Sebelius Shifts HIPAA Security Rule Enforcement to Civil Rights Office
The secretary of HHS shifted enforcement of the HIPAA Security Rule from CMS to the Office for Civil Rights (OCR), according to an HHS announcement published Tuesday in the Federal Register.
Until now, OCR has enforced only the HIPAA Privacy Rule, which protects the privacy of patients' health information and the confidentiality provisions of the Patient Safety Rule, which protect PHI from being used to analyze patient safety events and improve patient safety.
The security rule–published in the Federal Register on February 20, 2003–specifies a series of administrative, technical, and physical security procedures for covered entities to assure the confidentiality of electronic protected health information (i.e., encryption standards).
"I think it's smart for HHS to merge the enforcement responsibilities," says Jeff Drummond, health law partner in the Dallas office of Jackson Walker LLP. "But I don't think this signals a watershed shift in enforcement strategy."
The announcement by HHS Secretary Kathleen Sebelius comes as Congress this year helped move a bill through that supports stronger enforcement of HIPAA laws and greater compliance duties from entities who handle PHI.
- CMS Sets 2014 Pay Rates for Hospital Outpatient and Physician Services
- FDA hopes hospitals will switch to newly regulated pharmacies
- New G-Codes to Pay Doctors for Broad Array of Non-Face-to-Face Care
- The Most Polarizing Topics in Healthcare IT
- Not-for-Profit Hospitals Find Opportunity Amid Uncertainty
- Why You Should Involve Patients in Nursing Handoffs
- States Rejecting Medicaid Expansion Forgo Billions in Federal Funds
- The 5 Biggest Healthcare Finance Trouble Spots
- Substance Abuse Resurfaces Among Anesthesiologists in Training
- Safety Net Executives Renew Call to Preserve DSH Payments