Today the US Department of Health and Human Services (HHS) announced that the OCR will now be responsible for both the HIPAA Privacy Rule and the Security Rule.
Perhaps this is an indicator of more enforcement to come. As a quick review…
Posts Tagged ‘HITECH Act’
HIPAA Enforcement Will Improve With OCR Responsible for Both Privacy Rule & Security Rule
Monday, August 3rd, 2009(Lack Of) Encryption Is A Basis For Notification Under The HITECH Act
Friday, July 31st, 2009This week one of my tweeps asked me the following: “What’s your interpretation of encryption obligations for PHI data-at-rest under HITECH? Many parties are sweating this now.” Great question!
Is This A Breach Under The HITECH Act Definition?
Monday, July 27th, 2009This week I want to take a closer look at some of the issues and requirements within the HITECH Act, which dramatically expands the reach and requirements under the U.S. Health Insurance Portability and Accountability Act (HIPAA)…
What is PII? How About “Publicly Available” Info?
Thursday, July 16th, 2009There is much debate about what specific types of items should be considered as personally identifiable information (PII). A common topic of debate is; if information can be found publicly does that mean it is not PII?
HIPAA, HITECH Act and Disposal Problems
Thursday, May 21st, 2009Here’s yet another incident that provides very good lessons that could be incorporated into information security and privacy training sessions as a case study, particularly for HIPAA compliance as well as secure disposal training…
HITECH Act does *NOT* make HIPAA, or HIPAA advice, “obsolete”!
Monday, May 18th, 2009A couple of weeks ago I was surprised and concerned by a statement made in one of my many listservs by a lawyer commenting on HIPAA books and past advice given for HIPAA compliance…
Podcast: HITECH Act adds new compliance requirements, penalties
Wednesday, May 6th, 2009Last week I had the pleasure of speaking with Alexander B. Howard at SearchCompliance.com for a 26 minute podcast…
HIPAA & HITECH Act Sanctions & Penalties
Tuesday, April 28th, 2009Today I had the great pleasure and opportunity to do a podcast with Alexander Howard over at TechTarget discussing HIPAA and the HITECH Act…
Breach Notices, Securing PHI & PHR Vendor Responsibilities Under HIPAA/HITECH Act
Tuesday, April 21st, 2009Last Friday the US Department of Health and Human Services (HHS) released, at the last possible moment to meet their deadline, their interim final regulations to require covered entities (CEs) under the Health Insurance Portability and Accountability Act (HIPAA) and their business associates (BAs) to provide for notification in the case of breaches of unsecured protected health information (PHI) as required by the HITECH Act.
If you’ve read any of the at least 47 U.S. state and territory beach notice laws you will get a strong sense of deja vu while reading this document. They borrowed HEAVILY from the various existing breach notice laws to estblished their proposed definitions of securing PHI, what constitutes a “breach” of PHI, and for doing breach notifications.
There are two major issues…
HIPAA Requirements Changes & Business Associates Impacts From HITECH Act
Monday, April 20th, 2009Last week I engaged in a very interesting tweetversation with David Mortman about when the U.S. Department of Health and Human Services (HHS) needs to get their guidance documents and rules published for the various HITECH Act requirements…
