The Department of Health and Human Services Opens Notice and Comment Period for New HIPAA Privacy Rule

The Department of Health and Human Services (HHS) hosted a press conference today to announce changes to the Health Insurance Portability and Accountability Act (HIPAA) of 1996, Privacy, Security and Enforcement Rules. The rule proposed by HHS will be in a notice and comment period for the next two months, beginning July 8, 2010. During the press conference, Kathleen Sebelius, Secretary of the Department of Health and Human Services, noted that the new rule will make business associates culpable for information breaches the same as covered are currently. In addition, the penalties for breaches of information will now be raised to a maximum of $50,000 per breach, with an overall maximum of $1.5 million. The new rule will also prohibit the sale of protected information.

In addition to announcing the proposed rule, HHS outlined new resources and activities to strengthen the privacy of protected health information and educate Americans on their rights and the resources available to them to secure their protected health information. There will be two new websites that will help report and inform the public of any breaches of healthcare information privacy. The first website is the Office of Civil Rights breach notice website where entities and individuals are required to immediately post a notice of any breaches. The second website will keep the public informed on the actions and policies the government is contemplating and implementing for the protection of patient information.

Finally, questions from participants prompted a discussion of the actions HHS is taking to protect healthcare information. The HHS provided examples such as the training of a new workforce to try and protect health IT, working with the cyber security department and starting a national dialogue with consumers and providers at locations across the country to provide education on the privacy and security of protected health information.

For more information on HIPAA privacy and security rules, please visit www.wachler.com or contact a Wachler & Associates attorney at 248-544-0888.