» News & Information

CCH® Medicare — 07/27/10

New health information privacy and security rules proposed

New rules and resources designed to strengthen the privacy of health information and to help Americans understand their rights and the resources available to safeguard their personal health data have been proposed by HHS.

The Health Information Technology for Economic and Clinical Health (HITECH) Act, enacted as part of the American Recovery and Reinvestment Act of 2009 (ARRA) (P.L. 111-5), provides that current health information privacy and security rules must include broader individual rights and stronger protections when third parties handle individually identifiable health information.

The proposed rule would strengthen and expand enforcement of the Health Insurance Portability and Accountability Act of 1996 (HIPAA) privacy, security, and enforcement rules by:

  • expanding individuals’ rights to access their information and to restrict certain types of disclosures of protected health information (PHI) to health plans;
  • requiring business associates of HIPAA-covered entities to be under most of the same rules as the covered entities;
  • setting new limitations on the use and disclosure of PHI for marketing and fundraising;
  • prohibiting the sale of PHI without patient authorization.

HHS is also looking more closely at entities that are not covered by HIPAA rules to understand better how they handle personal health information and to determine whether additional privacy and security protections are needed for these entities.

HHS has also launched a privacy website at http://www.hhs.gov/healthprivacy/index.html to help visitors access information about existing HHS privacy efforts and the policies supporting them. Full text of the proposed rule will be available as a Part 2 in Report No. 1620.

HHS Proposed Rule, 75 FR 40868, July 14, 2010.

For more information on this and related topics, consult the CCH® Medicare and Medicaid Guide.

Visit our News Library to read more news stories.