HHS Delegates HIPAA Security Rule Enforcement to OCR

Health and Human Services (HHS) Secretary Kathleen Sebelius recently announced that authority for the administration and enforcement of the HIPAA security rule has been delegated to the Office for Civil Rights (OCR). The OCR’s administration and enforcement of the security rule, which had previously been delegated to the Centers for Medicare & Medicaid Services (CMS), will eliminate duplication and increase efficiencies in how the department ensures that Americans’ health information privacy is protected.
 
HHS has the authority for administration and enforcement of the federal standards for health information privacy called for in HIPAA. The privacy rule provides federal protections for personal health information held by covered entities and gives patients an array of rights with respect to that information. The OCR has been responsible for enforcement of the privacy rule since 2003.
 
The security rule specifies a series of administrative, technical, and physical security procedures for covered entities to use to ensure the confidentiality of electronic protected health information. The HITECH Act, part of the American Recovery and Reinvestment Act of 2009, mandated improved enforcement of the privacy and security rules.
 
“Security and privacy of health information are increasingly intersecting as the department works with the health industry to adopt electronic health records and participate in an even greater level of electronic exchange of health information,” says Sebelius. “Privacy and security are naturally intertwined because they both address protected health information. Combining the enforcement authority in one agency within HHS will facilitate improvements by eliminating duplication and increasing efficiency.”
 
Through a separate delegation, the CMS continues to have authority for administration and enforcement of the HIPAA administrative simplification regulations, other than privacy and security of health information.
 
Source: Health and Human Services