• Biden Administration’s Top HIPAA Enforcer Discusses Agency’s Plans

By Marianne Kolbasuk McGee (HealthInfoSec) • March 21, 2022   

The Department of Health and Human Services has an ambitious regulatory agenda for the months ahead, as well as plans for strong enforcement of HIPAA violations, including those involving patients’ right of access, says director of the HHS Office for Civil Rights, Lisa Pino.

Among the tasks on OCR’s rule-making agenda is a request for information pertaining to the agency sharing its collection of civil monetary penalties, or CMPs, and financial settlements to individuals harmed by HIPAA breaches, Pino says in a video interview with Information Security Media Group.

“We will solicit the public’s view about a methodology for the distribution of CMPs and monetary settlements, which is quite novel, to those harmed by a HIPAA offense related to privacy or security,” she says.

The distribution of a percentage of HIPAA settlements and CMPs collected by HHS OCR to harmed individuals was called for under an as-yet-unmet provision of the HITECH Act.

The RFI will also seek public input about the best ways for HHS OCR to implement a requirement for the agency to assess the security practices of covered entities and business associates when making certain HIPAA enforcement determinations, she says.

Pino says a final rule for modifications to the HIPAA privacy rule, “which would strengthen individuals’ rights to access their own health information, is also planned.

Enforcement Priorities

Meanwhile, enforcement of HIPAA remains a “top priority,” Pino says, noting that HHS OCR issued 14 enforcement actions in 2021 – many focused on the HIPAA right of access provision.

“Clearly we are serious about enforcement at OCR. We will pursue civil monetary penalties for violations that are not addressed,” she says.

That includes “holding covered entities responsible for providing patients with timely access to their medical records.”https://www.careersinfosecurity.com