On Sept. 23, 2013, new rules for the Health Insurance Portability and Accountability Act (HIPAA) take effect. The most significant changes are:
- It makes business associates of covered entities directly liable for compliance with certain of the HIPAA Privacy and Security Rules' requirements.
- It strengthens the limitations on the use and disclosure of protected health information for marketing and fundraising purposes, and prohibits the sale of protected health information without individual authorization.
- It expands individuals' rights to receive electronic copies of their health information and to restrict disclosures to a health plan concerning treatment for which the individual has paid out of pocket in full.
- It requires modifications to, and redistribution of, a covered entity's notice of privacy practices.
- It modifies the individual authorization and other requirements to facilitate research and disclosure of child immunization proof to schools, and to enable access to decedent information by family members or others.
Because of these changes, physician practices must modify various policies and procedures by Sept. 23, 2013, in order to comply with the new rule.
MMS PPRC Resources
To assist in with
these efforts, the MMS has created sample Notice of Privacy Practices and Business
Associate Agreement documents that physicians can use in their practice.
AMA HIPAA Toolkit
The American Medical Association has developed a comprehensive toolkit
to help physicians
navigate the revisions to the federal privacy and security rules
for health information.
