HIPAA and the stimulus package

The provisions of the American Recovery and Reinvestment Act (ARRA) required the Department of Health and Human Services (HHS) to provide regulations related to the notification of breaches of unsecured protected health information. On August 24, 2009, HHS released the “Breach Notification for Unsecured Protected Health Information; Interim Final Rule.” These interim final regulations require covered entities as defined under the Health Insurance Portability and Accountability Act (HIPAA) contact its participants in the event their unsecured protected health information (PHI) is breached. Generally unsecured PHI means PHI that is not rendered unusable, unreadable, or indecipherable to unauthorized individuals through the use of a technology or a methodology approved by HHS.

See the link here for more information: http://www.hhs.gov/ocr/privacy/hipaa/understanding/coveredentities/breachnotificationifr.html