AKIBIA'S PRACTICAL GUIDE TO ENTERPRISE TECHNOLOGY
Friday, March 13, 2009
HIPAA Revitalized in 2009 and Beyond
It’s been a few years since the Health Insurance Portability and Accountability Act of 1996 (HIPAA) came into effect and since then there seems to have been a “gliding along” approach. Many health organizations are now either compliant or at least feel like they have a grasp on HIPPA privacy and security safeguards and what they all mean. The challenge for organizations has always been “how to” protect Personally Identifiable Information (PII) in both paper and electronic form. HIPAA has often been labeled somewhat ambiguous and enforcement is not always forthcoming. HIPAA has also been overshadowed somewhat by other compliance and regulatory advances by the government and private industry.
President Barack Obama’s first speech to the nation outlined his $700 billion plus recovery plan. As noted by HealthLeaders News, it appears his plan also outlines new guidelines around HIPAA’s PII and Electronic Health Records (EHR’s). There are a couple of interesting points to consider:
- BA (Business Associates) will be more involved and accountable. Companies need to recognize whether they are upstream or downstream from other organizations that have HIPAA responsibilities. Each company needs to identify where they are responsible and to what degree.
- These new tough guidelines will be linked to state and federal data breach and privacy laws.
The Act also suggests penalties. These range from $100 to $ 50,000 per violation. Many factors will come into play as to how much an organization will be fined for a breach. But it appears HIPAA violations may now end up in the news like many of the credit card breaches we have all heard about before. What I found really interesting was the Act gives states’ attorney generals the power to seek civil damages and to recover attorney fees for HIPAA privacy breaches.
Are you ready for this new level of accountability? I recommend starting with the information below, as you determine changes and alterations to your HIPAA strategy.
- Analyze current compliance and training systems;
- Are your current policies and procedures good enough?
- Structure a timeline for implementation of new guidelines, policies and solutions to support them;
- Revisit health information exchanges and practices;
- Set a game plan for breach notification requirements.
-- Tim Trow, CISSP, Senior Security Consultant, Akibia
