Memories of Health Insurance Portability and Accountability Act (HIPAA) compliance likely have long faded for many HR and benefits professionals. You distributed your Privacy Notices, trained your staff, conducted a “risk assessment” of your information systems under the Security Rule, and formally adopted a thick binder of HIPAA Privacy and Security policies. HIPAA, like Y2K, has come and gone, and health plan compliance has turned to bigger and more pressing issues, right?
Not quite. Recent news stories about the theft of millions of veterans’ personal data from the Veterans Administration is a timely reminder about the importance of protecting the confidential data an organization maintains regarding beneficiaries of its health plans. In addition, the Final Rule on HIPAA Enforcement became effective on March 16, 2006, setting out comprehensive rules for all aspects of the enforcement process. These rules have more “teeth” than was expected, and speculate that this enforcement structure will mean more rigorous enforcement, including imposition of civil penalties, by the HIPAA regulators, the Department of Health and Human Services (HHS). The new rules also make clear that avoiding HIPAA complaints about your health plan is not enough to evade HIPAA enforcement action: HHS now can initiate “compliance reviews” based on any information suggesting noncompliance that comes to its attention, including media reports.
