Weekly roundup: Final privacy rule, finally

Considering we reported on three data breaches this week alone, it seems the final privacy rule couldn't be released soon enough. The final omnibus rule is designed to strengthen the privacy and security protections for health information established under HIPAA, according to the Department of Health and Human Services. The rule enhances patients' privacy protections, provides individuals new rights to their health information and strengthens the government’s ability to enforce the law.

The most important new standard, Adam H. Greene, partner of Davis Wright Tremaine law firm in Washington, D.C., told Clinical Innovation + Technology, is the standard for breach notification which was modified from risk of harm to probability of compromise.

“What this really means is that the Department of Health and Human Services (HHS) is attempting to go from what many argued was subjective determination as to whether an individual was harmed to something a bit more objective.” If the information was compromised, “the rule suggests that HHS would consider it a breach regardless of whether there is potential reputational or financial harm.” The rule expands the scope of what is going to be reported.

In the past, Greene explained, “if you had patient information that fell into the wrong hands and knew the information was compromised but there didn’t seem to be much harm to the individual, you could demonstrate that there was no significant risk of potential harm. That standard has been removed.” Now, if you know the information has been compromised, you are no longer in a position of determining whether you believe that compromise will result in harm. You are required to report the breach.

“It is clear what they’ve tried to do is create a more objective standard,” said Lisa A. Gallagher, senior director of privacy and security for the Healthcare Information Management and Systems Society. “This is a positive step and I’m a big proponent of ongoing security risk management anyway.”

Are you prepared to reevaluate your business associate agreements, notify the appropriate people in the event of a breach and adjust your harm threshold? Please share your experience.

Beth Walsh

Clinical Innovation + Technology Editor

bwalsh@trimedmedia.com