The law requires organizations to define clear procedures to protect patients' privacy, designate certain individuals to monitor privacy practices, and hear patients' complaints. It also outlines penalties for misuse of patient information. These regulations aren't finalized. Officials are also confident that IT and the rest of their organizations will be ready when next year's deadline arrives for implementing standards and formats for electronic transactions. After health care organizations finish their Phase 1 work, they face an April 2003 deadline for implementing privacy and security provisions, although Health and Human Services Secretary Tommy Thompson says the rules will be modified before the deadline.
Provisions governing security have yet to be finalized.
Matt Duncan, a research director for health care at Gartner Inc. in Stamford, Conn., says organizations that have yet to conduct Phase 1 risk assessments and hold employee education and awareness sessions risk missing next year's deadline. For the most part, he says, the health care industry needs to put more effort into its compliance projects. Yet IT leaders say they're on track for the first phase and they're proceeding cautiously on the privacy and security work until the federal regulations are firm. Calif. As for the data formats, Livsey says that two years is enough time to do the work and that he's comfortable with the progress his department has made. The hospital has been examining the regulations for a year, analyzing what it needs to do.