New HIPAA rule turns up the pressure on practices

by: Julia Kyles Aug 26, 2009

Beginning Sept. 23, 2009, you'll have a new set of responsibilities in the event your practice accidentally releases protected health information (PHI).

The interim final rule on security breach notification HHS released today serves as a reminder that the government is taking the security of PHI seriously (PBN 8/17/09). You'll have to investigate breaches and notify individual patients within 60 days of a breach. In some instances a breach that affects as few as 10 patients could require an embarrassing notice posted on your website or with major media outlets. And guess what? That 60 day time limit starts ticking away on the day HHS says you should have known about the breach.

On the bright side, a breach won't count if the PHI is encrypted or destroyed in a way that meets HHS's definition of "secure." So make sure you're shredding old paper records (redaction isn't enough) and talk to your software vendor about encrypting your electronic records.

On the Internet:

Interim final rule on breach notification for unsecured protected health information

To comment, login here.

Login

User Name:
Password:
Remember me Forgot password
Welcome to the new Part B News Online. If you are a returning user having trouble logging in, please click here.