The Centers for Medicare and Medicaid Services (CMS) recently changed the responsibility and enforcement of the Health Insurance Portability and Accountability Act (HIPAA) security rule to the Office of Civil Rights (OCR). The OCR now administers and makes decisions regarding the interpretation, implementation and enforcement of the HIPAA regulations security rule.

A representative of Healthcare Information and Management Systems Society (HIMSS), Lisa Gallagher, recently explained in an interview that until this point, the two departments had been sharing responsibilities. As a result, every complaint required the Department of Health and Human Services (HHS) and OCR to collaborate, which slowed the process down considerably.

”Now,” Ms. Gallagher explained in a recent interview, “all complaints will be handled within one organization, which should increase efficiency." 

By way of example, through the end of last year, December 2008, the OCR received 41,807 HIPAA complaints, with 6,019 (14%) cases still open. By way of comparison, as of June 30, 2009, CMS had received 1,472 complaints and still had 71 (5%) cases still open. Clearly then, CMS was doing a better job of keeping enforcement statistics up to date, even if on a smaller scale, so perhaps this is a good reassignment decision once economies of scale are determined.

Consistent with this observation, HHS Secretary Kathleen Sebelius said in a statement that the change "will eliminate duplication and increase efficiencies in how the department ensures that Americans' health information privacy is protected."

Certainly true, as there are observant inefficiencies in both organizations not only because of having a Privacy Rule and a separate Security Rule that needed to become combined regulation, but also by having two separate oversight agencies, many thought  they needed separate internal departments responsible for compliance; with the Privacy Rule largely the responsibility of privacy office and the legal counsel, and the Security Rule the responsibility of the information security office and information technology. The result was duplicative efforts and tremendous waste.

In summary, the reassignment should be more straightforward, not only for organizations, but also for the oversight agencies, and perhaps more effective for active enforcement actions. Only time will tell how audits, fines and penalties will change as both rules are now under the governance of just the OCR.

At the least, consider this a heads-up, one such reassignment may be indicative of more enforcement changes to come.

Read more...