The Health Insurance Portability and Accountability Act of 1996 (HIPAA) will see significant changes this year as the U.S. Department of Health and Human Services (HHS) continues its “Regulatory Sprint to Coordinated Care” initiative which aims to remove obstacles to coordinated patient care that may exist due to federal regulations like HIPAA. On December 10th, the HHS’ Office for Civil Rights (OCR) issued a Notice of Proposed Rulemaking, indicating its intention to revise the HIPAA Privacy Rule, among other priorities.

Last year, the Office of Civil Rights (“OCR”) announced a new initiative – the HIPAA Right of Access Initiative – as an enforcement priority in support of the right of individuals to timely access of their health records under the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) Privacy Rule. As of this October, OCR has settled 9 enforcement actions against healthcare organizations for failure to comply.

Over the past few weeks, as the crisis around COVID-19 has escalated, the federal government has taken steps to empower medical providers to continue caring for patients, wherever they might be, in response to social distancing and self-quarantine directives. Specifically, the U.S. Department of Health and Human Services (HHS) and the Office for Civil Rights (OCR), the agencies tasked with administration and enforcement of HIPAA regulations, have issued several bulletins which provide guidance to Covered Entities and Business Associates around maintaining patient privacy when using telemedicine practices to treat patients during the COVID-19 public health crisis.

On May 24, 2019, the Office of Civil Rights (OCR) – the arm of the Department of Health and Human Services that enforces the Health Insurance Portability and Accountability Act (HIPAA) – issued a new fact sheet clarifying the specific instances in which a business associate can be found directly liable for violations of the HIPAA Privacy, Security, Breach Notification and Enforcement Rules (“HIPAA Rules”). As you may know, prior to the promulgation of the 2013 HIPAA Final Rule, liability of business associates could arise only under the terms of a business associate agreement.