Home

  • Home
    • » e-Newsletters

Resolve your violations now

HIPAA Training Advisor, October 20, 2005


Resolve your violations now

Those expecting a final enforcement rule identical to the interim rule may be in for a rude awakening. Because HHS postponed the expiration date of the interim rule to March 16, 2006, there is plenty of time to examine the new rule that will take its place. The rule includes new policies and procedures that will change the way HHS handles violations.

Sections 160.300??.310 of the proposed enforcement rule are nothing new, says Susan Miller, JD, an independent consultant and chief operating officer and privacy official at HealthTransactions, Inc.

"These are the [enforcement] pieces originating in the privacy rule," she says. They cover general definitions, as well as HHS' processes for handling complaints and achieving compliance.

One difference is that voluntary compliance enforcement, which originally applied only to privacy, will now apply to all of HIPAA's rules.

"This is a good thing, particularly with the security rule, which is highly technical and difficult to comply with, even for people who know what they're doing," says Marc D. Goldstone, Esq., partner at Hoagland, Longo, Moran, Dunst & Doukas, LLP, in New Brunswick, NJ.

"If you find yourself in a situation where you don't think there's liability, but there may be liability down the road, the best thing you can do is ask for help," he says.

And the proposed enforcement rule adds an incentive for getting help: When a penalty becomes final, HHS will notify not only the specified appropriate state or local agencies, but also the general public. "So now everyone will know," he says.

Posting to an HHS Web site or publishing periodically in the Federal Register are among the methods that HHS is considering to disseminate this information.

Consider pushing for enforcement now

Until HHS adopts the new rule, organizations may choose to proceed under the old rule, Goldstone says. "That's a choice you'll make based on the facts and circumstances unique to your case."

The new rule contains multiple references to procedural inadequacies and quirks in the interim rule, so it may actually work to the advantage of organizations facing enforcement now-if they go through the process before publication of the final rule, Goldstone says.

"There are some expansions of jurisdiction and enforcement authority in the new rule that may adversely affect your position," he adds.

For example, Section 160.502 of the interim rule defines a person as a natural or legal person to distinguish, in the context of administrative subpoenas, between an entity (defined as a legal person) and natural persons who would testify on the entity's behalf. The proposed rule would revise and expand this definition, he explains.

The new rule also clarifies that enforcement applies to acts and omissions.

"It's not just what you did," Miller says. "It's what you potentially failed to do as well." This differs from the interim rule.

"Arguably, the interim rule only applies to affirmative acts," Goldstone says. "Therefore, if you have a situation where you have an omission that caused a HIPAA liability-you have a privacy rule breach because you failed to train someone-the government doesn't really have the authority to prosecute under the old rule."

By pushing for enforcement under the old rule, you may achieve a better result, he says. "Decide whether you want to proceed quickly and get the benefits of whatever quirks are in the old rule or [whether] it's a better situation to sit on your hands and try to get under the new rule."

If you have a matter percolating and you want to get the record sealed, do it before the new rule takes effect, says Goldstone. "It's not as clear under the interim rule, but the new rule clarifies that records [of violations and the details surrounding them] can be used in any way. If you plead to something on the record, the government can then ship it down the hall. If it's [OCR], they can send it to the Department of Justice [DOJ]. DOJ can send it to the Office of Inspector General and say, 'Look what we found. You can use this.' " This means that HIPAA won't be your only concern when faced with an investigation.

Editor's note: Adapted from "Organizations should resolve violations now" Briefings on HIPAA, October 2005.

Most Popular