Stimulus Bill Alters HIPAA Privacy and Security Rules; Federal Government Signals Renewed Interest in Enforcement of Rules

The American Recovery and Reinvestment Act of 2009 (commonly known as the Stimulus Bill), signed into law on February 17, makes several important changes with respect to the HIPAA privacy and security rules. These changes will require entities covered by the rules, their business associates and others to review and possibly revise their health information policies, procedures, practices and agreements. Further, through the Stimulus Bill and through the February 18 announcement of a settlement of a HIPAA privacy case against CVS, the nation's largest pharmacy chain, the federal government signals a renewed interest in the enforcement of the privacy and security rules.