91视频

If you do business with health care providers, insurance companies, long-term care facilities, and you receive protected health care information, you may be a 鈥渂usiness associate鈥� under the Health Insurance Portability and Accountability Act. As a business associate, you are required to comply directly with the privacy and security rules under HIPAA to protect a patient鈥檚 health care information.

Protected health care information, or PHI, is information, including demographic data, that relates to a patient鈥檚 past, present or future physical or mental health or condition. This includes payment for health care that identifies the patient or includes information from which one can identify a patient.

In February, President Obama signed The American Recovery and Reinvestment Act into law. Most of the act鈥檚 provisions will become effective on Feb. 17, 2010, including the requirement that business associates comply directly under HIPAA. However, some of those provisions, like new penalty provisions, are effective already.

Prior to the ARRA, business associates were not subject to HIPAA. Rather, only covered entities were required to comply directly. Business associates only had to enter into a contract with a covered entity to protect a patient鈥檚 privacy. Now, in addition to entering into a business associate agreement with a health care provider, a business associate must comply directly with HIPAA鈥榮 privacy and security rules. In order to do that, business associates must take reasonable and appropriate measures to protect a patient鈥檚 PHI.

To comply with HIPAA a business associate should consider appointing a privacy officer. This person would be responsible for implementing and complying with the company鈥檚 privacy policies and procedures, establishing new privacy and security policies to protect PHI from inadvertent or improper disclosures, reviewing existing privacy policies, adding or strengthening current physical and technical safeguards of PHI, reviewing or implementing record retention policies for HIPAA compliance and training employees about HIPAA compliance.

One additional requirement under the ARRA that will impact business associates is the new breach of notification provision. If a business associate inadvertently discloses 鈥渦nsecured鈥� information about a patient, regardless whether such a breach was harmful, the business associate must report the breach to the covered entity so that it can properly notify the harmed party within a specified period of time. Unsecured information means information not protected by technology or methods designated by the federal government that make that information unreadable, undecipherable or unusable.

What happens if you fail to comply with HIPAA? Prior to the ARRA, a business associate faced only contractual liability for failing to comply with a business associate agreement. Now, under ARRA, a covered entity or a business associate who fails to comply with HIPAA is subject to a series of tiered penalties ranging from $25,000 to $1.5 million. That particular penalty provision is now in effect. Thus, if you are not complying with HIPAA and are caught, you could face those penalties now. Another important change under the ARRA is that the U.S. Department of Human Services is now required to conduct audits of covered entities and business associates to ensure compliance with HIPAA. In addition, the ARRA grants state attorneys general the right to police compliance with HIPAA and to bring actions against non-compliant companies. Furthermore, individuals who violate HIPAA may also be prosecuted directly for violations.

The federal government, through ARRA, is sending a clear message: Protection of a patient鈥檚 health care and other personal information is of key importance. If you think you might be a business associate, consult with your attorney about establishing the proper safeguards to avoid disclosures of protected health care information and to update your business associate agreement to include the new provisions required under HIPAA.

Gabriela Sanchez is an attorney with Sussman Shank LLP. She specializes in collections and other issues relating to long-term care and health care facilities. Contact her at 503-227-1111 or [email protected].