…Under the Final Rule, the OCR has the power to domestically deal out civil penalties, corrective actions and long-term monitoring, while the DOJ has the power to domestically deliver a criminal prosecution. Through enforcement under HITECH, the State attorneys general also have the power to cause pain to U.S.-based companies, because the attorneys general are empowered to bring civil actions in federal district courts for state residents who have been damaged or whose rights were violated by information breaches

Read the full column here: Unclear HIPAA rules permit healthcare data offshoring … for now