![[firm] blog logo](/wp-content/themes/haynesboone2012/images/firm_header.jpg "Blogs of Haynes and Boone, LLP")
Final Rule Released Incorporating HITECH, GINA, and Other Changes into HIPAA
A Final Rule was released which amends the Health Insurance Portability and Accountability Act (“HIPAA”) to incorporate the changes made by the Health Information Technology for Economic and Clinical Health Act (“HITECH”) and the Genetic Information Nondiscrimination Act (“GINA”), and to make HIPAA more “workable” for covered entities, such as employer-sponsored group health plans. An Alert discussing the Final Rule can be found here.
HHS Settles HIPAA Case for $1.5 Million
On March 13, 2012, HHS announced a settlement with Blue Cross Blue Shield of Tennessee (“BCBST”) regarding potential violations of the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) Privacy and Security Rules. The investigation by HHS arose after a November 2009 breach report notice submitted by BCBST to HHS reported that 57 unencrypted computer hard drives containing “protected health information” (“PHI”) of more than 1 million individuals were stolen from a leased facility in Tennessee. As a result of its investigation, HHS discovered that BCBST failed to implement appropriate administrative and physical safeguards to adequately protect PHI. In addition to the $1.5 million penalty, the settlement agreement requires BCBST to review, revise and maintain its Privacy and Security Policies and Procedures and to conduct regular trainings for all BCBST employees with responsibilities under HIPAA. According to HHS, this enforcement action is the first resulting from the breach report… Continue Reading
Ninth Circuit Holds that Federal HIPAA Preempts Montana’s “Little HIPAA” Law
The U.S. Ninth Circuit Court of Appeals recently held that Montana’s “little HIPAA” insurance law (Mont. Code Section 33-22-526) is preempted by ERISA. In applying the “conflict preemption” standard set by the U.S. Supreme Court in Aetna Health Inc. v. Davila, the court held that because the state law claim (i) could have been brought under Section 502(a) of ERISA because the state and federal law provisions were both identical and applied to group health plans, and (ii) is not independent of the federal law because it expressly applied to group health plans subject to ERISA, the state law is preempted by ERISA. Due to preemption of the state law, the state law claim was defeated on its merits. The court, however, noted that it was not expressing an opinion as to whether its holding would apply to a state HIPAA-type statute that provided additional protection beyond the federal HIPAA… Continue Reading
HHS Announces Proposed Changes to HIPAA Privacy Rule
On May 31, 2011, the U.S. Department of Health and Human Services (“HHS”) released a notice of proposed rulemaking containing changes to the Health Insurance Portability and Accountability Act (“HIPAA”) Privacy Rule, pursuant to the Health Information Technology for Economic and Clinical Health Act (“HITECH”). The proposed rules provide individuals with the right to receive an access report discussing any electronic access to their protected health information (“PHI”). Also included in the proposed rule are changes to the accounting requirements for disclosures of PHI which are intended to better provide individuals with such disclosure information that is most likely to impact the individuals’ legal and personal interests. Comments are requested on the proposed rule through August 1, 2011. The proposed rule can be found here.
Tag RSS