1 Electronic Transactions and Code Sets Enforcement CMS Office of HIPAA Standards
2 Enforcement of Administrative Simplification Standards CMS named to enforce HIPAA transactions and code sets OCR continues to enforce HIPAA privacy CMS creates Office of HIPAA Standards
3 Office of HIPAA Standards Outreach Regulations and Policy Enforcement
4 Enforcement Responsibilities Establish enforcement process Develop regulations
5 Enforcement Reality CMPs may not be more than - - $100/violation - $25,000/calendar year for violation of an identical requirement or prohibition
6 Enforcement Authority Two provisions of HIPAA government enforcement - § 1176: civil monetary penalties (CMPs) - § 1177: criminal penalties HHS has authority to assess CMPs DOJ has authority for criminal penalties
7 Enforcement Regulation HHS lead on developing enforcement regulation Simplifies and standardizes the enforcement process Provides a predictable process
8 Enforcement Regulation Notice of what constitutes a violation and how penalties will be determined Hapless vs. Willful Rulemaking process allows for public input
9 From Complaint To Compliant Complaint driven Voluntary compliance Technical assistance Corrective action plan Progressive Steps
10 Complaint Driven Complaints - web submittal - download and mail Notification in writing
11 Voluntary Compliance Opportunity to demonstrate compliance Good faith efforts go a long way
12 Technical Assistance Focus on educating providers and covered entities Roundtables, informational papers ASK HIPAA and HIPAA hotline
13 Corrective Action Plan Opportunity to submit corrective action plan Demonstrate and document efforts to become compliant Exercise reasonable diligence, make efforts to correct problem
14 Progressive Steps Compliance FIRST Corrective Action MIDDLE Tied for LAST: -CMPs - Exclusion from Medicare Access to care and patient safety
15 What CMS WILL DO Actively listen Actively participate in your conferences We want voluntary compliance as much IF NOT MORE than you do
16 Questions?