HHS Issues Notice of Proposed Rulemaking to Implement HITECH Act Modifications to the HIPAA Rules
July 8, 2010 The Department of Health and Human Services (HHS) issued a notice of proposed rulemaking today to modify the Privacy, Security, and Enforcement Rules issued pursuant to the Health Insurance Portability and Accountability Act of 1996 (HIPAA). The Health Information Technology for Economic and Clinical Health (HITECH) Act, enacted as part of the American Recovery and Reinvestment Act of 2009, is designed to promote the widespread adoption and standardization of health information technology, and requires HHS to modify the HIPAA Privacy, Security, and Enforcement Rules to strengthen the privacy and security protections for health information and to improve the workability and effectiveness of the HIPAA Rules. The proposed modifications to the HIPAA Rules issued today include provisions extending the applicability of certain of the Privacy and Security Rules' requirements to the business associates of covered entities, establishing new limitations on the use and disclosure of protected health information for marketing and fundraising purposes, prohibiting the sale of protected health information, and expanding individuals' rights to access their information and to obtain restrictions on certain disclosures of protected health information to health plans. In addition, the proposed rule adopts provisions designed to strengthen and expand HIPAA's enforcement provisions. "This proposed rule strengthens the privacy and security of health information, and is an integral piece of the Administration's efforts to broaden the use of health information technology in healthcare today," said Georgina Verdugo, director of the HHS Office for Civil Rights (OCR). These HIPAA Rules are administered and enforced by OCR. Once it is published in the Federal Register, the notice of proposed rulemaking may be viewed and commented on for 60 days at www.regulations.gov <http://www.regulations.gov/> . In addition to issuing the notice of proposed rulemaking, OCR also updated its breach notification webpage. Breaches of unsecured protected health information affecting 500 or more individuals that are reported to the Secretary are now posted in a new, more accessible format that allows users to search and sort the reported breaches. Additionally, this new format includes brief summaries of the breach cases that OCR has investigated and closed, as well as the names of private practice providers who have reported breaches of unsecured protected health information to the Secretary. Visit the OCR website for more information about this proposed rule and the updated breach notification webpage: www.hhs.gov/ocr/privacy/. ------------------------------------------------------------------------ -------------------------------------------------- Note: If you have problems accessing any hyperlink in this message, please copy and paste the URL into your Internet browser. If you know someone who would like to subscribe to a FFS provider listserv, go to (http://www.cms.gov/prospmedicarefeesvcpmtgen/downloads/Provider_Listser vs.pdf) . If you received this message as part of the All FFS Providers listserv, you are currently subscribed to one of eighteen Medicare Fee-For-Service (FFS) provider listservs. If you would like to be removed from all NIH listservs, please go to (https://list.nih.gov/LISTSERV_WEB/signoff.htm) to unsubscribe. If you would like to unsubscribe from a specific provider listserv, please go to (https://list.nih.gov/cgi-bin/show_list_archives) to unsubscribe or to leave the appropriate listserv. Please DO NOT respond to this email. This email is a service of CMS and routed through an electronic mail server to communicate Medicare policy and operational changes and/or updates. Responses to this email are not routed to CMS personnel. Inquiries may be sent by going to (http://www.cms.gov/ContactCMS). Thank you.
