Category Archives: Healthcare Regulatory Matters

COVERED CALIFORNIA: WHAT’S A PROVIDER TO DO?

Several issues arise from the proposed agreements for providers from Qualified Health Plans (“QHP”) under Covered California. Some issues that physicians and other providers should be watching out for:

1. Payment Schemes. Initial contracts from the various QHP’s are offering low payment options, particularly the “80% of Medicare” option. Physicians should be wary of such agreements. Under QHP contacts with Covered California, the plans have agreed to work on value-based payments in the future, making future contracts even less attractive for providers.

2. Hospital Contracts. There still is no clarity on which hospitals will take part in Covered California and under what plans. Covered California has no listing of participating hospitals at this time. The prospect of narrow networks (fewer providers offered to consumers) makes it troublesome to predict the future on hospital participation.

3. Administrative Burdens. QHPs are imposing difficult and legally thorny administrative tasks on providers, particularly providing information about patients and payments.

4. Populations. Get information on the types of patients expected under contracts. The initial rounds of patients are predicted to be populations that are in fair to poor health. Since they are not used to traditional medical care, they are expected to have a large percentage of missed appointments and compliance issues.

5. Collections. What is the providers obligations to collect? Some Covered California plans leave high deductibles and copays for enrollees. Yet, the newest enrollees are not used to paying such amounts. Also, determine risk for patients who fail to pay premiums to Covered California QHPs. Providers may be on the hook.

With all the problems with exchange products, providers may want to sit out this first round

Several issues arise from the proposed agreements for providers from Qualified Health Plans (“QHP”) under Covered California. Some issues that physicians and other providers should be watching out for:

1. Payment Schemes. Initial contracts from the various QHP’s are offering low payment options, particularly the “80% of Medicare” option. Physicians should be wary of such agreements. Under QHP contacts with Covered California, the plans have agreed to work on value-based payments in the future, making future contracts even less attractive for providers.

2. Hospital Contracts. There still is no clarity on what hospitals will take part in Covered California and under what plans. Covered California has no listing of participating hospitals at this time. The prospect of narrow networks (fewer providers offered to consumers) makes it troublesome to predict the future on hospital participation.

3. Administrative Burdens. QHPs are imposing difficult and legally thorny administrative tasks on providers, particularly providing information about patients and payments.

4. Populations. Get information on the types of patients expected under contracts. The initial rounds of patients are predicted to be populations that are in fair to poor health. Since they are not used to traditional medical care, they are expected to have a large percentage of missed appointments and compliance issues.

5. Collections. What is the providers obligations to collect? Some Covered California plans leave high deductibles and copays for enrollees. Yet, the newest enrollees are not used to paying such amounts. Also, determine risk for patients who fail to pay premiums to Covered California QHPs. Providers may be on the hook.

With all the problems with exchange products, providers may want to sit out this first round of patients.

FORNIA: WHAT’S A PROVIDER TO DO?

Several issues arise from the proposed agreements for providers from Qualified Health Plans (“QHP”) under Covered California. Some issues that physicians and other providers should be watching out for:

1. Payment Schemes. Initial contracts from the various QHP’s are offering low payment options, particularly the “80% of Medicare” option. Physicians should be wary of such agreements. Under QHP contacts with Covered California, the plans have agreed to work on value-based payments in the future, making future contracts even less attractive for providers.

2. Hospital Contracts. There still is no clarity on what hospitals will take part in Covered California and under what plans. Covered California has no listing of participating hospitals at this time. The prospect of narrow networks (fewer providers offered to consumers) makes it troublesome to predict the future on hospital participation.

3. Administrative Burdens. QHPs are imposing difficult and legally thorny administrative tasks on providers, particularly providing information about patients and payments.

4. Populations. Get information on the types of patients expected under contracts. The initial rounds of patients are predicted to be populations that are in fair to poor health. Since they are not used to traditional medical care, they are expected to have a large percentage of missed appointments and compliance issues.

5. Collections. What is the providers obligations to collect? Some Covered California plans leave high deductibles and copays for enrollees. Yet, the newest enrollees are not used to paying such amounts. Also, determine risk for patients who fail to pay premiums to Covered California QHPs. Providers may be on the hook.

With all the problems with exchange products, providers may want to sit out this first round of patients.

HEALTHCARE LAW UPDATE, 2014: PHARMACISTS SEE MORE CLOUT

This is second in a series of new 2024 laws affecting healthcare in California. 

SB 493: New Authority to Pharmacists

One of the key goals of the Accountable Care Act was to to increase utilization of professionals other than doctors.  One way to do that is to expand the authority of pharmacists to perform certain tests and to administer drugs.

This new law gives pharmacists new clout as “health care providers” who can now administer drugs by injection, provide training on drug therapy and disease management and prevention, furnish contraceptives, nicotine replacement products, medications recommended for travel outside the US, order certain tests, and initiate, adjust or discontinue drug therapy (but may not interfere with “as written”).

Devolving  physician authority to other professionals, including nurse practitioners, physician assistants and pharmacists, is an experiment with some risk.  It is clear that these professionals will be able to fill some gaps left by overly busy physicians.  However, there is likely to be less quality and the overall effectiveness of healthcare may follow.  The provision regarding the administration of international travel drugs will likely the pocket books of those physicians who derive economic benefit from this part of their practice.

 

NEW CALIFORNIA HEALTHCARE LAWS: GAY AND LESBIAN DISCRIMINATION FOR FERTILITY TREATMENT

This is the first in a series of posts about new laws for 2014 affecting healthcare.

AB 460: Non-Discrimination for Homosexuals and Lesbians

Summary

This law requires coverage under the Knox-Keene Health Care Service Plan Act and a under a policy of health insurance that provides for coverage for the treatment of infertility.   If such coverage is offered and purchased, it must be provided without discrimination on the basis of age, ancestry, color, disability, domestic partner status, gender, gender expression, gender identity, genetic information, marital status, national origin, race, religion, sex or sexual orientation.

AB 460 extended the idea of “non-discrimination” in this context to homosexuals and lesbians regarding fertility. If a health insurance plan is purchased that contains coverage for infertility, then the plan must not discriminate.  This statute is meant to help all people access to treatment of infertility.

Insurance plans are not required to carry such coverage.  There will be a violation of the statute only if the plan does offer such coverage and they attempt discrimination in the utilization of the coverage.

The law makes homosexuals and lesbians eligible for insurance coverage for “treatment of infertility, except in vitro fertilization, under those terms and conditions as may be agreed upon between the group subscriber or the group policyholder and the plan or the insurer.”

An interesting issue arises when the definition of infertility is considered. Under the new law, homosexuals and lesbians will be classified as “infertile” if they are unable “to conceive a pregnancy or to carry a pregnancy to a live birth after a year or more of regular sexual relations without contraception.” Since most sexual relations in a homosexual and lesbian relationship do not result in pregnancy, the law effectively defines all homosexuals and lesbians as “infertile.” Surely this is an unintended result and new legislation will need to be considered in the near future.

HIPAA Settlement Shows How To Comply

HHS’s Office of Civil Rights
recently completed an enforcement action against Wellpoint.  Wellpoint
suffered security breaches and settled with the Office of Civil Rights for $1.7
million.  Wellpoint self-reported the breach to HHS’s, which mitigates the
penalties that it agreed to pay.  The breach was leaving their database
open to unauthorized users over the Internet.  There is no evidence that
the database was accessed or information utilized.

What is
unique is that the OCR has published the actual settlement agreement with
Wellpoint.  From a providers point of view, the settlement shows what to avoid to be HIPAA compliant.  OCR
lists the violations of HIPAA law that caused the fine.  

What
this demonstrates is that it’s the “technical violation” that will get entities
into trouble. In this case, not having all the safeguards in place to safeguard
protected healthcare information (“PHI” or electronic protected healthcare
information, “ePHI”).

Quoting
from the agreement:

“2.
Factual Background and Covered Conduct

On
June 18, 2010, HHS received notification from WellPoint regarding abreach
of certain of its unsecured electronic protected health information (ePHI). OnSeptember
9, 2010, HHS notified WellPoint of HHS’s investigation regardingWellPoint’s
compliance with the Privacy, Security, and Breach Notification Rules.

HHS’s
investigation indicated that the following conduct occurred (“CoveredConduct”):

 (1) Beginning on
October 23, 2009, until March 7, 2010, WellPoint did not adequately
implement policies and procedures for authorizing access to ePHI
maintained in its web-based application database consistent with theapplicable
requirements of the Security Rule.

 (2) WellPoint did
not perform an adequate technical evaluation in responseto
a software upgrade, an operational change affecting the security of ePHI maintained
in its web-based application database that would establish the extent
to which the configuration of the software providing authentication safeguards
for its web-based application met the requirements of the Security
Rule.

 (3) Beginning on
October 23, 2009, until March 7, 2010, WellPoint did not adequately
implement technology to verify that a person or entity seekingaccess
to ePHI maintained in its web-based application database is the one claimed.

(4) Beginning on
October 23, 2009, until March 7, 2010, WellPointimpermissibly
disclosed the ePHI, including the names, dates of birth,addresses,
Social Security Numbers, telephone numbers and healthinformation,
of approximately 612,000 individuals whose ePHI was maintained
in the web-based application database."

 

 ACTION ITEMS

Steps That
Covered Entities Can Take to Protect Against HIPAA Enforcement

  • Review
    relationships and the documentation of such relationships among and
    between Affiliated Covered Entities and other related entities with which
    they share PHI
  • Revisit
    risk analyses, especially following any changes to the underlying
    technology
  • Update
    policies and procedures as necessary to account for changes in technology
    or practices
  • Continue
    workforce training
  • Audit
    ongoing programs
  • Monitor
    security intrusions
  • Implement
    a breach response plan

BEST PRACTICES TO AVOID PAIN KILLER ABUSE BY PATIENTS IN THE MEDICAL OFFICE

This is the third in a series of articles on
avoiding fraud and theft in healthcare professionals
offices.
The article is meant for medical professionals including physicians,
dentists, home nursing and mental health professionals. If you have any
questions about this series, feel free to contact attorney Matthew L. Kinley, a
healthcare lawyer in Long Beach, California at 562.901-3050

           Practices in California should be wary
of prescribing pain killers for their patients.
The Medical Board has told various audiences that they are reviewing
physicians who prescribe such medications, and will review patient files for
abuse.

           There is good reason for the Medical
Board to be concerned: There has been great abuse by patients who utilize pain
killers.  There has also been an epidemic
of deaths caused by such abuse.  One
estimate has it that American physicians prescribe enough pain killers to
medicate every American around the clock for a month.

           In order to avoid a visit by the
Medical Board, or to be prepared if they do visit,  and to make sure that your painkiller practice
is beneficial for patients, physician offices should adopt protocols to make
sure that patients actually need the painkillers you prescribe.  Such protocol will help keep prescribed drugs
making it on the black market.

 Action Items to Protect Your Practice:

 1. Carefully
document the patient chart.  Carefully
explain the side effects of the prescription, and for long term use, the
potential detrimental effects of potential addiction.

 2. Screen
and monitor for substance abuse and mental health problems.

 3. Be
vigilant for scams and identity theft.

 4. Prescribe
pain killers only after examining the patient.

           California Business and Professions
Code provides some guidance.  Section
2242 provides  that it is
“unprofessional conduct” to prescribe or furnishing dangerous drugs without
an appropriate prior examination and a medical indication.

 5.  Only prescribe painkillers after other treatments
have not been effective for pain.

 6.  Use legally required form. California Healt  & Safety Code section 11162.1 provides standards
for prescription forms for controlled substances. 

Limit the
number of pills prescribed. 

 7. The
quantity prescribed should be based on the expected length of pain.California
Health Safety Code section 11158 provides for limits on number of pills
(“may dispense directly to an ultimate user a controlled substance
classified in Schedule II in an amount not to exceed a 72-hour supply for the
patient in accordance with directions for use given by the dispensing
practitioner only where the patient is not expected to require any additional
amount of the controlled substance beyond the 72 hours. )

 8. Using
patient-provider agreements combined with urine drug tests for people using
painkillers long term.

 9.  Talking with patients about safely using,
storing and disposing of prescription of painkillers.  (www.cdc.gov/homeandrecrationalsafety/poisoning/preventiontips.htm)

 10.  Check the prescription monitoring programs with the California Attorney
General.

 

By Matthew L. Kinley, Esq.

 

BEST PRACTICES TO AVOID FRAUD AND THEFT IN THE MEDICAL OFFICE: PROTECTED HEALTH INFORMATION, IDENTITY THEFT AND THE LAW PRACTICE

IDENTITY THEFT, PROTECTED HEALTH INFORMATION EMRs and OTHER FEDERAL REGULATORY ISSUES

This is the second in a series of articles on
avoiding fraud and theft in healthcare professionals
offices.
The article is meant for medical professionals including physicians,
dentists, home nursing and mental health professionals. If you have any
questions about this series, feel free to contact attorney Matthew L. Kinley, a
healthcare lawyer in Long Beach, California at 562.901-3050.
 

Medical providers store all sorts of private information.  Patients give medical providers virtually every identifying fact about themselves possible.  Records kept in the office include information about the health of the patient.  Billing records have banking and other important financial contacts.

Medical providers have an obligation to protect private health infomration.  Federal and state laws impose specific obligations to protect information provided to medical providers. The Health Insurance Portability and Accountability Act of 1996 (HIPAA) and related regulations, the Health Inforamtion TEchnology for Economic and Clinical Health  (HITECH) and realated regulations, and the California Business and Professions Codes and related regulations are all laws designed to protect patient’s privacy and to require providers to keep information private.

Medical providers, if they expect payment from Medicare, Medicaid (Medi-Cal in California) or from private payors, will have Electronic Medical Rerords systems in place.  This expansion of electronic records require medical providers to institute plans to follow complicated regulations to make sure they are able to survive government audits and in order to make sure that medical records are safe.  Failure to do so may result in penalties and fines.

ACTION ITEMS:

What to do to protect electronic information?

1.  Hire competent people. 

Take the time to carefully research people you hire.  Check their references.  Make sure they are not on the Office of Inspector Generals Excluded Persons list. (Persons on this list have been found by the OIG to be involved in some sort of fraudulent scheme.)

2.  Prepare a HIPAA Compliance Plan.  Every medical provider, no matter how small, should prepare such a plan.  Failure to do so can result in serious fines and penalties, even if no information is leaked.  The basics of such a plan include:

a.  Appointment of a privacy officer.  Takes charge of the office’s privacy efforts.

b. Security Rule Analysis.  This is the first part of preparing a HIPAA plan.

c.  Prepare a Breach Policy.  This is what to do if there’s a breach and confidential helath information is made public.

d.  Training of your employees.  All employees need to be trained in basic patient privacy.

e.  Privacy Notice.  The law requires every health provider to have and have published a Privacy Notice.

f.  Business Associate Agreements.  The provider is required to protect all information if using other entities to help with collections or other information gathering.

g.  Policies relating to release of information.   When can a patient’s information be released?  To whom can the information be released?  How is such information sent (internet? e-mail?).

Some of the nuts and bolts of your plan will include:

a. Negotiating Leases.  Make sure your landlord does not have access to protected health information.  Most leases allow the landlord to enter the premises, either upon notice or during emergencies.  These entrances into the medical space should be limited.

b. Patient sign-in sheets don’t disclose protected medical information.

c. Patient schedules can’t be seen.

d. Confidential discussions can’t be overheard.

e. Computers have proper encryption and passwords.

f.  Computer monitors can’t be seen by passersby

g. Internet use is secure.

h. Filing cabinets are locked.

i.  Use encryption.  Monitor lap tops and portable storage devices to make sure they are not lost.

e. Keys and access items are retireved from former employees.

Modern electronic information requires that all medical providers comply with the law and institute privacy procedures.  Our office provides guidance on such matters for a flat fee.  You can call for a no cost consultation at any time.

By: Matthew L. Kinley, Esq.

 

 

 

 

 

 

 

 

DOMA: HOW IT CHANGES BENEFITS FOR SAME SEX COUPLES

THE SUPREME COURT STRIKES DOWN DEFENSE OF MARRIAGE ACT

The decision of the United States Supreme Court in U.S. v.
Windsor, where the court struck Section 3 of the Defense of Marriage Act
(DOMA), will change many aspects of healthcare as it relates to same-sex
marriage.  The decision requires that the
federal government recognize same-sex marriages that are recognized under state
law.

SOME OF THE THINGS THE
COURT DID NOT RULE

The Feds Follow the
State
.
The Court didn’t rule that the federal government must recognize all
same-sex marriage.  Instead they
determined that marriage is traditionally an issue for the states to
decide. 

 States Follow Their Own
Path
.  The Court did not
strike down Section 2 of DOMA, which provides that no state shall be required
to recognize a same-sex marriage that is recognized by another state. This
raises a number of issues for couples who move from state to state or who live
in a state that does not recognize same-sex marriage but travel to a state that
does and marry there.

 Retroactive?.  Another open issue is retroactivity. Windsor
did not specifically address whether same-sex couples have any retroactive
rights to any benefits. For example, suppose a 401(k) plan participant entered
into a same-sex marriage, designated someone other than the same-sex spouse as
beneficiary (without obtaining the spouse’s consent), and died before the
decision. Does the surviving spouse have a claim against the plan for survivor
benefits? Do same-sex couples have a right to claim refunds for health plan
benefits that were previously treated as taxable? The Courts and the IRS will
provide guidance on retroactivity at some point. 

CALIFORNIA RECOGNIZES
SAME SEX UNIONS

In California, the Supreme Court, in a 5-4 decision issued on
the same day as U.S. v. Windsor, ruled against the backers of California’s
Proposition 8
gay marriage ban. With the court’s ruling, gay marriage is once
again officially legal in California. While many questions remain about the broader
constitutional issue concerning the right of gay and lesbian couples to get
married, June 26 will be remembered as the day California’s gay marriage ban
died. 

 DOMA:  KNOWN EFFECTS

       1. Imputation of Income.
Same-sex partners will no longer pay federal taxes on income imputed for an
employer
s
contribution to a same-sex spouse
s
medical, dental or vision coverage and employers will no longer be required to
pay federal payroll taxes on such amounts.

        2.     Employer Refunds.  Employers may be entitled to a refund for
payroll taxes previously paid.
Employers may be required to continue to impute income for state law
purposes in states that do not recognize same-sex marriage.

3.  Coverage.
Windsor does not address whether plans that provide spousal coverage must cover
same-sex spouses. Employers with self-insured plans subject to ERISA are not
required to cover spouses and if they do cover some spouses, they are not
necessarily required to cover all spouses. Employers with plans not subject to
ERISA would be subject to any applicable state laws regulating coverage.  The ACA requires coverage of offspring but
not spouses, same sex or not.

 4. Pre-tax premiums.
Employees with same-sex spouses may pay the cost of spousal health coverage by reducing
pay on a pre-tax basis.

 5. COBRA. Same-sex spouses have the same independent COBRA rights as
opposite-sex spouses.

 6.  Special
Enrollment Rights.
Marriage to or divorce from a same-sex spouse is now a
HIPAA special enrollment event under plans offering spousal coverage. Employees
may add a same-sex spouse to their health coverage outside of the open
enrollment period, if they marry or if the spouse loses coverage due to a job
loss or change.

 7.  Personal Representatives.  HIPAA provisions relating to providing
patient information will now clearly include same sex spouses. 

8.  Medical
Expenses Tax Treatment.
Eligible medical expenses incurred by a same-sex
spouse at least since the date of the Windsor decision are eligible for
tax-free reimbursement under health care flexible spending accounts, health
reimbursement arrangements, and health savings accounts. There may also be a
medical expense deduction.  An employee
and a same-sex spouse will share the deduction limit for HSA contributions and
the typical health care cost deduction.

 9.  Qualified Retirement Plans. Spouses have a
number of rights under qualified retirement plans (such as defined benefit and
401(k) plans) subject to ERISA. Some examples of these rights, which must now
be provided to same-sex spouses, include Qualified Joint and Survivor rights,
same-sex spouses who are divorced can obtain a qualified domestic relations
order dividing retirement benefits (QDRO’s), and other rights for spouses.

HEALTHCARE SPECIFIC
ISSUES

Impact on Medicaid/CHIP
Eligibility. 
With
the invalidation of DOMA, states that recognize gay marriage must treat
married, same-sex couples as part of the same household. To determine whether
an individual is eligible for Medicaid/CHIP, states assess a household’s
composition and countable income as a percentage of the federal poverty level.

Treating same-sex couples as spouses can make it more likely that they are eligible
for Medicaid/CHIP by increasing the size of their households or it can make a
household less likely to be eligible by increasing the total family income.
Ultimately, in terms of Medicaid/CHIP eligibility, whether a same-sex couple
benefits or loses from being treated as one household depends on the amount of
income each spouse contributes.

The DOMA decision will affect the access married, same-sex
couples have to many government programs, as well as to employer-sponsored
health insurance. With DOMA no longer in place:

           Same-sex
spouses of federal employees will be entitled to federal healthcare           coverage.

           Same-sex
spouses of military personal will be eligible to receive TRICARE           coverage.

           Individuals in
same-sex marriages
like
those in heterosexual marriages
will
be able to qualify for Medicare based
on a spouse
s
work history.

 OTHER ISSUES

FMLA

The FMLA now will provide entitlement to take leave to care
for a same-sex spouse to the same extent as an opposite-sex spouse.

Medicare Secondary Payer Rules

Same-sex spouses will now be treated as spouses, such that
plans covering spouses of active employees will be considered primary for
Medicare purposes.

Prohibited Transaction Rules

Spouses are treated as “family members” in
determining whether a person is a disqualified person for purposes of
prohibited transaction rules. Same-sex spouses are now disqualified persons to
the same extent that opposite-sex spouses are.

 Ownership Attribution Rules

 The same-sex spouse of a 5% owner of employer stock is now
considered to be a 5% owner by attribution, including for purposes of
identifying highly compensated employees and for top hat purposes.

ACTION
ITEMS

 1.  Begin reimbursing
medical care expenses for same-sex spouses of participants.
Notify employees of the window (typically 30-days) under the
cafeteria plan for family status changes and special enrollment rights for
same-sex spouses and their dependents.

 2. Review definitional and choice-of-law provisions of benefit
plans concerning the definition of “spouse.”  Start obtaining spousal consent from same-sex
spouses for any defined benefit plan retirement distributions.

3. Advise employees married to same-sex spouses to review
their death beneficiary designations; if proper spousal consent has not been
obtained, their designations will be void.

4. Employers will want to ensure that same-sex spouses are
identified for its records in the same manner opposite-sex spouses are
identified. If the employer does not currently distinguish between same-sex
spouses and domestic partners in company records, for example, or identifies
opposite-sex spouses, but not same-sex spouses in its record keeping, the
employer should consider modifying its practices.

5.  Review all plan
documents, in particular the eligibility provisions, to determine if provisions
that were designed to provide coverage to domestic partners or same sex spouses
or designed to restrict coverage to opposite sex spouses should be changed or modified.

6.  Be sure that, at
least after the date of the Windsor decision, retirement plans in operation
provide lawfully married same-sex spouses residing in states where same-sex
marriages are recognized the benefit rights to which opposite sex spouses are
entitled. (See the lists above.)

7.  Cease imputing
income on health coverage and other benefits provided to same-sex spouses
residing in states that recognize same-sex marriage if income imputation is not
required for opposite-sex coverage.

 8. Permit employees to pay the 2013 cost of health care
coverage for lawfully married same-sex spouses residing in states where
same-sex marriages are recognized with pre-tax reductions in pay.

9.Consider whether to seek a refund for employment taxes paid
on imputed income for same-sex spouse benefits for open tax years.

10.  Begin a review of all
employee benefit plans, policies, procedures and handbooks to consider whether
changes are needed or desirable.

Matthew L. Kinley, Esq.

HIPAA: Business Associates and Business Associate Agreements

Health care
professionals working with personal medical information face major compliance
obligations under the newest rules related to “protected health information
(“PHI”).  The Omnibus rules were issued by the Department of
Health and Human Services issued last January (the “Final Rule”).

The Final Rule
sets requirements and authorizes substantially increased penalties for
violations of HHS’ regulations under the Health Insurance Portability and
Accountability Act of 1996
(HIPAA) and the 2009 Health Information Technology
for Economic and Clinical Health
(HITECH) Act. Particularly in light of those
increased penalties, HIPAA covered entities (health plans, health care
clearinghouses, and most health care providers) and their “business associates”
— which are now directly subject to HHS regulations — should be actively
reviewing their new responsibilities under the Final Rule.

The Final Rule’s
significant aspects relating to business associates are:

 

  • Make
    subcontractors (and sub-subcontractors, sub-sub-subcontractors, etc.) of
    HIPAA business associates themselves “business associates” and thus
    directly subject to most provisions of the HIPAA Privacy Rule, as well as
    the HIPAA Security Rule and HHS’ Breach Notification Rule;
  • Eliminate
    the “risk of harm” standard that HHS previously prescribed as a criterion
    for determining when it is necessary to notify individuals about a breach
    of security affecting their PHI; and
  • Require
    amendments to Notices of Privacy Practices, business associate agreements,
    and a variety of policies and procedures entailed in complying with the
    Privacy Rule.

With limited
exceptions, compliance with the Final Rule’s provisions is required by
September 23, 2013.

The HHS has
compiled extensive information about the business associates at their WEBSITE .

The site
includes a generic, sample agreement for business associates.  The sight
warns that not all of the sample should be used and parts should be modified to
set the exact situation. This agreement is a good start for complying with the
law. 

 By Matthew L. Kinley, Esq