Patricia Wagner Quoted in Article, "HIPAA Gets Tougher on Physicians"

Revised privacy notices will need to be displayed in prominent areas of doctors' offices and on practices' websites. Patients will be able to ask for copies of their electronic health records or restrict the information given to health plans if they self-pay for services. And perhaps most important, practices might be subject to serious fines if any of their business associates cause security breaches.

On Jan. 17, the Dept. of Health and Human Services issued a final omnibus rule to strengthen the patient privacy protections established by the Health Insurance Portability and Accountability Act of 1996. The rules not only expand the individual rights of patients but also tighten federal breach notification requirements under the Health Information Technology for Economic and Clinical Health Act of 2009. ...

There may be some relationships with business associates where the increased risk for liability won't apply, said Patricia Wagner, who specializes in privacy issues. An example of this is an accreditation agency, which "can't be an agent of the entity they're surveying because they're supposed to be independent." Still, doctors will need to spend a lot of time examining all of the contracts they have with various business associates to see if any need restructuring to reduce their own liability risk, she said.

Practices with limited time to tackle this could prioritize the relationships they're most worried about, Wagner said. These may be the ones that handle the most patient health information or the firms the practice isn't as familiar with.