What Does the HITECH Amendment Have to Do with HIPAA?
Posted:
Monday, November 8th, 2010
Category:
B2B, Healthcare, Higher Education
Part of the American Recovery and Reinvestment Act (ARRA) that President Barack Obama signed into law in 2009 is the provision for the Health Information Technology for Economic and Clinical Health Act (HITECH). This provision expands on the privacy and security protections under the Health Insurance Portability and Accountability Act of 2006 (HIPAA).
How this might affect you and your business is that the new law has increased the legal ramifications for non-compliance and provides stricter enforcement. Knowing the ins and outs of the new law is critical to practitioners in higher education and the healthcare industry.
HITECH requires data breach notification for unauthorized uses and disclosures of “unsecured PHI” (unencrypted personal health information). These breach notification requirements are similar to most state data breach laws related to personally identifiable information. For those health providers with an electronic health record (EHR) system in place, patients have a right to access their electronic personal health information (ePHI). The patient can also have their records be sent to a third-party for a fee that is equal to the labor cost to produce.
Physicians, for their part, feel that the new provision is a “mixed blessing.” The greatest advantage of the new regulation will allow consumers better control over their personal health information. However, the provision will also escalate uncertainty, cost, and risk for any organizations that manage and transmit such information. The amendment will affect the business associates of the physicians. They are required to comply with HIPAA privacy and security regulations. Entities such as clearinghouses, accountants and lawyers who support physicians will bear the culpability in terms of privacy violations.
