April 17, 2009

Guidance Specifying the Technologies and Methodologies That Render Protected Health Information Unusable, Unreadable, or Indecipherable to Unauthorized Individuals for Purposes of the Breach Notification Requirements under Section 13402 of Title XIII (Health Information Technology for Economic and Clinical Health Act) of the American recovery and Reinvestment Act of 2009; Request for Information

This initial guidance outlines the minimum safeguards that HHS expects to require HIPAA covered entities to use to secure protected health information. In addition, it establishes circumstances in which the new data breach notification rules added to federal law under the Health Information Technology for Economic and Clinical Health Act will require HIPAA covered entities to notify patients of a breach of security of protected health information. The guidance was required from HHS by the American Recovery and Reinvestment Act. Comments may be submitted on or before May 21, 2009.