HIPAA final rule tightens data security requirements.

• Position: HIPAA

On March 26, the final rule to the Health Insurance Portability and Accountability Act (HIPAA) went into effect, ending the more than three-year effort to overhaul the provisions of the 1996 law. Most of the changes were required by the 2009 HI TECH Act, which incentivized the implementation and use of electronic health records and prompted the development of standards, implementation specifications, and certification criteria for the exchange and use of electronic health information.

The new rule expanded the definition of "business associates," requiring more entities to take a more proactive role in complying with HIPAA. Previously, the law required healthcare providers and other "covered entities" to contractually require that any organization that handles protected heath information (PHI) on behalf of the covered entity (business associate) also to comply with HIPAA.

Under the new rule, the business associate must take full responsibility for ensuring it complies with HIPAA's data security and privacy rules. This means that business associates will also be subject to annual civil penalties for each HIPAA violation, which could be as much as $1.5 million per violation.

Breach notification requirements were also addressed in the new rule. The proposed rule defined a data security breach as the "acquisition, access, use, or disclosure of [PHI] in a manner not permitted [by the Privacy Rule] which compromises the security or privacy of the [PHI]." It went on to say the standard should be whether there was a "significant risk of financial, reputational, or other harm to the individual."

[ILLUSTRATION OMITTED]

The final rule, however, requires that the entity trying to avoid breach...