Law Students

On October 30, 2009 HHS issued the following release:

>>

The U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR) issued an interim final rule today to conform the enforcement regulations promulgated under the Health Insurance Portability and Accountability Act of 1996 (HIPAA) to currently effective statutory revisions made pursuant to the Health Information Technology for Economic and Clinical Health (HITECH) Act, which was enacted as part of the American Recovery and Reinvestment Act of 2009 (ARRA).

In this interim final rule, published today in the Federal Register, HHS amends HIPAA?s enforcement regulations that relate to the imposition of civil money penalties to incorporate the HITECH Act?s categories of violations, tiered ranges of civil money penalty amounts, and revised limitations on the Secretary?s authority to impose civil money penalties for established violations of HIPAA?s Administrative Simplification Rules.  This interim final rule does not make amendments with respect to those enforcement provisions of the HITECH Act that are not yet effective under the applicable statutory provisions.  This interim final rule is effective 30 days after today.   

>>

If you are trying to follow along with the maze of HITECH's effective dates I suggest that you start here. HHS's Interim Final Rule ("IFR"), in general, relates to HITECH Section 13410-Improved Enforcement. The bottom line is that the "new Sheriff" has far more authority under HITECH to impose more stringent civil fines. Couple that with, among other things, HITECH fines returning to HHS' Office of Civil Rights coffers and you have a dramatically altered HITECH/HIPAA regulatory landscape. The full text of the IFR can be found here, along with HHS' commentary regarding same. If you want to review the sections of the Social Security Act that HITECH 13410 revises click here.

Check out a FREE EHR Checklist. For more information on HITECH / HIPAA Privacy and Security Rules go to The HIPAA Survival Guide website or sign up for Digital Business Law Group's free monthly compliance newsletter.

Note: We will start conducting HITECH / HIPAA Risk Management Webinars beginning in January, 2010 that may also be of interest. These webinars will be managed as a forum of "round-table" discussions on the pertinent issues, with many opportunities for audience participation and questions.

Note: We will start conducting HITECH / HIPAA Risk Management Webinars beginning in January, 2010 that may also be of interest. These webinars will be managed as a forum of "round-table" discussions on the pertinent issues, with many opportunities for audience participation and questions.