Time & Attendance
By Staff Report
Aug. 25, 2009
The U.S. Department of Health and Human Services has issued regulations requiring providers, health plans and other entities covered by the Health Insurance Portability and Accountability Act to notify individuals when their health information is breached.
The regulations issued Wednesday, August 19, implement provisions of the Health Information Technology for Economic and Clinical Health Act, which passed as part of the American Recovery and Reinvestment Act of 2009, which President Barack Obama signed into law in February.
The regulations require health care providers and other HIPAA-covered entities to promptly notify affected individuals, the HHS secretary and the media when the breach affects more than 500 individuals.
Breaches affecting fewer than 500 individuals must be reported to the HHS secretary annually. Business associates of covered entities also are required to notify the covered entity of breaches at or by the business associate, according to the HHS.
“The new federal law ensures that covered entities and business associates are accountable to the department and to individuals for proper safeguarding of the private information entrusted to their care,” Robinsue Frohboese, acting director and principal deputy director of the HHS Office for Civil Rights, which developed the regulations, said in a statement. “These protections will be a cornerstone of maintaining consumer trust as we move forward with meaningful use of electronic health records and electronic exchange of health information.”
Alison Schaap, a Chicago-based legal consultant with Hewitt Associates, said employers are “going to have to look at their existing polices, what needs to change in terms of how they provide the required notification to individuals, and what updates they need to make” to their business associate agreements “so they can get the necessary information within the required time frame to provide notification to individuals in the event of a breach of unsecured protected health information.”
America’s Health Insurance Plans, the Washington-based health insurer trade group, applauded the regulations.
“We are pleased that the new regulations give practical guidance plans and outline reasonable standards for assessing if a data breach has occurred,” AHIP said in a statement.
Schedule, engage, and pay your staff in one system with Workforce.com.
ComplianceMinimum Wage by State (2023)
federal law, minimum wage, pay rates, state law, wage law compliance
Staffing Management4 proven steps for tackling employee absenteeism
absence management, Employee scheduling software, predictive scheduling, shift bid, shift swapping
Time and Attendance8 proven ways to reduce overtime & labor costs (2023)
labor costs, overtime, scheduling, time tracking, work hours