News & Analysis as of September 17, 2024

Covered Entities

+ Follow

Business Associates can refer broadly to individuals engaged in business relationships with one another. However, in the HIPAA context, the term has a specific statutory meaning and those characterized as business associates have expanded data protection obligations and duties. Essentially, a business associate under HIPAA is a person or entity that performs certain functions or services which necessitates exposure to protected health information on behalf of a covered entity. Typical business associate functions include: claims processing or administration, data analysis, billing, etc. less -

What HIPAA Security Rule Surprises Await Healthcare Providers for the Second Half of 2024?

Holland & Knight LLP on 5/14/2024

The U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR) has, as part of its mandate, the responsibility to enforce the Health Insurance Portability and Accountability Act (HIPAA) Security Rule....more

Annual Report to Congress on HIPAA Privacy, Security, and Breach Notification Rule Compliance

Benesch on 4/4/2024

The U.S. Department of Health and Human Services (HHS), Office for Civil Rights (OCR) recently published an executive summary (Report) outlining key enforcement activities of the Health Insurance Portability and...more

HHS OCR Provides Annual Report to Congress Detailing 2022 Enforcement Activities

BakerHostetler on 3/19/2024

On Feb. 16, the U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR) published its 2022 Annual Report to Congress. ...more

The Long-Awaited Part 2 Modifications Are Finalized with New Obligations for Part 2 Providers and Less Friction for Sharing...

BakerHostetler on 3/1/2024

On February 8, 2024, the U.S. Department of Health & Human Services (HHS) released a final rule modifying 42 CFR Part 2 (Part 2) provisions regarding the confidentiality of Substance Use Disorder (SUD) Patient Records. The...more

Office of Civil Rights Guidance on Recognized Security Practices Under the 2021 HITECH ‎Act Amendment

Locke Lord LLP on 12/14/2022

Last year, Congress enacted an amendment to the HITECH Act in January 2021 (“HITECH Amendment”) to require that the Department of Health and Human Services (“HHS”) consider whether a covered entity or business associate has...more

HHS Proposes New Rule Aligning Part 2 Regulations with HIPAA

BakerHostetler on 12/6/2022

On November 28, 2022, the U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR) and the Substance Abuse Mental Health Services Administration (SAMHSA) announced a Notice of Proposed Rulemaking...more

The Potential Impact of State Abortion Laws on Reproductive Health Apps

Goodwin on 7/19/2022

Millions of women use reproductive health applications (or “apps”) to track menstrual cycles, ovulation, and pregnancy. These apps provide women that use the rhythm method for birth control and women seeking to become...more

OCR Seeks Input on “Recognized Security Practices” as Mitigating Factor for HIPAA and HITECH Fines

McGuireWoods LLP on 5/27/2022

• In 2021, HITECH was amended to add “recognized cybersecurity practices” as a mitigating factor when determining fines, audits and remedies against covered entities and business associates for violations of HIPAA....more

OCR: Current Fines Too Low to Spur Compliance; Agency Also Seeks Funding Boost, Injunctive Relief

Health Care Compliance Association (HCCA) on 5/6/2022

Report on Patient Privacy 22, no. 5 (May, 2022) - Compared to other agencies, the HHS Office for Civil Rights (OCR) is a little fish in the big federal pond, but it has an outsize effect on HIPAA covered entities (CEs) and...more

Recent OCR HIPAA Enforcement Actions and Request for Information on HITECH Implementation

Arnall Golden Gregory LLP on 4/20/2022

Enforcement Actions - In its first announcement of enforcement actions in 2022, the U.S. Department of Health and Human Services (“HHS”) Office for Civil Rights (“OCR”) simultaneously announced the resolution of three...more

Any Port in a Storm? OCR Seeks Comments on HIPAA “Safe Harbor” for Recognized Security Practices

Wyrick Robbins Yates & Ponton LLP on 4/20/2022

Earlier this month, HHS’s Office for Civil Rights (OCR) issued a Request for Information (RFI) seeking comments on a statutory provision adopted last year that provides a quasi-safe harbor for entities that have voluntarily...more

Office For Civil Rights Seeks Input on Implementation of HITECH Amendments

Baker Donelson on 4/11/2022

On April 6, 2022, the U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR) released a Request for Information (RFI) seeking public comment on "recognized security practices" and on sharing civil...more

Important FTC Rules for Health Apps Outside of HIPAA

Holland & Knight LLP on 9/27/2021

The Federal Trade Commission (FTC) adopted a policy statement on Sept. 15, 2021, emphasizing that developers of digital health apps, connected devices and other health products have obligations under the Health Breach...more

HITECH Act Amended to Give Businesses Brownie Points for Certain HIPAA Security Programs

Holland & Knight LLP on 1/7/2021

On Jan. 5, 2021, the President signed into law H.R. 7898, which provides even more incentive for Health Insurance Portability and Accountability Act (HIPAA)-covered entities and business associates to develop robust security...more

Congress Passes Bill to Mitigate Penalties for Potential HIPAA Violations

WilmerHale on 12/23/2020

On December 19, the Senate passed H.R.7898, which the House of Representatives had previously passed on December 9. This law amends the Health Information Technology for Economic and Clinical Health (HITECH) Act to require...more

Modified HIPAA Rules for Sending Records to Third Parties

Holland & Hart - Health Law Blog on 2/10/2020

Thanks to a federal judge, the Office for Civil Rights has modified its rules for sending records to third parties. Covered entities are no longer required by HIPAA to send non-electronic protected health information (“PHI”)...more

Some Reminders on How HIPAA Works

WilmerHale on 11/22/2019

The HIPAA privacy rules have been in the news a lot lately. That’s good, but not when it’s for the wrong reasons or based on a misunderstanding of the rules....more

Encrypt Your Devices or Face HIPAA Penalties

Holland & Hart - Health Law Blog on 11/8/2019

This week, the Office for Civil Rights (“OCR”) announced a $3,000,000 HIPAA settlement arising from a medical center’s loss of an unencrypted laptop and flash drive. This is simply the latest of many HIPAA settlements based...more

HHS Lowers Annual Caps on Most HIPAA CMPs

McGuireWoods LLP on 7/12/2019

On April 30, 2019, the United States Department of Health and Human Services (HHS) published a notice of enforcement discretion that lowers most of the annual caps on civil money penalties (CMP). HHS may assess against...more

HHS Releases Guidance on Direct Liability for Business Associates Under HIPAA

Jones Day on 6/21/2019

The Situation: On May 24, 2019, the Department of Health and Human Services ("HHS") issued a new fact sheet clarifying business associates' direct liability for violations of the Health Insurance Portability and...more

Understanding When Business Associates Are Directly Liable Under HIPAA

Miller Canfield on 6/4/2019

New guidance issued by the U.S. Department of Health & Human Services (HHS) Office for Civil Rights (OCR) reaffirms that business associates must have proper HIPAA compliance practices, safeguards and documentation in place...more

Liability of Business Associates for HIPAA Penalties

Holland & Hart - Health Law Blog on 5/30/2019

The HITECH Act extended certain HIPAA obligations to business associates, including those entities that create, receive, maintain or transmit protected health information (“PHI”) on behalf of covered entities. Business...more

Good News for Covered Entities and Business Associates: Recent HHS HIPAA Pronouncements Acknowledge Realities and Soften Impact

Arnall Golden Gregory LLP on 5/8/2019

In two recent pronouncements, the United States Department of Health and Human Services (HHS) has taken a balanced approach to interpreting the Health Insurance Portability and Accountability Act (HIPAA) regulations that...more

HHS Decreases Maximum HIPAA Penalties

Ballard Spahr LLP on 5/6/2019

The Department of Health and Human Services has announced that it is lowering the maximum amount it will assess for most types of HIPAA violations. Although the change is couched as an exercise of discretion, HHS states that...more

HHS Reinterprets (and Significantly Lowers) Annual Penalty Caps for HIPAA Violations

Davis Wright Tremaine LLP on 5/1/2019

The Department of Health and Human Services Office for Civil Rights (OCR) today announced that it is lowering the maximum total penalties it may assess against covered entities and business associates for multiple violations...more

99 Results

View per page

Page: of 4

Business Associates › HITECH Act › Covered Entities

"My best business intelligence, in one easy email…"