New feature: Ann & Dan's compliance corner
Welcome to Ann & Dan's Compliance Corner! In this new monthly column, we'll bring you updates on compliance issues you want to know about. Our Compliance Team, led by Dan Orenstein (see his athenista spotlight in this issue), regularly addresses compliance issues affecting athenahealth and our customers – in addition to keeping abreast of industry-wide issues – and we want to keep you in the loop. This month, we kick off the column with an update on the much-anticipated HIPAA Enforcement Rule.
The long-awaited final version of the HIPAA Enforcement Rule was released on February 16, 2006 in the Federal Register. The Rule describes how the Department of Health and Human Services (HHS) may take steps to impose civil penalties on providers and other organizations that violate HIPAA standards and requirements. Many are expecting that HIPAA enforcement will increase, now that the government has clear standards with which to prosecute violations and calculate penalties. However, while the Enforcement Rule establishes procedures to enforce HIPAA, it doesn't affect HHS's enforcement priorities.
The Enforcement Rule allows HHS considerable flexibility in enforcing HIPAA requirements, including giving technical assistance to providers rather than imposing penalties. It does, however, give HHS leeway to impose penalties for multiple violations arising out of a single set of events. An unusual feature of the Enforcement Rule is that it authorizes HHS to report the imposition of civil penalties to state and local medical and professional organizations, state agencies, and to the public at large. It is also important to note that the Enforcement Rule only applies to civil enforcement. More serious violations, such as the intentional release of protected health information (PHI) to an unauthorized person can result in criminal penalties, which are prosecuted by U.S. Attorneys' offices which are not bound by the provisions of the Enforcement Rule. The Enforcement Rule is available at: http://www.hhs.gov/ocr/hipaa/FinalEnforcementRule06.pdf.
Disclaimer: The content of Compliance Corner is for general informational purposes only, and should not be interpreted as compliance guidance or advice. Consult your compliance advisor or attorney for compliance or legal advice on specific issues related to your practice or compliance program.