A Womble Client Alert: A Detailed Analysis of Changes to HIPAA and the Implications for Healthcare Providers and Others in the Healthcare Industry

On Friday, January 25, 2013, the Office for Civil Rights ("OCR") of the U.S. Department of Health and Human Services ("HHS") published a final rule modifying the HIPAA Privacy, Security, and Enforcement Rules (the "Final Rule") as mandated by the Health Information Technology for Economic and Clinical Health ("HITECH") Act. Many of these modifications were set forth in a Notice of Proposed Rulemaking ("NPRM") dated July 14, 2010, although the Final Rule does not adopt all the proposals as described in the NPRM.

The Final Rule also modifies the Breach Notification Rule, which has been effective as an interim final rule since September 23, 2009. Finally, the Final Rule strengthens privacy protections for certain genetic information under the Genetic Information Nondiscrimination Act ("GINA").

The Final Rule makes significant changes to HIPAA and the potential penalties for violating HIPAA. The Final Rule also expands the scope of HIPAA, meaning that some businesses that were not subject to HIPAA before the Final Rule now have HIPAA compliance obligations and can be subject to enforcement action for noncompliance. Healthcare providers and others in the healthcare industry should be aware of these changes and how they will apply to their particular business.

The Final Rule is effective on March 26, 2013, and Covered Entities and Business Associates must comply with the Final Rule by September 23, 2013.

Click each subheading below for a detailed summary of some of the key provisions of the Final Rule:

• HIPAA Privacy Rule
• HIPAA Security Rule
• HIPAA Enforcement Rule
• HIPAA Breach Notification Rule
• GINA

If you have any questions about the Final Rule or HIPAA please contact Jill M. Girardeau, the principal drafter of this alert, Sarah B. Crotts, Deonys de Cárdenas, Tracy Field, or any member of Womble Carlyle's Healthcare Industry Team.

For a printer friendly link to this alert, please click here.

HIPAA Rules... Finally!

The below is client alert from our fellow Womble attorney Jill M. Girardeau that I wanted to share with you.

Yesterday, the Office for Civil Rights of the U.S. Department of Health and Human Services released a final rule containing modifications to the HIPAA Privacy, Security, Enforcement, and Breach Notification Rules (the "Final Rule"). The Final Rule will be published in the Federal Register on January 25, 2013. We are conducting a thorough review of the Final Rule and will provide a comprehensive summary once our review is complete. In the meantime, we thought the following information may be helpful to you.

• The Final Rule is effective on March 26, 2013, and Covered Entities and Business Associates must comply with the Final Rule by September 23, 2013.
• The Breach Notification Rule has been modified. Until now, an impermissible use or disclosure of Protected Health Information ("PHI") was a Breach only if there was a significant risk of harm. Now, an impermissible use or disclosure of PHI is presumed to be a Breach unless the Covered Entity or Business Associate can demonstrate that there is a low probability that the PHI has been compromised.

• A subcontractor of a Business Associate that creates, receives, maintains, or transmits PHI on behalf of the Business Associate is now itself a Business Associate. As a result, these subcontractors are subject to the HIPAA provisions applicable to Business Associates.

• A Covered Entity and a Business Associate (and a Business Associate and its subcontractor) may continue to operate under an existing Business Associate Agreement ("BAA") for a certain amount of time if (1) prior to January 25, 2013, the BAA complied with then-current HIPAA rules and (2) the BAA is not renewed or modified from March 26, 2013 until September 23, 2013. If these conditions are met, the parties can operate under the existing BAA until the earlier of (1) the date the BAA is renewed or modified on or after September 23, 2013 or (2) September 22, 2014.

• The Final Rule takes a different approach to marketing than the proposed rules from 2010. In short, individual authorization is required for all treatment and health care operations communications if the Covered Entity receives financial remuneration from a third party whose product or service is marketed in the communications.

Stay tuned for a more in-depth analysis of the Final Rule. In the meantime, if you have any questions about the Final Rule or HIPAA, please contact Jill M. Girardeau, any member of the Health Care Practice Group, or the Womble Carlyle attorney with whom you normally work.