In light of the increased HIPAA enforcement activity, covered entities and business associates should review their existing HIPAA Privacy and Security safeguards to determine if you sufficiently protect Protected Health Information (PHI). If applicable, the safeguards should address how to protect PHI taken off your premises either on paper or electronically (for example, on a laptop computer). Also, covered entities and business associates should confirm that any employees with access to PHI have received the necessary HIPAA training. In addition, to avoid HIPAA’s breach notification requirements, PHI should be secured (that is, encrypted or destroyed), to the extent possible.
The Department of Health and Human Services (HHS), through its Office for Civil Rights (OCR), is responsible for enforcing the HIPAA Privacy and Security Rules. Although OCR has been enforcing HIPAA’s rules since 2003, the Health Information Technology for Economic and Clinical Health (HITECH) Act, which was enacted as part of the American Recovery and Reinvestment Act of 2009, significantly enhanced OCR’s enforcement authority.
