The American Recovery and Reinvestment Act of 2009 (ARRA) expands the privacy protections for health information under the Health Insurance Portability and Accountability Act of 1996 (HIPAA).
On April 17, 2010, the Department of Health and Human Services (HHS) released guidance on technologies and methodologies for securing legally protected health information (PHI), which takes effect immediately.
Until now, HIPAA’s privacy and security requirements applied only to health care providers, health insurance plans and health care clearinghouses. Now those requirements (and the penalties for non-compliance) also apply directly to third-party administrators and other vendors.
The act significantly increases civil penalties for violations. Maximum penalties are $10,000 per violation, with a cap of $250,000 for multiple violations during the calendar year. The penalties apply to all violations after the date of enactment. Health and Human Services will periodically audit covered entities and will investigate covered entities upon receiving a complaint.
Effective immediately, state attorneys general can bring civil actions in federal court against covered entities seeking injunctions against violations and can sue for damages on behalf of state residents.
InterComputer’s Trusted Health Information solution prevents the compromise of electronic identities and communications between health care providers, insurance companies, other vendors, and patients, and insure against losses and regulatory penalties from cybercrime of any kind.
