8 implications of the final HIPAA omnibus rule on privacy & security announced today providing individuals new rights to their health information
The U.S. Department of Health and Human Services (HHS) announced the release of final omnibus rule that will strengthen the privacy and security protections for health information established under the Health Insurance Portability and Accountability Act of 1996 (HIPAA). The rule will provides individuals new rights to their health information, and strengthens the government’s ability to enforce the law.
“Much has changed in health care since HIPAA was enacted over fifteen years ago,” said HHS Secretary Kathleen Sebelius. “The new rule will help protect patient privacy and safeguard patients’ health information in an ever expanding digital age.”
8 implications of the final HIPAA omnibus rule on privacy & security include:
- Expansion of many of the requirements to business associates of these entities that receive protected health information, such as contractors and subcontractors
- Penalties are increased for noncompliance based on the level of negligence with a maximum penalty of $1.5 million per violation
- Strengthens the Health Information Technology for Economic and Clinical Health (HITECH) Breach Notification requirements by clarifying when breaches of unsecured hea lth information must be reported to HHS
- Patients can ask for a copy of their electronic medical record in an electronic form. When individuals pay by cash they can instruct their provider not to share information about their treatment with their health plan
- Sets new limits on how information is used and disclosed for marketing and fundraising purposes and prohibits the sale of an individuals’ health information without their permission
- Reduces burden by streamlining individuals’ ability to authorize the use of their health information for research purposes
- Makes it easier for parents and others to give permission to share proof of a child’s immunization with a school
- Gives covered entities and business associates up to one year after the 180-day compliance date to modify contracts to comply with the rule
The final omnibus rule is based on statutory changes under the HITECH Act, enacted as part of the American Recovery and Reinvestment Act of 2009, and the Genetic Information Nondiscrimination Act of 2008 (GINA) which clarifies that genetic information is protected under the HIPAA Privacy Rule and prohibits most health plans from using or disclosing genetic information for underwriting purposes.
For more information on the omnibus rule announcement can be viewed at https://www.federalregister.gov/public-inspection.
