DHHS lays out plan for HIPAA enforcement. (NH News Notes).

With the HIPAA Privacy Rule deadline come and gone in April, and the transactions and security regulations coming up, the Department of Health and Human Services (DHHS) is now focusing on how to penalize providers for HIPAA privacy and security violations. DHHS has issued an interim final rule, effective until September 16, 2003, that lays out its thoughts on the matter so far; revisions and the complete final Enforcement Rule will be issued later.

According to Jennifer L. Hilliard, Esq., AAHSA's corporate compliance officer and public policy attorney, the enforcement procedure that DHHS is explaining in the rule is based on the Office of Inspector General's (OIG) imposition of civil money penalties (CMPs)--a process familiar to some long-term care providers. Hilliard explains that the enforcement process is complaint-driven, and progressive steps will be taken to penalizeviolators (e.g., the first-violation might yield a warning, and subsequent violations might bring increasing fines). The DHHS Office of Civil Rights will enforce civil violations of the Privacy Rule, and the Department of Justice will enforce criminal violations; the Centers for Medicare and Medicaid Services (CMS) is responsible only for enforcing the transactions and code set standards, with compliance due October 16, 2003.

In terms of how willing government agencies will be to work with providers instead of imposing penalties, Hilliard says, "I think that cooperation will depend, in large part, on good-faith efforts by providers to comply with HIPAA, as well as time--i.e., as time goes by, I think DHHS will not be so tolerant of violations, particularly where it suspects that a provider is not trying very hard to comply."

The interim rule, which is open to public comment, can be found at www.access.gpo.gov/su_docs/fedreg/a030417c.html under "Health and Human Services Department."