California’s Privacy Pileup

New state laws meet even newer federal regulations

CHICAGO, August 5, 2009—New privacy protection laws included in the American Recovery and Reinvestment Act (ARRA) make even a brief unauthorized look at medical records a federal offense that can mean large monetary fines both for individuals and healthcare facilities. A feature article in the August issue of the Journal of AHIMA reports that providers across the nation are now charged with the task of adapting their privacy policies and procedures to meet both state and federal requirements, while California amplified the task by overhauling healthcare privacy policies with strict new state laws.

Congress used ARRA as an attempt to increase patient trust that the healthcare industry will protect their personal health information. The data breach notification regulations are the first of the ARRA privacy provisions to take effect. The law requires both the Department of Health and Human Services and the Federal Trade Commission to create and publish final interim regulations by August 16. California’s state laws contain tough new requirements that require facilities to report all privacy breaches to the California Department of Public Health.

This article explains how sorting out whether state or federal law is stricter has become a big challenge for healthcare officials because, as drafted, ARRA suggests that federal regulations will not preempt state laws. Under California law, patients must be notified if their health information has been compromised and if lost or stolen records are not encrypted with data protection technology.

California’s Privacy Pileup  explains that once final regulations are announced, the collision of state and federal laws can be alleviated if healthcare organizations study and comply with ARRA provisions determined to be the most stringent. Also discussed is the need for these entities to work toward common interpretations and implementations when setting their policies.

Also in this issue

This month’s Journal of AHIMA includes the cover story “Physician Practice Check-Up” that examines the American Recovery and Reinvestment Act’s incentive program and how a practice’s readiness assessment can make the difference between success and failure for electronic health records.

Read these articles, our monthly Professional Practice Brief and more in the August issue of the Journal of AHIMA or online at journal.ahima.org.

About AHIMA

Representing more than 53,000 specially educated Health Information Management professionals in the United States and around the world, the American Health Information Management Association is committed to promoting and advocating for high quality research, best practices and effective standards in health information and to actively contributing to the development and advancement of health information professionals worldwide. AHIMA’s enduring goal is quality healthcare through quality information. www.ahima.org