The federales announced a new set of HIPAA regulations today (to be published in the Federal Register on July 14) in a press conference featuring Kathleen Sebelius (HHS Secretary), Georgina Verdugo (HHS OCR Director) and David Blumenthal (ONC Director). The HIPAA changes are essentially mandated by the HITECH Act. From the HHS presser:
The proposed rule announced today would strengthen and expand enforcement of the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy, Security, and Enforcement Rules by:
- expanding individuals’ rights to access their information and to restrict certain types of disclosures of protected health information to health plans;
- requiring business associates of HIPAA-covered entities to be under most of the same rules as the covered entities;
- setting new limitations on the use and disclosure of protected health information for marketing and fundraising; and
- prohibiting the sale of protected health information without patient authorization.
Two new websites were announced as well. One is a beefed-up version of the HIPAA data breach notification wall of shame, and the other is a new HHS privacy website directed at the general public, now up at hhs.gov/healthprivacy.
This website, a joint statement from ONC and OCR posted today, and the tenor of the federales’ remarks today indicate a deep concern about public perceptions concerning privacy and security of protected health information — sort of a “what if we throw a party and nobody comes?” vibe.Continue reading…


