May 2005 Newsletter

New HIPAA Rules Go Into Effect

By , Compliance Officer, Partner

HIPAA Enforcement NPRM Published

The Department of Health and Human Services (HHS) published a Notice of Proposed Rulemaking (NPRM) of the Health Insurance Portability and Accountability Act (HIPAA) Enforcement Rule in the April 18, 2005 Federal Register.

The proposed rule, entitled, "Civil Money Penalties: Policies and Procedures for Investigations, Imposition of Penalties, and Hearings," would amend the existing rules relating to the investigation of noncompliance to make them apply to all of the HIPAA Administration Simplification rules, rather than exclusively to the Privacy Rule. It would also amend the existing rules relating to the process for imposition of civil money penalties.

This proposed rule would complete the Enforcement Rule by addressing, among other issues:

• Clarification and elaboration of the investigation process
• Bases for liability
• Determination of the penalty amount
• Grounds for waiver
• Conduct of the hearing
• The appeal process

The HHS approach to enforcement is to promote and encourage voluntary compliance with the HIPAA rules through education, cooperation, and technical assistance. They intend to continue to work on educational and technical assistance materials, including additional guidance on compliance and enforcement along with targeted assistance materials focused on particular segments of the health care industry.

The authority for administering and enforcing compliance with the Privacy Rule has been assigned to the HHS Office of Civil Rights (OCR) while enforcement of non-privacy HIPAA rules has been delegated to the Centers for Medicare & Medicaid Services (CMS). CMS's responsibility for enforcement of the rule extends to all covered entities whether or not they participate in federal programs. According to HHS data through January 31, 2005, OCR has received 10,785 privacy complaints since the Privacy Rule came into effect; 62% of the complaints have been resolved.

Comments from the public on all issues set forth in this NPRM will be considered by HHS until June 17, 2005. Submit comments by email.