Just as important as the timely renewal of licenses, awareness of all deadlines required by covered entities and business associates is necessary to avoid potential violations and subsequent penalties.   The HIPAA Final Omnibus Rule shortened the time requirement to meet a few of these deadlines that require a specific action be taken by the covered entity or business associate. Still, some states have even tighter timelines.

Here are a few of the important deadlines to keep top of mind:

Deadline: 10 DAYS

Hepatitis B Vaccine for Employees at Risk of Exposure
29 CFR 1910.1030

Employees at risk of occupational exposure must be offered Hepatitis B Vaccine (at no cost) after the worker is trained and within 10 days of initial assignment to the job unless previously vaccinated, demonstrates prior immunity via antibody testing or is contraindicated for medical reasons, in which case the employer must obtain a written opinion by a licensed health professional within 15 days of vaccination evaluation. If the employee refuses the vaccination for any reason, a Hepatitis B Declination form should be signed and kept in the employee’s file.

 

Deadline: 30 DAYS

Individual’s Right to Access Medical Record
45 CFR §164.524

A provider must provide a copy of PHI as part of the designated record set to the requesting individual within 30 day deadline (30 day extension may be granted if the individual is notified in writing) except for:

• Psychotherapy notes
• Information compiled in anticipation of or use in a Civil, Criminal or administrative action or proceeding

If access is not denied as part of an unreviewable ground for denial §164.524 (a)(2)(i-v), the individual must be given a written denial within 30 days and the individual has the right to have the request reviewed by a 2^nd licensed professional.

 

Deadlines: 60 DAYS

Individual’s Right to Request Amendment to Medical Record
45 CFR §164.526

When a covered entity accepts an amendment request, the amendment must be completed within the 60 day deadline (additional 30 days if the individual is notified by the covered entity in writing). The covered entity may require the individual to make amendment requests in writing if this is stated in the Notice of Privacy Practices. The covered entity must also notify those identified by the individual who may have relied on such information to the detriment of the individual.

A covered entity may deny the amendment request if PHI:

• Was not created by the covered entity, unless the individual provides a reasonable basis to believe that the originator of PHI is no longer available to act on the requested amendment
• Is not part of the designated record set
• Would not be available under inspection under §164.524
• Is accurate and complete

The reason for denial must be sent to the individual within 60 days (one-time extension of 30 days if the individual is notified in writing). The individual may submit a statement of disagreement to include in their record and the covered entity may also include a rebuttal statement in the record as long as the individual receives a copy.

Individual’s Right to Accounting of Disclosures of PHI
45 CFR §164.528

The individual has the right to receive accounting of disclosures within 60 days for disclosures up to 6 years from the request date unless the request fits one of the exceptions from 164.528(a)(1)(i-ix).

 Breach Notification
45 CFR §164.400-414

Covered entities are required to notify affected individuals of any unauthorized access, use, disclosure or acquisition without reasonable delay within 60 days after discovery of the breach (some states within 30 days). Business associates must report breaches immediately upon discovery to the covered entity. If part of the Business Associate Agreement, the covered entity may require the business associate to notify the affected individuals. In addition, the Department of Health and Human Services (HHS) must be notified of such breaches:

• If >500 affected individuals, HHS should be notified at same time of individual notification.
• If <500 affected individuals, HHS must be notified within 60 days of calendar year end.

If the covered entity is unable to contact >10 of the affected individuals, the covered entity must post information on its website regarding who to contact for more information to determine if the breach has affected them.

Awaiting Final 60- day Overpayment Ruling (February 2016)
Self -Disclosure Protocol and Return of Overpayment

According to the 60-day rule as required by the Affordable Care Act section 6402, Center for Medicare and Medicaid Services (CMS)’ providers have to follow section 1128J(d)(2) of the Social Security Act requiring overpayment be reported and returned by the deadline of 60 days from the date on which the overpayment was identified. While awaiting a final decision addressing numerous public comments, CMS warns providers of possible False Claims Act liability if overpayments are not returned by the 60- day deadline. One such case arose on August 4, 2015, when the Department of Justice announced its first settlement due to a provider’s failure to exercise due diligence when identifying and investigating credit balances on the books.