New HIPAA Rules Expand Breach Notification Requirements

If your company is subject to HIPAA, new rules published by the Department of Health and Human Services ("HHS") will require changes in your policies and practices regarding data breaches.

Among other things, the new rules implementing the Health Information Technology for Economic and Clinical Health Act ("HITECH Act") have introduced a stricter standard for determining when notification is required and have broadened the group of entities to which it applies.  Here are the highlights:

1. The "Significant Harm" Standard has been Replaced by a "Risk of Compromise" Standard.  Under the previous rule, the unauthorized disclosure of unsecured protected health information ("PHI") was considered a breach requiring notification only if a covered entity or business associate determined that there was a "significant risk of financial, reputational, or other harm" to affected individuals.  Under the new rule, such a disclosure is presumed to be a breach unless a