American Recovery & Reinvestment Act (ARRA) Enforces Regulations

Title XIII of the American Recovery and Reinvestment Act of 2009 (ARRA), specifically known as the Health Information Technology for Economic and Clinical Health Act (HITECH Act), is doing more than just mandating a transition to Electronic Health Records (EHR). It is also expanding the compliancy requirements of HIPAA and introducing the first federally mandated data breach notification requirement.

Under the new HITECH Act, regarding healthcare information privacy and data security, all "business associates" of organizations covered by HIPAA must now adhere to the same requirements. "Business Associates", as defined in the act, refers to service providers such as billing agencies, law firms, accounting firms, and others that provide service and interact with organizations that are directly subject to HIPAA regulations.  This means that the same criminal and civil liabilities that apply to pharmacies, hospitals, and other healthcare providers now apply to associated business entities of these organizations.  Prior to HITECH, associated businesses that failed to protect patient privacy, health records, and data security were only liable to HIPAA-covered organizations via service contracts, and never subject to government scrutiny and consequences.

With stricter compliance requirements and major transitional process changes it is more important than ever that companies in the healthcare industry have visible, structured, and secure methodologies for implementing such major changes.  As it stands, the ARRA is offering $22 billion in stimulus funding for the advancement of Health Information Technology (HIT). All healthcare providers and pharmaceutical companies that fail to demonstrate "meaningful use" of technology will face hefty monetary penalties by 2014. This being said, more and more healthcare companies and healthcare business associates are taking advantage of stimulus funding and turning to Business Process Management (BPM) software to model and improve their current processes and implement new security measures to ensure HIPAA compliance.

Is your company developing new strategies to facilitate a smooth, secure transition to EHR? Can your affiliated service providers' measure up to the increased scrutiny and compliance regulations?

Mary Katherine Strupe
Marketing Coordinator
Ultimus