If the patient's information has been disclosed because of a breach of privacy, providers must notify the patient or their next of kin within 60 days; if the breach affects more than 500 patients the local media must be notified along with HHS, so it can be posted on the department's Web site, he added.
The interim regulation spelling out all the EHR requirements is due to be published no later than July of this year. Practices that already have EHRs have until Jan. 1, 2014 to comply with the new rules; those who buy EHRs from now on have to comply either by the day they purchase the system or by Jan. 1, 2011, whichever is later, he said. MGMA, MedFusion, Athena health, and MicroMD sponsored the teleconference.