The Department of Health and Human Services recently published the Final Omnibus Rule which officially implements the HITECH Act under HIPAA. The Final Omnibus Rule will replace the Interim Rule on March 26, 2013 and will significantly raise the bar on patient privacy. By September 23, 2013, all covered entities and business associates will be legally required to be in compliance with HITECH.

Who are these “Covered Entities”?
Any medical office regardless of size, large hospitals, drugstore chains, and large health insurance companies are all covered entities. Offices of all size must comply with current regs. On April 17, 2012, the United States Department of Health and Human Services (“HHS”) announced that its Office of Civil Rights (“OCR”) had reached a settlement with Phoenix Cardiac Surgery, P.C. requiring the practice to pay a $100,000 fine. Phoenix Cardiac Surgery is a five-physician practice in Phoenix, Arizona. The practice was posting clinical and surgical appointments for its patients on an Internet-based calendar that was publicly accessible. 

The biggest changes to the final rule are:
1. Business Associates
Business Associates are now directly liable for compliance with the requirements of HIPAA. Under the Security Rule provisions, they must evaluate security programs and implement risk management strategies to protect electronic PHI. To learn “What is a Business Associate?” please click here.

2. Breach Notification
The “risk of harm” standard used to determine when notification of a security or privacy breach is required has been replaced with the “risk assessment” standard. While the two are similar, a risk assessment is more precise and it is hypothesized that more breach notifications will be reported.

This is just a small part of the changes needed. If you don’t know where to start then give us a call at 512-832-6209 and we can help.