Faced with a congressional mandate for rules, CMS has released "final" "interim" rules that generally parallel the April 17 version.

Among the highlights:

a.    The federal rules do not pre-empt the state rules except where joint compliance is impossible;

b.    Although the rules give you up to 60 days for disclosure, the CMS comments make it clear that they may not accept a 60-day limit where disclosure could have been reasonably made sooner;

c.          Deadline for compliance is September 24, 2009, based on the publication date (inspite of concern Congressional mandate probably required the 17th)  although the CMS statement suggests that they have exercised general discretion to delay enforcement until the general February 17, 2010 deadline under the ARRA.  Caution:  This statement was not sufficiently definite to rule out enforcement in an breach prior to February but after September 24, if CMS feels it is warranted.

d.    In order to comply with the actual September deadline, it would be necessary to establish breach notification policies and procedures (if not already in place or compliant with the new rules), modify Business Associate agreements, train personnel, have sanctions in place for Business Associates and employees for breaches, and have mitigation and notification plans ready to use.

e.    Breaches covered by this rule involve only UNENCRYPTED protected healthcare information under HIPAA.  CMS has ruled in this regulation that ONLY encryption or destruction of data renders the information sufficiently unaccessible or unusable to satisfy legislative standards.

f.    Redaction of documents does not render the PHI secure, but de-identification of documents removes the data from the classification of PHI and therefore removes the breach from the disclosure requirements of this regulation, CMS indicated.

g.    Both healthcare providers and business associates are subject to new and more aggressive fine enforcement under the ARRA and these regulations.

A Full text PDF of the final interim regulation may be downloaded at www.medlaw.com/breachnotification.pdf