Houston partner Robert Wolin and associate Ameena Ashfaq were quoted in the March 20, 2009, Houston Business Journal article, "HIPAA Replacement Closes Compliance Loophole."
According to the article, the American Recovery and Reinvestment Act signed into legislation by President Obama last month, contains significant reforms in the Health Insurance Portability and Accountability Act (HIPAA). One change is designed to safeguard patient privacy by expanding "covered entities"—previously doctors, hospitals and insurers—to include "business associates," such as billing firms, law firms, and pharmaceutical companies, which will now also have to be in compliance with HIPAA regulations.
Compliance could be costly, according to Ashfaq. "I think it will have some pretty expensive ramifications for health providers as well as business associates. A lot of entities will have to change their policies and procedures. It will be onerous," said Ashfaq.
According to the article, another HIPAA change that could have far-reaching consequences prohibits the sale of medical records without the patient's consent and limits direct marketing to patients based on their medical records. "Computer systems of firms that handle medical data will have to be secure," said Wolin. Stringent HIPAA standards include encrypting e-mails and ensuring that medical data cannot be accessed by unauthorized persons, said Wolin.
Another change involves the "breach notification requirement" which requires that, if there is a data breach, the affected individuals must be notified—and if more than 500 people are involved, local news media and the federal government must be notified so the breach can be made public. According to Wolin, in the past large-scale breaches of security and breaches involving celebrities were the only ones that got reported and resulted in legal action. "You didn't see many cases of enforcement in the past because there was no private right of action. The federal government had to bring action," said Wolin.