April 26, 2003
How Will HIPAA Be Enforced?
The Department of Health and Human Services has issued an interim final rule establishing rules of procedure for the imposition of money penalties on entities that violate standards adopted by HIPAA. This rule is the first installment of a rule that is termed the “Enforcement Rule.'' The Enforcement Rule, when issued in complete form, will set forth procedural and substantive requirements for imposition of civil money penalties.
The duty to comply with certain of the HIPAA rules is now a reality for many, if not most, covered entities. The immediacy of the compliance obligation brings with it the issue of how these rules will be enforced. Accordingly, HHS has begun to inform providers its general approach to enforcement.
HHS's General Approach to Enforcement
The Department intends to seek and promote voluntary compliance with the rules promulgated to carry out the HIPAA provisions. With respect to the Privacy Rule, Office of Civil Rights has developed and is continuing to produce guidance and a wide array of other technical assistance materials to help covered entities effectively implement the Privacy Rule. These materials are available on the OCR Privacy web site at http://www.hhs.gov/ocr/hipaa. These efforts will continue after the April 14, 2003 compliance date, as OCR learns from its compliance activities and from those who are implementing the Privacy Rule where additional guidance and assistance are needed. To the extent practicable, OCR will seek the cooperation of covered entities in obtaining compliance with the Privacy Rule, and may provide technical assistance to help covered entities voluntarily comply with the Rule.
OCR will seek to resolve matters by informal means before issuing findings of non-compliance, under its authority to investigate and resolve complaints, and to engage in compliance reviews. With respect to enforcement of the remainder of the HIPAA rules, the enforcement approach of CMS is similar. Enforcement activities will focus on obtaining voluntary compliance through technical assistance. The process will be primarily complaint driven and will consist of progressive steps that will provide opportunities to demonstrate compliance or submit a corrective action plan.
|