HHS Puts Industry on Notice: OCR is Serious About HIPAA Enforcement

Posted by Jason Greis on March 2, 2011 under Articles | Be the First to Comment

On Feb. 22, 2011, the U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR) announced that it had issued a civil money penalty (CMP) of $4.3 million against Cignet Health of Prince George’s County, MD., the first imposition of a CMP by OCR for a violation of the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy Rule. Two days later, HHS announced that General Hospital Corporation and Massachusetts General Physicians Organization, Inc., collectively referred to as Mass General, agreed to pay $1 million to settle potential violations of the HIPAA Privacy Rule. Read More...

HIPAA and HITECH Proposed Regulations Released

Posted by Jason Greis on August 6, 2010 under Articles | Be the First to Comment

Summary of Proposed Changes to Privacy, Security and Enforcement Rules Read More...

Many HIPAA Changes under the HITECH Act Now Effective

Posted by Jason Greis on February 22, 2010 under Articles | Be the First to Comment

Having reached the one year anniversary of the HITECH Act, enacted as part of the American Recovery and Reinvestment Act of 2009, many changes to the HIPAA Privacy and Security Rules are now effective. Unfortunately, since the Department of Health and Human Services has not yet issued guidance with respect to most of these changes, Covered Entities and Business Associates must begin good faith compliance based solely on the language of the HITECH Act. Below are some highlights. Read More...

GreisGuide to LTACHs Newsletter (November/December 2009)

Posted by Jason Greis on December 16, 2009 under eNewsletter | Be the First to Comment

This issue of the GreisGuide to LTACHs Newsletter contains articles and information on: Read More...

LTACHs Should Revise All HIPAA Business Associate Agreements by February 17, 2010

Posted by Jason Greis on December 6, 2009 under Articles | Be the First to Comment

Covered entities (i.e. LTACHs and other healthcare providers), and the business associates that assist them with the performance of functions and activities that involve access to protected health information (“PHI”), are now subject to much greater regulation of their information security practices as a result of the Health Information Technology for Economic and Clinical Health Act (“HITECH Act”).  The HITECH Act was included as Title XIII of the Federal economic stimulus package, the American Recovery and Reinvestment Act of 2009 (“ARRA”), and represents the most expansive modification to the Federal privacy and security rules for health-related businesses since the 1996 enactment of HIPAA. Read More...

LTACH Medical Director and Medical Center Employees Receive Fines and Probation for HIPAA Violations

Posted by Jason Greis on December 5, 2009 under Articles | Be the First to Comment

In October 2009, a Federal judge in Arkansas sentenced the medical director of an Arkansas hospital-within-hospital LTACH and an account representative and emergency unit coordinator of the host hospital to fines and probation for violating the Health Insurance Portability and Accountability Act (“HIPAA”) by unlawfully viewing a high profile patient’s electronic medical records.  (U.S. v. Holland, E.D. Ark., No. 09-cr-168, sentencing Oct. 26, 2009; U.S. v. Griffin, E.D. Ark., No. 09-cr-169, sentencing Oct. 26, 09; U.S. v. Miller, E.D. Ark., No. 09-cr-170, sentencing Oct. 26, 2009).  Read More...