HIPAA PRIVACY ENFORCEMENT ON THE RISE

In February 2009, as part of the economic stimulus legislation known as the American Recovery and Reinvestment Act, Congress enacted the Health Information Technology for Economic and Clinical Health Act (HITECH).  HITECH not only provided federal incentives for medical care providers to accelerate implementation of electronic health records systems, but also broadened the categories of those responsible for protecting the patient health information contained in those records and significantly increased the penalties for HIPAA violations.

The original HIPAA Privacy Rule finalized in 2002 applied only to “covered entities” such as health care providers, health plans, health care clearinghouses and later, sponsors of drug discount cards under Medicare. The Department of Health and Human Services Office for Civil Rights (OCR) is responsible for civil enforcement of HIPAA privacy regulations.  Under the original Privacy Rule, OCR lacked direct enforcement authority against the  “business associates” of covered…