Source: http://www.annalsofhealthlaw.com/annalsofhealthlaw/vol__26_issue_1?pg=63
Timestamp: 2019-06-18 16:48:38
Document Index: 450785223

Matched Legal Cases: ['§ 164', '§ 164', '§ 164', '§ 164', '§ 164', '§ 164', '§ 164', '§ 13408', '§ 17938', '§ 160', '§ 13401', '§ 17931']

operations,”124 certain public health activities,125 and when the individual health information has been “de-identified.”126 For a covered entity to disclose PHI for other purposes, the covered entity may need to seek the patient’s authorization127 or offer him an opportunity to agree or object.128 Under HIPAA’s Security Rule, covered entities and business associates must follow standards to “ensure the confidentiality, integrity, and availability of all electronic” PHI and “protect against any reasonably anticipated threats or hazards” or unpermitted disclosures.129 Further, covered entities and business associates must “implement policies and procedures to prevent, detect, contain, and correct security violations.”130
Second, HITECH subsequently modified federal privacy rules, while simultaneously encouraging greater data sharing through an investment in EHRs.131 As aforementioned, through meaningful-use requirements, the federal government encourages health providers eligible for incentives to share health data not only among other eligible providers but also public health agencies and other providers that are ineligible for incentives.132 Such data sharing should improve public health, clinical research, and payment and delivery reforms.133
To balance individual privacy with this explicit encouragement to share health data, HITECH includes several new privacy protections. First, HITECH expands the definition of a business associate134 and clarifies that business associates must comply with both HIPAA regulations on data security135 and the new HITECH privacy protections.136 Further, business associates can be held liable for their failure to comply with the Privacy Rule.137 HITECH also required individuals to be notified of breaches, or the
124. 45 C.F.R. § 164.502 (2013).
125. 45 C.F.R. § 164.512(b) (2016).
126. 45 C.F.R. § 164.514 (2013).
127. 45 C.F.R. § 164.508 (2013) (discussing an authorization and the core elements needed for a valid authorization).
128. 45 C.F.R. § 164.510 (2013).
129. 45 C.F.R. § 164.306 (2013).
130. 45 C.F.R. § 164.308 (2013).
131. Kara Johnson, HITECH 101, ABA YOUNG LAWYERS DIV., http://www.american bar.org/groups/young_lawyers/publications/the_101_201_practice_series/hitech_101.html
(last visited Oct. 16, 2016).
132. See STAGE 2 TOOLKIT., supra note 51.
133. See Roski, supra note 70, at 1116.
134. American Recovery and Reinvestment Act of 2009 § 13408, 42 U.S. C. A. § 17938 (West 2009) (including patient safety organizations, state health information organizations, and subcontractors); 45 C.F.R. § 160.103.
135. American Recovery and Reinvestment Act of 2009 § 13401, 42 U.S. C. A. § 17931 (West 2009).