Stites & Harbison, PLLC

Presented by the Louisville Bar Association

Program Host: LBA Health Law Section (K. Kelly White Bryant, Chair)

Click here for further information.

Certain health information privacy changes that took effect February 17, 2010 require business associates of healthcare providers and health plans, including law firms who represent health care clients, to reevaluate how they handle medical records and other health information. Specifically, the American Recovery and Reinvestment Act of 2009, also known as the Stimulus Package, included approximately $147 billion in funding for various healthcare-related programs in the form of the Health Information Technology for Economic and Clinical Health Act ("HITECH"). HITECH explicitly extends certain provisions of the Health Information Portability and Accountability Act of 1996 ("HIPAA"), and the HIPAA privacy and security regulations, to cover business associates of healthcare providers and health plans, including attorneys and law firms.

HIPAA defines a "business associate" to include any entity that provides legal services to or for a healthcare provider or health plan if the provision of the legal service would involve the disclosure of protected health information ("PHI"). In addition to extending liability for HIPAA privacy breaches directly to business associates, HITECH now also requires business associates who receive or maintain PHI in electronic format to fully implement the HIPAA security rule. Additionally, HITECH now also requires business associates to immediately notify their health care clients in the event that their HIPAA policies are breached.

It is important that attorneys and law firms that are business associates be aware of and implement these safeguards in order to ensure compliance with the HITECH Act. Our program will cover the specific HITECH provisions applicable to law firms and will include a roundtable discussion by attorneys and an IT administrator at a local law firm about the challenges that they faced while implementing the HITECH-imposed policies and procedures.

Speakers:

• Charles J. (Mike) Cronan IV, Member, Health Care Service Group, Louisville office
• Jennifer L. Elliott, Member, Health Care Service Group, Louisville office
• Sarah O. Cronan, Associate, Health Care Service Group, Louisville office
• Tab Barton, Director of Information Services, Louisville office