Cignet Health (Cignet) has become the first covered entity to be issued a civil monetary penalty. The HHS Office of Civil Rights (OCR) has imposed a penalty of $4.3 million. The violations were a result of the new rules and regulations set forth in Section 13410(d) of the HITECH Act.

For further details see links below.

http://www.hhs.gov/ocr/privacy/hipaa/news/cignetnews.html

As many are aware, the February 17, 2010 effective date for many of the HITECH provisions has passed. This has left many covered entities and business associates wondering how to proceed. According to hhs.gov, the relevant effective dates for provisions will be issued through Notice of Proposed Rulemaking (NPRM) and an eventual final rule.

In a notice published in the Federal Register on August 4, 2009, Kathleen Sebelius, Secretary of the Department of Health and Human Services delegated authority to the Director of the Office of Civil Rights over the HIPAA Security rules.  With this delegation, the OCR is responsible for interpreting and enforcing both the HIPAA Privacy and Security rules.  The OCR can now impose civil money penalties, issue subpoenas, and make exception determinations.  The delegation is effective immediately. See 74 FR 38630.

On April 17, 2009, HHS issued guidance specifying the technologies and methodologies that render protected health information unusable, unreadable, or indecipherable to unauthorized individuals, as required by the Health Information Technology for Economic and Clinical Health (HITECH) Act passed as part of the American Recovery and Reinvestment Act of 2009. The guidance was developed through a joint effort by OCR, the Office of the National Coordinator for Health Information Technology, and CMS.