In addition to the COBRA subsidy, the American Recovery and Reinvestment Act of 2009 (“ARRA”), enacted on February 17, 2009, made significant changes to HIPAA privacy and security obligations. Those changes affect covered entities, including group health plans, and also affect business associates. Although most of the HIPAA changes are effective February 17, 2010, one change (regarding breach notifications) will become effective earlier. A summary of the key provisions affecting group health plan covered entities and business associates is below.
- Requirement to Notify Individuals of HIPAA Breaches. The law changes now require covered entities to notify eachindividual whose unsecured protected health information (“PHI”) has been breached. For a breach of PHI under the control of a business associate, the business associate is required to notify the covered entity. Notice of the breach has to be provided to the Secretary of the US Department of Health and Human Services (“HHS”) and in the case of a mass breach involving more than 500 individuals, to a prominent media outlet. Unsecured PHI means PHI that is not secured through the use of a technology or methodology specified by the Secretary of the US Department of Health and Human Services.
The Secretary of HHS is required to issue guidance about acceptable technology within 60 days of February 17, 2009. The law contains a default description of acceptable technology in the event that HHS does not timely issue guidance. The ARRA directs the HHS to issue regulations within 180 days of February 17, 2009. Then, the new notification requirements will apply to breaches discovered on or after the date that is 30 days after the date the regulations are published.
- Additional Individual Rights.
– Accounting of Disclosures for Treatment, Payment and Health Care Operations.Under current law, individuals have the right to an accounting of disclosures of their PHI made in the previous six (6) years requiring covered entities to track the disclosures. There are certain exceptions to the accounting requirement such as disclosures that are made for treatment, payment, or health care operations. Now, a covered entity that uses or maintains an “electronic health record” with respect to PHI must account for disclosures for treatment, payment, and heath care operations. This accounting is limited to disclosures made in the previous three (3) years. HHS is required to promulgate regulations implementing this new requirement.
There are two general effective dates: (1) with respect to electronic health records acquired by a covered entity on January 1, 2009, the effective date is January 1, 2014 and (2) with respect to electronic records acquired by a covered entity after January 1, 2009, the effective date is January 1, 2011 or, if later, the date the electronic record is acquired.
– Access to PHI in Electronic Form. If a covered entity uses or maintains an electronic health record for PHI, the new law gives individuals the right to obtain a copy of the PHI in electronic format. The individual can also direct the covered entity to transmit an electronic copy directly to an entity or person designated by the individual.
This requirement is effective as of February 17, 2010.
– Right to Restrict Disclosures for Payment & Health Care Operations. Under current law, individuals have the right to request that a covered entity not disclose their PHI for purposes of routine treatment, payment, or health care operations, although the covered entity is not required to agree to the restriction. Now, the covered entity must agree to the restriction for purposes of payment and health care operations (but not for purposes of treatment) if the PHI pertains solely to a health care item or service for which the health care provider involved has been paid out of pocket in full. This requirement is effective as of February 17, 2010.