HIPAA Omnibus Rule Final Release Issued
The HIPAA Omnibus Rule (Health Insurance Portability and Accountability Act of 1996 Omnibus Rule) was drafted in July 2010; however the final release has been delayed until this month in order to address some of the concerns raised by stakeholders about the latest HIPAA amendment.
The final rule has been held by the Office of Management and Budget since March last year although the final release has now been issued. All HIPAA-covered entities – and their business associates – must read the new rule and make changes to existing policies and procedures and factor in the new amendments. Healthcare organizations have 180 days in order to effect the changes as the Final Rule will not be enforced until Sept 22, 2013.
The new rule has been issued to bring HIPAA in line with HITECH, and was introduced by the U.S. Department of Health and Human Services’ Office of Civil Rights to cover the use of Health Information Technology (HIT) and ensure that patient health information is properly protected. The final rule represents a major change to the legislation and is the most extensive amendment to be introduced since HIPAA came into effect in 1996.
The Final Rule runs to 563-pages; although the main points covered in the amendment – in terms of HIT – are indicated below:
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
- An individual’s Personal Health Information should be properly protected and policies have been introduced to strengthen security and privacy protection
- There is now a requirement for Business Associates and their subcontractors to be HIPAA compliant and adhere to the same standards as covered entities
- The new rule prohibits the sale of PHI without prior permission being obtained and restrictions have been placed on the of the use of health data for marketing purposes
- Patients are able to prevent their health plan from being informed about services paid for in cash
- Further modifications have been made to the Privacy Rule to cover the use of genetic information
- Changes to Breach Notification Rules introduces a new standard for the assessment of the liability of a healthcare organization after a data breach
- The OCR’s strategy for enforcing HIPAA regulations has been clarified
- Changes have been made to make it easier for parents to share-proof a child’s immunization with a school
- It will be easier for individuals to authorize the use of their personal health information for research purposes
- The new rule introduces stiff penalties for non-compliance and data breaches based on the degree to which the entity in question is liable, with a maximum fine of up to 1.5 million per violation
