Company: EHC
Filing Date: 2025-02-28
Form Type: 10-K
Source: 0000785161-25-000009
Chunk: 119

Company: Encompass Health Corp
Filing Date: 2025-02-28
Form: 10-K
Item: Item 1
Chunk 119
---
 information on Medicare fraud and abuse that leads to the recovery of Medicare funds. Penalties for violations of HIPAA include civil and criminal monetary penalties. The United States Department of Health and Human Services Office of Civil Rights (“HHS-OCR”) implemented a permanent HIPAA audit program for healthcare providers nationwide in 2016. As of December 31, 2024, we have not been selected for audit.

HIPAA and related regulations contain certain administrative simplification provisions that require the use of uniform electronic data transmission standards for certain healthcare claims and payment transactions submitted or received electronically. HIPAA regulations also regulate the use and disclosure of individually identifiable health-related information, whether communicated electronically, on paper, or orally. The regulations provide patients with significant rights related to understanding and controlling how their health information is used or disclosed and require healthcare providers to implement administrative, physical, and technical practices to protect the security of individually identifiable health information.

The Health Information Technology for Economic and Clinical Health (“HITECH”) Act modifies and expands the privacy and security requirements of HIPAA. The HITECH Act applies certain of the HIPAA privacy and security requirements directly to business associates of covered entities. The modifications to existing HIPAA requirements include: expanded accounting requirements for electronic health records, tighter restrictions on marketing and fundraising, and heightened penalties and enforcement associated with noncompliance. Significantly, the HITECH Act also establishes new mandatory federal requirements for notification of breaches of security involving protected health information. HHS-OCR rules implementing the HITECH Act expand the potential liability for a breach involving protected health information to cover some instances where a subcontractor is responsible for the breaches and that individual or entity was acting within the scope of delegated authority under the related contract or engagement. These rules generally define “breach” to mean the acquisition, access, use or disclosure of protected health information in a manner not permitted by the HIPAA privacy standards, which 

16

compromises the security or privacy of protected health information. Under these rules, improper acquisition, access, use, or disclosure is presumed to be a reportable breach, unless the potentially breaching party can demonstrate a low probability that protected health information has been compromised.

HHS-OCR is responsible for enforcing the requirement that covered entities notify the United States Department of Health and Human Services (“HHS”) and any individual whose protected health information has been improperly acquired, accessed, used, or disclosed. In certain cases, notice of a breach is required to be made to media outlets. The penalties for noncompliance may be up to