HIPAA’s final enforcement rule, which was published last week in the Federal Register and which takes effect March 16, contains no major changes from the proposed rule, but clarifies how liability is investigated and determined. The final rule amends the existing requirements relating to the investigation of noncompliance to make them apply to all of the HIPAA administrative simplification rules, rather than exclusively to the privacy standards. The final rule also clarifies the investigation process, bases for liability, determination of the penalty amount, grounds for waiver, conduct of the hearing, and the appeal process. For example, the final rule states that the number of violations will not be calculated based on the number of times an identical requirement is violated, but on the number of requirements that are violated. Click here to read the final rule, including section-by-section comparison between the proposed and final rules.
