HIPAA

HIPAA's compliance requirements are organized into three main rules. The Privacy Rule (45 CFR Part 164, Subpart E) governs the use and disclosure of PHI, establishes patient rights (access, amendment, accounting of disclosures), and requires a Notice of Privacy Practices. The Security Rule (45 CFR Part 164, Subpart C) mandates administrative, physical, and technical safeguards specifically for electronic PHI (ePHI). The Breach Notification Rule (45 CFR Part 164, Subpart D) requires notification to individuals, HHS, and potentially the media following a breach of unsecured PHI.

Enforcement has intensified significantly since the HITECH Act of 2009. The HHS Office for Civil Rights (OCR) conducts investigations based on complaints and data breaches, and since 2016 has also conducted random compliance audits. Penalty tiers range from $137 to $68,928 per violation, with calendar-year caps of $2,067,813 per violation category. State attorneys general, including California's, can bring additional actions under HITECH. In California, the CMIA provides even stronger protections that layer on top of HIPAA.

BayArea Compliance's HIPAA|360 program addresses all three HIPAA rules plus California's CMIA requirements. We conduct the Security Rule's required risk assessment, develop and maintain your privacy and security policies, deliver annual workforce training, manage business associate agreements, and maintain your breach response procedures. The program is designed for California healthcare providers who must navigate both federal and state privacy requirements simultaneously.