Important new rule changes to the Health Insurance Portability and Accountability Act of 1996 now force law firms that come into contact with protected health information to revisit internal policies and practices, and enforce information security controls, protect confidential information, monitor workforce information access and track compliance.
Until now, the U.S. Department of Health and Human Services never made the move to audit or penalize law firms for lack of compliance with HIPAA data privacy and security rules, choosing instead to focus regulatory efforts on health care providers and related health care organizations. But the game is about to change. The HIPAA Omnibus Rule, which took effect on March 26, finalizes multiple revisions to previous HIPAA regulations. For the first time, business associates, such as law firms, are directly liable for multiple provisions of HIPAA rules.
