Providers will have to give patients electronic copies of their health information and use “a more objective standard” to determine whether patients were harmed by breaches under the HIPAA “mega rule” released Jan. 17.
 
The rule consolidates four separate rules that would significantly change how you comply with privacy and security requirements.
 
The rule is effective March 26, but covered entities and business associates won’t have to comply until Sept. 23.
 
The long-awaited HIPAA omnibus rule:
  • Replaces the breach notification rule’s harm threshold with “a more objective standard”;
  • Holds business associates liable for certain HIPAA requirements;
  • Allows patients to receive electronic copies of their health information;
  • Requires changes to the notice of privacy practices;
  • Limits the use and disclosure of protected health information (PHI) for marketing and fundraising;
  • Prohibits most health plans from using or disclosing genetic information for underwriting purposes, as required by the Genetic Information Nondiscrimination Act (GINA); and
  • Adopts increased and tiered civil monetary penalties of up to $1.5 million per violation.