Beginning Next Week: InsideCounsel will become part of Corporate Counsel. Bringing these two industry-leading websites together will now give you comprehensive coverage of the full spectrum of issues affecting today's General Counsel at companies of all sizes. You will continue to receive expert analysis on key issues including corporate litigation, labor developments, tech initiatives and intellectual property, as well as Women, Influence & Power in Law (WIPL) professional development content. Plus we'll be serving all ALM legal publications from one interconnected platform, powered by, giving you easy access to additional relevant content from other InsideCounsel sister publications.

To prevent a disruption in service, you will be automatically redirected to the new site next week. Thank you for being a valued InsideCounsel reader!


New HIPAA privacy laws take effect after grace period for the newly regulated

Businesses not in compliance could face considerable penalties

New Health Insurance Portability and Accountability Act (HIPAA) regulations went into effect Sept. 23, following a grace period intended to give previously unaffected entities time to become compliant. The new rules attempt to improve privacy for personal medical records, tighten the definition of who can access private information and set new standards for what must be done in the event of a security breach.

While HIPAA has been around since 1996, it was reevaluated as part of the Genetic Information Nondiscrimination Act of 2008 and was overhauled during the Recovery and Reinvestment Act of 2009. The former sought to prevent the use of genetic information found in personal health documents from being used as means for denial of service or employment from healthcare providers and employers.

As of January 2013, so-called “covered entities” are responsible for protecting the privacy of patients and customers under HIPAA. Now that the grace period has elapsed, rules expand that same responsibility to “business associates.” “Covered entities” are defined as healthcare providers and insurers whereas “business associates” are defined as any additional personnel who may handle health records.

Regulations impose considerable fines for those that fail to comply, and can also result in criminal charges in the event of extreme negligence. Fines of up to $1 million are now possible within a single calendar year for repeat offenders.

According to The Wall Street Journal, in addition to more detailed definitions of who is responsible for what, the new regulations stipulate that those falling into the “business associates” category will be responsible for conducting risk analysis to discover any potential issues with the way they store sensitive information. They must also get out in front of any risks that may be coming down the pike. The rules will also apply to consultants and other third parties now considered part of the business associate category.

While fines won’t start immediately, the Department of Health and Human Services is expected to start auditing companies shortly. Those who are found to be out of compliance will be required to provide a tactical plan on how they expect to achieve compliance, or they will face the fines laid forth by HIPAA.

Executive Editor

author image

Chris DiMarco

Chris DiMarco, Executive Editor of InsideCounsel magazine, has a background in multimedia production with previous involvement in projects in which he developed and created content...

Bio and more articles

Join the Conversation

Advertisement. Closing in 15 seconds.