New HIPAA rule expands liability for healthcare providers and business partners

The Department of Health and Human Services (HHS) on Thursday issued a final “omnibus” rule to update the Health Insurance Portability and Accountability Act of 1996 (HIPAA).

The comprehensive rule, detailed in a 563-page document, expands the direct liability of contractors and subcontractors of healthcare providers, plans and insurers that violate patient privacy.

Penalties are increased for noncompliance based on the level of negligence with a maximum penalty of $1.5 million per violation. The changes also strengthen the Health Information Technology for Economic and Clinical Health (HITECH) Breach Notification requirements by clarifying when breaches of unsecured health information must be reported to HHS.

“Much has changed in health care since HIPAA was enacted over fifteen years ago,” said HHS Secretary Kathleen Sebelius, in a press release. “The new rule will help protect patient privacy and safeguard patients’ health information in an ever expanding digital age.”

Individual rights are expanded in the rule. Patients can ask for a copy of their electronic medical record in an electronic form. When individuals pay by cash they can instruct their provider not to share information about their treatment with their health plan. The final omnibus rule sets new limits on how information is used and disclosed for marketing and fundraising purposes and prohibits the sale of an individuals’ health information without their permission.

“This final omnibus rule marks the most sweeping changes to the HIPAA Privacy and Security Rules since they were first implemented,” said HHS Office of Civil Rights Director Leon Rodriguez. “These changes not only greatly enhance a patient’s privacy rights and protections, but also strengthen the ability of my office to vigorously enforce the HIPAA privacy and security protections, regardless of whether the information is being held by a health plan, a health care provider, or one of their business associates.”

The final rule will be published in the Federal Register on January 25.

Patricia Sheehan

Patricia Sheehan was Editor in Chief of I Advance Senior Care / Long Term Living from 2010-2013. She is now manager, communications at Nestlé USA.