by Kim Stanger, Holland & Hart LLP

HHS issued the new HIPAA omnibus rule yesterday. The new rule contains important changes for health care providers and their business associates. For example, the new rule:

• Modifies the standard for reporting breaches to patients and HHS. HHS replaced the former “no harm, no foul” rule with a new standard: a breach is presumed unless the covered entity can demonstrate a low probability that the protected health information has not been compromised. This requires an assessment of specified factors and will likely increase the number of reportable breaches.
• Confirms HIPAA requirements for business associates and their subcontractors. Business associates are subject to HIPAA penalties if they fail to comply. The definition of “business associates” was expanded to include entities that provide data transmission services for protected health information and require routine access to the information.
• Confirms providers are liable for their business associate’s violations if the business associate is acting as the agent for the provider. The rule’s commentary contains a helpful analysis for determining whether an agency relationship exists.
• Makes it easier for family members to obtain information about decedents. The rule also confirms that HIPAA does not apply to information 50 years after the decedent’s death.
• Expands patients’ right to obtain electronic copies of their records.
• Prohibits providers from disclosing information to health insurers if the patient pays for the treatment and requests that the information not be disclosed to insurers. Implementation will create significant practical problems for practitioners.
• Prohibits the sale of protected health information unless certain conditions are satisfied.
• Imposes additional requirements for the use of protected health information for marketing or fundraising. Among other things, an authorization is required to disclose information for treatment purposes if the provider is receiving remuneration for the disclosure.
• Requires new provisions to be added to providers’ Notice of Privacy Practices, including a description of disclosures that require authorizations and notice of a patient’s right to receive notice of HIPAA breaches.