Login

Help

BI’s Article search uses Boolean search capabilities. If you are not familiar with these principles, here are some quick tips.

To search specifically for more than one word, put the search term in quotation marks. For example, “workers compensation”. This will limit your search to that combination of words.

To search for a combination of terms, use quotations and the & symbol. For example, “hurricane” & “loss”.

Login Register Subscribe

HHS publishes interim final HIPAA rule

Reprints
Benefits Legislation & Regulation P/C Legislation & Regulation Health Care Benefits More + Less -

WASHINGTON—The U.S. Department of Health and Human Services published an interim final rule Friday that incorporates changes to the Health Insurance Portability and Accountability Act included in federal stimulus legislation enacted earlier this year.

The interim final rule amends HIPAA's enforcement regulations to include new categories of violations and tiered civil penalties on covered entities, and revises limitations on the authority of the HHS secretary to impose civil penalties for violations.

Under the interim final rule published Friday, the following penalties for HIPAA violations will apply on or after Nov. 30:

  • The minimum civil penalty is $100 per violation if the covered entity was unaware of it and, by exercising reasonable diligence, would not have known about the violation.

  • The minimum civil penalty is $1,000 per violation for those that were the result of “reasonable cause” involving circumstances that would make it unreasonable for the covered entity to comply.

  • The minimum penalty is $10,000 for violations that result from willful neglect and are subsequently corrected.

  • The minimum penalty is $50,000 for violations that result from willful neglect but are not corrected.

  • The maximum penalty for multiple violations is $1.5 million per calendar year.

    The new penalty amounts apply to HIPAA violations occurring on or after Feb. 18.

    Several other changes also were made to HIPAA as part of the American Recovery and Reinvestment Act of 2009. They include:

  • Notification within 60 days of a privacy breach involving an individual’s HIPAA-covered personal health information.

  • Business associates, such as consultants and third-party administrators, must meet most security requirements that previously applied only to covered entities.

  • Notification of the Department of HHS and the media in privacy breaches involving 500 or more individuals.

  • Authorization of state attorneys general to bring suit for HIPAA violations.

    HHS’s regulations implementing these other changes were published earlier this year.

    The Office for Civil Rights is accepting comments on the interim final rule until Dec. 29.

    To access a copy of the interim final rule, go to: http://edocket.access.gpo.gov/2009/E9-26203.htm.

    • About

    Advertise

    Reprints and Licensing

    Resources

    . Privacy Policy • Terms of Use

    COPYRIGHT © 2024 BUSINESS INSURANCE HOLDINGS

    Member, Beacon International Group, Ltd.