6. BAs must now comply with HIPAA’s Security Rule
7. BAs are now subject to HIPAA’s (increased) civil and criminal penalties
8. State AGs can bring HIPAA enforcement action against BAs (in addition to CEs)
9. Employees and other individuals are subject to HIPAA’s criminal fines and penalties
10. HHS now required to conduct audits of CEs and BAs
11. New type of BA – data transmission entities (health information exchange organizations, regional health information organizations, e-prescribing gateways, vendors of personal health records); CEs need BAAs from these new BAs
12. Restriction on disclosure requests: CEs have to comply with certain restriction requests from patients – must agree to patient’s restriction on disclosure request if disclosure is to a health plan for payment or health care operations (not treatment) AND the patient information pertains solely to health care items / services for which patient has paid provider in full
13. Patient access to CE’s electronic health record: patients have the right to obtain copies of a CE’s electronic health record in electronic form
14. Minimum necessary is basically the limited data set (as defined by Privacy Rule), unless more is required; guidance to be issued prior to deadline
15. Further restrictions on using patient information for marketing purposes |
