Feds: Business Associate HITECH Provisions Forthcoming

OCR reminded covered entities and BAs that two interim final rules implementing HITECH provisions have already been issued and are currently in effect: enforcement and breach notification.

New civil money penalty amounts apply to HIPAA privacy and security rule violations occurring after February 17, 2001. Covered entities and BAs must comply now with breach notification obligations for breaches that are discovered on or after September 23, 2009.

OCR has said it would use its "enforcement discretion" not to impose fiscal sanctions with regard to breaches discovered before February 22, 2010.

"Since that date has passed, OCR will enforce the Breach Notification Interim Final Rule, including with the possible imposition of sanctions, as it does with the HIPAA Privacy and Security Rule requirements," OCR added.