Health Law Monitor

HHS and FTC Issue Final Breach Notification Rules

To better protect the privacy of personal health information, the Department of Health and Human Services (HHS) and the Federal Trade Commission (FTC) have published new rules implementing the HITECH breach notification requirements.  Healthcare providers and other covered entities regulated under HIPAA will be required to provide notice to individuals, HHS, and, potentially, the media when unsecured protected health information is breached.  These new rules extend the notification requirements to business associates and vendors of electronic health records, while strengthening the requirements for covered entities.  The notification requirements apply to any breach on or after September 23, 2009.  For more information about these requirements, click here.

FTC “Red Flags Rule” – Enforcement Delayed Until August 1, 2009

The Federal Trade Commission (“FTC”) has delayed enforcement of the new “Red Flags Rule” until August 1, 2009, to give creditors and financial institutions more time to develop and implement written identity theft prevention programs.  The Red Flags Rule applies to any business that provides goods or services to consumers on credit.  During this delay, the FTC will release a template that will be designed to help low risk entities comply with the law.  This template will be posted on the FTC’s website, www.ftc.gov.  For more information about how the Red Flags Rule will affect health care providers, follow the link.

If you have any questions or need further assistance, please feel free to contact either James W. Thomas or Lindsay R. Darling with the Jackson Kelly Health Law Group.