penalty assessed will depend upon the culpability of the entity or individual that violated hiPaa. in general, violations that occur under circumstances in which the individual or entity did not know (or would not have known exercising reasonable diligence) result in lower penalties than those in which the entity or individual “willfully neglected” to comply. the entity or individual’s response to the identified violation is also a factor, and increased penalties may result if corrective action is not taken within 30 days. the final rule reaffirmed hhs’s commitment to investigating alleged violations and clarified that the ocr is required to investigate violations of hiPaa that are suspected to have been caused by willful neglect (it no longer retains the discretion to determine if it wishes to conduct an investigation). The stated purpose of the Final Rule is to both “strengthen the privacy and security protections” established under HIPAA and to “increase flexibility for and decrease burden on the regulated entities.” the final rule also indicated that the ocr will generally conduct a “compliance review” in response to a complaint, whether it stems from a media report, the state, or other means. importantly, the final rule made clear that the secretary of hhs has discretion to directly assess civil monetary penalties without first exhausting informal resolution procedures. on the other hand, the secretary also has discretion to settle issues and cases, and to compromise on the amount of penalties imposed. in exercising this discretion, the secretary may consider all relevant factors, including, but not limited to, the culpability of the violator, the entity or individual’s history of compliance, and the financial condition of the provider (which may increase or decrease the amount of penalties). the extent to which the secretary is willing to compromise remains to be seen. however, it is important for providers to be ready for a review of its hiPaa policies, procedures, and practices at all times. Relaxed Rule for Decedents the final rule eased the burden on providers regarding the provision of a decedent’s Phi to others. specifically, it clarified FEATURE story that providers may disclose Phi to “family members and others who were involved in the care or payment for care of the decedent prior to death, unless doing so is inconsistent with any prior expressed preference of the individual that is known...”1 so long as the provider has “reasonable assurances” that the individual was involved in the decedent’s care or payment for same, the provider is not required to investigate whether the person who seeks Phi is the “personal representative.” hhs declined to place the burden of proof upon the individual seeking the information, but also noted that providers who are not comfortable disclosing Phi to an individual due to questions about the individual’s relationship to the decedent are not required to do so. Immunization Records Release Relaxed requirements to release immunization results to schools were also relaxed. While it remains necessary for providers to document the permission of a parent or guardian to release immunization records to a school, written permission is not required. instead, the parent or guardian’s verbal permission will suffice. Providers are encouraged to document verbal permission in the child’s medical record. Notice of Privacy Practices Providers should be cognizant of both the requirements for revising their notice of Privacy Practice (nPP) and the manner in which the revised document should be provided to patients. among other revisions, the nPP now needs to include a statement advising the patient that he or she has a right to be notified of a breach of unsecured Phi. hhs opined that such a statement is meant to “provide helpful context for individuals should they later receive and breach notification,” and will not “cause individuals unnecessary concern” or create unfounded fear that the journal of the healthcare billing and management association 19
Billing_MJ13
To see the actual publication please follow the link above