By Legal & Regulatory Affairs staff
By Sept. 23, 2013, psychologists covered by HIPAA must implement changes required by the HIPAA Final Rule, which was released January 2013 by the U.S. Department of Health and Human Services. (Most psychologists trigger the need to comply with HIPAA by electronically transmitting Protected Health Information (PHI) in connection with insurance claims or other third-party reimbursement.)
The most important changes affecting psychologists concern enforcement and penalties, breach notification, notice of privacy practices and business associates. Changes to enforcement policies are critical and could result in penalties of up to $1.5 million per year for violations of any particular HIPAA requirement. Stiffer penalties and enforcement are aimed at those who should be complying, but are not taking the basic steps to comply with the HIPAA rules.
The APA Practice Organization has prepared a resource called The HIPAA Final Rule: What you need to do now (PDF, 550KB), which we are providing free to Practice Organization members. This resource also includes the inserts you need to update your existing HIPAA forms, such as your notice of privacy practices. (The Final Rule resource will also be made available to past and future purchasers of the HIPAA for Psychologists compliance product.)
The Practice Organization has also updated the Privacy Rule Primer (PDF, 1.5MB) to explain briefly how Final Rule changes fit into the broader context of Privacy Rule compliance. The primer, which is available to all APA members, also provides a refresher for those who started complying long ago, and an introduction for new practitioners just starting with HIPAA. It covers HIPAA basics such as who needs to comply with the Privacy Rule and the Security Rule.
For more information about the new HIPAA Final Rule resource, watch this brief introductory video from Alan Nessman, JD, senior special counsel for the APA Practice Organization.