The U.S. Department of Health and Human Services has released the final omnibus rule to strengthen the privacy and security protections for health information established under the Health Insurance Portability and Accountability Act of 1996.
The final omnibus rule is based on statutory changes under the Health Information Technology for Economic and Clinical Health Act, enacted as part of the American Recovery and Reinvestment Act of 2009 and the Genetic Information Nondiscrimination Act of 2008, which clarifies that genetic information is protected under the HIPAA Privacy Rule and prohibits most health plans from using or disclosing genetic information for underwriting purposes.
The rule enhances patients' privacy protections, provides individuals new rights to their health information and strengthens the government's ability to enforce the law in an ever changing and expanding digital age. According to the release, the rule represents the most sweeping changes since the HIPAA Privacy and Security Rules were first implemented.
According to the release, changes in the final rule provide patients with increased protection and control of personal health information in a variety of ways:
• Individuals have the right to ask for a copy of their electronic medical record in an electronic form.
• When individuals pay by cash they can instruct their provider not to share information about their treatment with their health plan.
• The sale of individuals' health information without their permission is prohibited.
• The final rule streamlines an individuals' ability to authorize the use of their health information for research purposes.
• The rule makes it easier for parents and others to give permission to share proof of a child's immunization with a school and gives covered entities and business associates up to one year after the 180-day compliance date to modify contracts to comply with the rule.
Additional changes under the final rule include:
• The rule expands requirements to include business associates of healthcare providers, health plans and other entities that receive protected health information, such as contractors and subcontractors.
• Since some of the largest breaches reported to HHS have involved business associates, penalties are increased for noncompliance based on the level of negligence with a maximum penalty of $1.5 million per violation.
• The rule strengthens the HITECH Breach Notification requirements by clarifying when breaches of unsecured health information must be reported to HHS.
The rule announced today may be viewed in the Federal Register at https://www.federalregister.gov/public-inspection.
47% of Healthcare Leaders Face Challenges in Meeting HIPAA Requirements
How Does HIPAA and the HITECH Act Impact Medical Device and Pharma Companies?
The final omnibus rule is based on statutory changes under the Health Information Technology for Economic and Clinical Health Act, enacted as part of the American Recovery and Reinvestment Act of 2009 and the Genetic Information Nondiscrimination Act of 2008, which clarifies that genetic information is protected under the HIPAA Privacy Rule and prohibits most health plans from using or disclosing genetic information for underwriting purposes.
The rule enhances patients' privacy protections, provides individuals new rights to their health information and strengthens the government's ability to enforce the law in an ever changing and expanding digital age. According to the release, the rule represents the most sweeping changes since the HIPAA Privacy and Security Rules were first implemented.
According to the release, changes in the final rule provide patients with increased protection and control of personal health information in a variety of ways:
• Individuals have the right to ask for a copy of their electronic medical record in an electronic form.
• When individuals pay by cash they can instruct their provider not to share information about their treatment with their health plan.
• The sale of individuals' health information without their permission is prohibited.
• The final rule streamlines an individuals' ability to authorize the use of their health information for research purposes.
• The rule makes it easier for parents and others to give permission to share proof of a child's immunization with a school and gives covered entities and business associates up to one year after the 180-day compliance date to modify contracts to comply with the rule.
Additional changes under the final rule include:
• The rule expands requirements to include business associates of healthcare providers, health plans and other entities that receive protected health information, such as contractors and subcontractors.
• Since some of the largest breaches reported to HHS have involved business associates, penalties are increased for noncompliance based on the level of negligence with a maximum penalty of $1.5 million per violation.
• The rule strengthens the HITECH Breach Notification requirements by clarifying when breaches of unsecured health information must be reported to HHS.
The rule announced today may be viewed in the Federal Register at https://www.federalregister.gov/public-inspection.
More Articles on HIPAA Privacy and Security:
HIPAA Compliance: What Has Changed and How Will It Impact Healthcare Providers?47% of Healthcare Leaders Face Challenges in Meeting HIPAA Requirements
How Does HIPAA and the HITECH Act Impact Medical Device and Pharma Companies?