs understand and meet the HITECH Act's...
Most Popular
- Articles
-
- Q/A: Volume requirement for reporting hydration services
- Featured blog post: Nurses face felony charges after reporting physician to the Texas Medical Board
- Catch up on what's new with injections and infusions
- Identify potential Medicaid RAC target areas
- HIPAA Q&A: Level of encryption needed for email
- Topic: CMS, OESS post new security compliance review information, checklist
- Capturing all necessary codes for IUD insertion and removal can be challenging
- What does case-mix index mean to you?
- OB services: Coding inside and outside of the package
- QA:Coding multiple initial infusions
- E-mailed
-
- Q/A: Volume requirement for reporting hydration services
- Featured blog post: Nurses face felony charges after reporting physician to the Texas Medical Board
- HIPAA Q&A: Level of encryption needed for email
- Q&A: Follow CMS' coding guidelines when using modifier -25
- What does case-mix index mean to you?
- Catch up on what's new with injections and infusions
- CMS has reformulated payments for some bilateral procedures
- New conflicts of interest create new challenges
- Q/A. One injection code or two?
- ED-to-inpatient transfers are flawed with safety gaps
- Searched