The new federal protected health information privacy and security final regulations will tighten the rules governing how health insurance agents and brokers share "protected health information" (PHI).
Mark Holloway, a lawyer in the health reform advisory practice at Lockton Benefit Group, talks about the changes in a commentary on the regulations.
In the past, Holloway said, federal Health Insurance Portability and Accountability Act (HIPAA) privacy and data security rules applied directly only to health insurers, hospitals, medical offices and other "covered entities."
A health insurer had to negotiate health information confidentiality agreements with health insurance agents, health insurance brokers and other "business associates," but the business associates simply had to abide by the confidentiality agreements, Holloway said.
"Business associates were contractually liable to the plan if there was a breach but were not subject to direct oversight" by the regulatory agency that enforces the HIPAA rules," the U.S. Department of Health and Human Services (HHS), Holloway said.
Under the laws now in effect, "the HIPAA privacy and security rules directly apply to business associates, as do HIPAA's civil and criminal penalties," Holloway said. "Thus, business associates must develop formal policies and procedures to demonstrate compliance with the HIPAA rules, as well as designate their own privacy and security officials."
In the final regulations, HHS has now decided to include a business associate's subcontractors in the definition of "business associate," Holloway said.
"This means that the HIPAA confidentiality obligations and enforcement regime would extend to these subcontractors (even though they do not have a direct relationship to the health plan) to the extent that the subcontractors create, maintain or transmit [protected health information (PHI)] on behalf of the business associate," Holloway said.
HHS developed the new final health information privacy and security regulations to implement parts of the Health Information Technology for Economic and Clinical Health (HITECH) Act of 2009 and the Patient Protection and Affordable Care Act of 2010 (PPACA).
The final regulations are set to take effect March 26. Health insurers and health producers, and other covered entities and business associates, are supposed to start complying with the regulations by Sept. 23. Business associates will then have a year to shift to using contracts that reflect the new security and privacy regulations.
