Summary of Changes: HIPAA & the HITECH Act

by Trish Voss

As the New Year approaches, we must make sure we are prepared to face the challenges of the expanded HIPAA legislation referred to as the HITECH Act (Health Information Technology for Economic and Clinical Health).  There are a lot of things to consider, so I thought posting an itemized list of the expanded obligations under HIPAA, along with the new obligations imposed with the HITECH Act, would provide a quick reference of items to review or address.

• Expanded Penalties (Effective Immediately)
• Expanded Obligations – Business Associates (Effective 2/17/2010)
• Expanded Obligations – Unsecured Information (Effective not later than 9/16/2009)
• Expanded Obligations – RHIOs, HIEs, and PHR Vendors (Effective 2/17/2010)
• Expanded Obligations – Accounting for Disclosures (Effective no earlier than 1/11/2011)
• New Obligations – Restrictions on Disclosure of PHI (Effective 2/17/2010)
• New Obligations – PHR Vendors and Breaches of Security (Effective no earlier than 8/17/2009)
• New Obligations – Marketing and Fundraising Activities (Effective 2/17/2010)
• New Obligations – Government Oversight (Effective no earlier than 2/17/2010)

There are several documents available for review online.  A really nice summary of the itemized changes is available from Legal HIM formation.  It can be difficult and time consuming to read the actual regulations.  Having a summary that provides a quick and easy to understand description of the expanded and new obligations gives you the starting point to proactively research and address your compliance requirements.

Best of luck in the New Year!