HITECH will ignite great opportunities in the secure destruction industry

January 17, 2013

By Bob Johnson, NAID CEO

One of the country’s most prominent and respected privacy experts, attorney Kirk Narha, reported the HITECH Final Rule may be released soon, possibly by the end of this month. As many of you know, it was originally supposed to be released last summer and has been postponed several times since then.

So, even though it is reasonable to have some healthy skepticism about the speculated release, U.S. Department of Health and Human Services (HHS) can’t put it off forever and it is long overdue. Other professionals have speculated that HHS was waiting for the election results to release the rule because the winner could influence the tenor of future enforcement. Nonetheless, Narha would not have made his suspicions public, if there was not a strong feeling the release was imminent.

Why is the release of the HITECH Final Rule so important? It is important for a lot of reasons but mostly because it will mark a new era of data protection enforcement; an era where regulators are legally required to impose strong fines where both covered entities and business associates violate the law.

I have long maintained the HITECH Final Rule will mark a significant turning point for the secure destruction industry for the following reasons:

1. The mandatory requirements to investigate reported violations, combined with whistle-blower incentives, will dramatically increase fear in covered entities and business associates as well as investigations.
2. The reality of mandatory fines (along with mandatory investigations) will serve as a proverbial slap across the face to all health care providers, dramatically turning their attention to risk mitigation, including service provider qualifications, training, policies, and indemnification.
3. Coverage of the new rules will be furious and universal in the health care media for years; just like we saw when HIPAA hit. Even the general media (e.g., USA Today, Wall Street Journal, New York Times, Newsweek) will be covering it initially, but reports of fines and articles about compliance strategies will be everywhere in health care media publications for years to come.
4. The NAID Doctors’ Office Marketing Program was designed to capitalize on the furor resulting from the HITECH Final Rule. By postponing the release, HHS did not hold up there part of the bargain. Now that it is likely to hit soon, the market will be primed and members need to embrace this program for all its worth. The good news is that there will be plenty of opportunities to capitalize on the program once the rule hits. Also, you might want to visit www.properPHIdisposal.net, which is a NAID-sponsored resource for covered entities.
5. The HITECH Final Rule will create an opportunity to put all health care customers into play whether there is a contact in place. This is bad news for those who just want to sit back and keep what they have but good news for those willing to increase their qualifications and capitalize on the new regulatory environment.
6. My personal opinion is that HITECH is a trial balloon for what will be a national data protection law covering all personal and health data. It may take years to come but those who learn how to navigate in this new regulatory environment will be positioned nicely when the same rules apply to all businesses.