Settled HIPAA Case Underlines Importance of Protecting ePHI

In a recently settled HIPAA case, the Department of Health and Human Services (HHS) set a new precedent for guarding electronic protected health information (ePHI).

In an extensive investigation, HHS determined that a small surgery practice in Arizona had violated HIPAA privacy rules and had instated few safeguards to protect patients’ ePHI. The practice reportedly posted PHI on an Internet-based, publicly-accessible calendar and sent emails containing PHI to workers’ personal email accounts.

HHS specifically noted that the practice was in violation because it had failed to obtain business associate agreements with the email and electronic calendar providers, a marked departure from past regulations. Previously, email providers had been considered “conduits,” and were not subject to the same requirements as other entities that have access to PHI. This determination may signal the department’s intent to require all employers to obtain a business associate agreement from all conduits in the future.

The case is also notable because it is the first time that text messaging has been discussed in relation to transmitting ePHI. According to the resolution agreement, HHS is requiring the practice to implement technical security measures for any protected information transmitted via text message. This ruling may also indicate the direction the department plans to take in regard to texting and may impact employers nationwide.

With this case, the HHS seems to be setting an example regarding future enforcement of regulations. The small size of the involved practice underlines the importance for organizations of all sizes to guard ePHI

New HSA Limits Released

The Internal Revenue Service (IRS) recently issued Revenue Procedure 2012-26 which contained new limitations governing health savings accounts (HSAs) and high deductible health plans (HDHPs) for calendar year 2013. Listed below are the updated limits:

HSA Contribution Limits

Self only: $3,250 (up from $3,100)

Family: $6,450 (up from $6,250)

HDHP Out-of-Pocket Expense Limits

Self only: $6,250 (up from $6,050)

Family: $12,500 (up from $12,100)

HDHP Deductible Limits

Self only: $1,250 (up from $1,200)

Family: $2,500 (up from $2,400)

These new limits are for the 2013 calendar year, effective Jan. 1, 2013.

DID YOU KNOW

June is Firework Safety Month and as the Fourth of July approaches, it is the perfect time to educate your employees on the proper use of fireworks. Some tips include:

• Never allow young children to play with or ignite fireworks.
• Always have an adult supervise the use of fireworks.
• Keep a bucket of water or a garden hose close by in case of emergency and to douse used fireworks before discarding.

For more information or safety tips, visit www.cpsc.gov/info/fireworks/index.html