
The American Recovery & Reinvestment Act of 2009 makes significant changes to the privacy and security regulations adopted under the Health Insurance Portability & Accountability Act (“HIPAA”). Some of the most significant changes include:
• making business associates directly subject to HIPAA’s privacy and security requirements and applying criminal and civil monetary penalties to business associates who fail to comply;
• requiring covered entities to report security breaches to both the federal government and the individual whose information was breached; and
• mandating that civil monetary penalties be imposed against covered entities and business associates who violate HIPAA’s privacy and security provisions.
In the associated document is a summary of these and other HIPAA changes included in the American Recovery & Reinvestment Act.
If you have any questions, please contact Susan Freed at 515.288.2500 or e-mail SusanFreed@davisbrownlaw.com; or your Davis Brown attorney.


