Breach and notification regulations issued; Expected compliance date: September 23, 2009

21 August 2009
HDJN Client Advisory

The Department of Health and Human Services has issued draft regulations mandating that providers notify patients in the event that a patient’s information is compromised. These regulations were issued based upon the standards under the HITECH Act passed in February of this year. The exact compliance date for the regulations will depend on the date of publication in the Federal Register (expected soon), but we estimate that the compliance date will be on or about September 23, 2009.

Under these new standards, if a patient’s information is disclosed inappropriately, subject to certain limitations, the provider will be required to follow specific procedures to notify the patient, the Department of Health and Human Services, and in some cases, the media, of the breach. In comments, the Department indicates that it plans to exercise enforcement discretion to not impose penalties for failure to provide notifications for breaches discovered within 180 days after the publication of the rule, but HDJN recommends that providers proceed as soon as possible in preparing to adopt policies and procedures to comply with these regulations.

For more information on regulations, or for assistance in preparing policies to address these new standards, please contact Bill Hall by telephone at 804 | 967-9604 or by e-mail at bhall@hdjn.com. Additional information about Hancock, Daniel, Johnson & Nagle, P.C. is available on the firm’s website at www.hdjn.com.

The information contained in this advisory is for general educational purposes only. It is presented with the understanding that neither the author nor Hancock, Daniel, Johnson & Nagle, PC, is offering any legal or other professional services. Since the law in many areas is complex and can change rapidly, this information may not apply to a given factual situation and can become outdated. Individuals desiring legal advice should consult legal counsel for up-to-date and fact-specific advice. Under no circumstances will the author or Hancock, Daniel, Johnson & Nagle, PC be liable for any direct, indirect, or consequential damages resulting from the use of this material.