The HIPAA Privacy Rule covers health plans, health care clearinghouses, and those health care providers who conduct certain financial and administrative transactions electronically. Covered entities that fail to comply with the rule are subject to civil and criminal penalties, but individuals do not have the right to sue for violations of the rule. On April 17, 2003 HHS published an interim final "Enforcement Rule" that applies to standards, including the Privacy Rule, adopted under the Administrative Simplification provisions of HIPAA, 68 Fed. The interim final rule establishes procedures for investigations, imposition of penalties, and hearings for civil money penalties; and is effective May 19, 2003 thru September 16, 2003. It is to be revised when HHS issues a complete Enforcement rule that will include procedural and substantive requirements for the imposition of civil money penalties, such as HHS' policies for determining violations and calculating CMP's. A state law is "more stringent" if it meets one or more of the following criteria: 1) the state law prohibits or further limits the use or disclosure of protected health information, except if the disclosure is required by HHS to determine a covered entity's compliance or is to the individual who is the subject of the individually identifiable information; 2) the state law permits individuals with greater rights of access to or amendment of their individually identifiable health information; provided, however, HIPAA will not preempt a state law to the extent that it authorizes or prohibits disclosure of protected health information about a minor to a parent, guardian or person acting in loco parentis of such minor; 3) the state law provides for more information to be disseminated to the individual regarding use and disclosure of their protected health information and rights and remedies; 4) the state law narrows the scope or duration of authorization or consent, increases the privacy protections surrounding authorization and consent, or reduces the coercive effect of the surrounding circumstances; 5) the state law imposes stricter standards for record keeping or accounting of disclosures; 6) the state law strengthens privacy protections for individuals with respect to any other matter.
As of April 14, 2003, most health care providers (including doctors and hospitals) and health plans are required to comply with the new Privacy Rule mandated by the Health Insurance Portability and Accountability Act of 1996 ("HIPAA"), and must comply with national standards to protect individually identifiable health information. The HIPAA Privacy Rule creates a federal floor of privacy protections for individually identifiable health information; establishes a set of basic consumer protections; institutes a series of regulatory permissions for uses and disclosures of protected health information; permits any person to file an administrative complaint for violations; and authorizes the imposition of civil or criminal penalties. In hearings prior to the effective date of the Rule, there was widespread concern over aspects of the rule, including the extent to which it preempted state laws. On April 17, 2003, HHS published an interim final rule establishing the rules of procedure for investigations and the imposition of civil money penalties concerning violations. This interim final rule will be effective May 19, 2003 through September 16, 2003. HHS plans to issue a complete Enforcement Rule with both procedural and substantive provisions after notice-and-comment rulemaking. This report will be updated.