|
|
Article: HHS And FTC Announce New Breach Notification Rules For Unsecured Protected Health Information.(Health Information Technology for Economic and Clinical Health Act)(Health Insurance Portability and Accountability Act of 1996)
- Article from:
- Mondaq Business Briefing
- Article date:
- September 8, 2009
CopyrightCOPYRIGHT 2009 Mondaq Ltd. This material is published under license from the publisher through the Gale Group, Farmington Hills, Michigan. All inquiries regarding rights should be directed to the Gale Group. (Hide copyright information)
|
On August 24 and 25, 2009, the Department of Health and Human Services ("HHS") and the Federal Trade Commission ("FTC"), respectively published rules on when and how covered entities regulated by the Health Insurance Portability and Accountability Act of 1996 ("HIPAA") and vendors of personal health records ("PHR") must notify individuals of security breaches concerning their unsecured protected health information ("PHI"). With its rule, HHS also provided guidance on securing PHI through "encryption" and "destruction" measures. While compliance with these security measures is not required, conformance to the guidance offers a relative safe harbor for covered entities and ...