Federal Privacy Rule Protects Health Information
Recently, the first-ever federal privacy standards to protect individuals’ health-care information went into effect. The mandate for these standards, collectively known as the Privacy Rule, was in the Health Insurance Portability and Accountability Act of 1996 (HIPAA).

The Privacy Rule gives individuals access to their medical records and greater control over the use and disclosure of their personal health information. States are still free to keep or adopt their own policies or practices that are at least as protective as the new federal requirements.

Who Is Covered
Entities subject to the Privacy Rule include health-care providers, health plans (including insurance companies and HMOs), and health care clearinghouses, such as physicians’ billing services. The regulations also apply to “business associates,” meaning any organization or person (other than a worker for a covered entity) that receives or accesses private medical information on behalf of a covered entity. When a covered entity uses a business associate, the two must enter into a written agreement containing specific protections for the health information used or disclosed by the business associate.

On its face, the Privacy Rule does not directly apply to employers, but that is not to say that employers need not become familiar with its requirements. Employers frequently interact with covered entities and their business associates. In addition, employers administering their own group health plans are effectively brought within the reach of the Privacy Rule. Safeguards for Individuals

The Privacy Rule applies to “protected health information” (PHI), defined as all individually identifiable health information held or transmitted in any form or media, whether electronic, paper, or oral. Individuals generally should be able to see and obtain copies of their PHI within 30 days of a request. Covered entities must provide a notice to individuals describing how their PHI may be used and informing them of their rights under the Privacy Rule.

In the interest of promoting quality health care, providers are not restricted in their ability to share information needed to treat patients.

Generally, PHI may not be used for purposes unrelated to health care. However, in the rare cases where it is allowed, only a minimum amount of protected information may be used or shared. Covered entities may release medical information to outside businesses such as insurers, banks, or marketing firms only with specific written authorization from the individual.

The Privacy Rule gives individuals the right to request alternative means or locations for receiving PHI communications. For example, a patient could ask a doctor to communicate with the patient through a designated telephone number or address. Another reasonable accommodation might be sending medical information to a patient in a closed envelope rather than on a postcard.

Policies and Procedures
The Privacy Rule requires covered entities to set up policies and procedures to protect the confidentiality of PHI. Written privacy procedures must identify staff with access to PHI and describe how such information will be used and when it may be disclosed. There must be training of employees in privacy procedures and designation of an individual to be responsible for insuring that those procedures are followed.

Covered entities may continue existing disclosures of health information for certain public responsibilities, subject to limits and safeguards that are specific to such circumstances. Examples include emergencies, identification of the body of a deceased person, and public health needs. If there is no other law that mandates disclosure to meet a particular public responsibility, covered entities may use their professional judgment to decide whether to make disclosures.

Enforcement
The Government may impose civil penalties of $100 for each failure to comply with a Privacy Rule requirement. A penalty may not exceed $25,000 per year for multiple violations of the same requirement in a calendar year. If a violation is due to reasonable cause, involved no willful neglect, and is corrected within 30 days of when an entity knew or should have known about it, no civil penalty may be imposed. A knowing violation of the Privacy Rule could also bring a fine of $50,000 and up to a one-year prison term. Maximum criminal penalties are higher if the wrongful conduct involves false pretenses, or use of the health information for commercial advantage, personal gain, or malicious harm.

Highlights Of The New Federal Tax Act
On May 28, 2003, the Jobs and Growth Tax Relief Reconciliation Act of 2003 became law. Much of this federal tax law applies only to the years 2003 and 2004, after which provisions in the 2001 Tax Act will again become effective. Nonetheless, the Act contains some significant changes for individuals as well as businesses.

Individuals
The child tax credit increases from $600 to $1,000, which is an acceleration of a scheduled phase-in that was to have occurred between 2005 and 2010. In 2005, the credit will fall to $700, but will then gradually rise to $1,000 again by 2010 by virtue of the 2001 Act.

The standard deduction for married couples will double to twice the amount of the standard deduction for single taxpayers. Married taxpayers filing a separate return will claim the same standard deduction as a single person. Similarly, for 2003 and 2004, the upper limit of the 15% income tax bracket for married couples will increase to a dollar amount that is twice that for a single taxpayer.

For 2003, income levels for the 10% tax bracket will increase to $7,000 for single taxpayers and $14,000 for joint filers. In 2004, these levels of income will be indexed for inflation. Retroactive to January 1, 2003, the new tax rates for individuals are 10%, 15%, 25%, 28%, 33%, and 35%. For transactions taking place from May 6, 2003 to December 31, 2007, the maximum capital gain tax rate has dropped from 20% to 15%, and from 10% to 5% for lower-income taxpayers.

To reduce the double taxation of corporate earnings, dividends received by an individual shareholder from a domestic or qualified foreign corporation will be taxed like capital gain income. This means a rate of 15% for most taxpayers and 5% for those at lower-income levels, assuming the stock is held for at least the holding period set by law. Dividends from certain corporations are not eligible for this new treatment, such as those from tax-exempt charities, farmers’ cooperatives, and particular foreign companies.

Businesses
The Act increases the amount of investment that may be deducted immediately by small businesses from $25,000 to $100,000. The amount of this deduction is reduced by the amount that the cost of the business assets exceeds $400,000. Under prior law, this phase-out of the deduction began at $200,000. The additional first-year bonus depreciation deduction is increased from 30% to 50% for investments acquired and put into service between May 5, 2003 and January 1, 2005. Qualifying property still must be brand new, with a class life of 20 years or less.

San Diego Law Firm
San Diego office: 2828 University Avenue, Suite 102, San Diego, CA 92104
Carmel Valley office: 12707 High Bluff Drive, Suite 200, San Diego, CA 92130

Terms of Use    Privacy Policy
© 2001, 2006 San Diego Law Firm    ALL RIGHTS RESERVED.
Law Firm Website by LawMarkets.com; Website design by