• It clarifies an individual’s right to access their PHI (Protected Health Information).  They have the right to ask a provider for a copy of their PHI along with a list of all disclosures the provider has made of this information.  These disclosures would include health plans and other providers in your referral or consulting network.
• Privacy and security requirements have been extended to the provider’s business associates.
• The maximum data breach penalties have been raised to $1.5 million per violation.

Let’s dedicate a little more space in this post to talking about data breach, since this is the item that is getting the most attention with the new rules.

A data breach or data exposure is an unauthorized release of a patient’s PHI.  The old rule allowed the provider to assess whether the exposure created a risk of harm to the patient, sometimes called the “harm threshold”.  If there was no risk of harm then the breach did not need to be reported. 

The new rule strengthens this definition.  Its focus is no longer on the risk of harm to the patient but whether there was an unauthorized release of PHI.  Very little “wiggle-room” for a provider confronted with an exposure.

Since reporting a data breach means informing the patients involved, HHS and perhaps your local media it can have a detrimental effect on your dental practice.  This does not even take into account the penalties that can be levied by the federal government.

I am not an attorney and this post is not intended to provide anyone with legal advice.  It is to alert you to the new HIPAA rules and to suggest you consult your legal counsel for a more informed opinion, particularly if you are confronted with a potential breach.  

I’ll leave you with a couple of quotes from Leon Rodriguez the Director of the HHS Office of Civil Rights (the HIPAA enforcement arm).  He says about the new rules,

“…not only greatly enhances a patient’s rights and protections, but also strengthen the ability of my office to vigorously enforce the HIPAA privacy and security protections.”

And again from Mr. Rodriguez,

“We have moved into an area of more assertive enforcement.”

Taking these new rules seriously would be a right click.

.