HHS releases expanded enforcement rule for HIPAA

HHS has released proposed regulations to "complete the enforcement rule" for standards issued under administrative simplification provisions of the Health Insurance Portability and Accountability Act (HIPAA).

The expansion would allow for enforcement of additional rules under HIPAA pertaining to security, transactions and code sets, and the standard unique health identifiers for healthcare providers. The privacy regulation already has been enforceable under HIPAA administrative simplification.

Procedures for when civil money penalties could be applied are among the additional regulations established in the proposed enforcement rule. Another provision would clarify when covered entities are liable for the actions of their business associates, agents and employees.

Specifically, the rule stipulates covered entities are required to execute business associate agreements with anyone who might see protected health information. HHS will accept comments within 60 days of the April 18 publication of the proposed rule in the Federal Register.