By ROLF LOWE
The Department of Health and Human Services (HHS) released proposed changes to the Health Insurance and Portability Accountability Act (HIPAA) Standards for Privacy of Individually Identifiable Health Information (the Privacy Rule) on December 10, 2020. The proposed modifications to the Privacy Rule are intended to address existing standards HHS has identified as impeding the transition to value based care, while continuing to protect the privacy and security of individuals’ protected health information (PHI). HHS specifically identified obstacles currently in place hindering care coordination and case management communications among individuals and covered entities, (which include hospitals, physicians, other health care providers, payors and insurers). The proposed rule changes also address unnecessary burdens associated with communicating PHI between covered entities and individuals.
Some of the major changes to the Privacy Rule include:
-Defining electronic health records (EHR) and personal health application;
-Modifying rules concerning an individuals’ right of access to their PHI;
-Amending the definition of health care operations to broaden the permitted use and disclosure of PHI for care coordination and case management;
-Creating an exception for “minimum necessary” standard for the purpose of care coordination and case management;
-Clarification of the rules covering the ability to disclose PHI to social service agencies, community-based organizations, home and community-based services (HCBS) providers and other organizations providing health related services;
-Replacing the “professional judgment” standard for permissible uses and disclosures with a good faith standard;
-Eliminating the requirement to obtain an acknowledgment of receipt of a direct treatment provider’s Notice of Privacy Practices (NPP);
-Modifying the required contents of a NPP to clarify the rights of individuals as it relates to their PHI and exercising those rights;
-Express permission to disclose PHI through Telecommunications Relay Services (TRS); and
-Expanding the Armed Forces permissible disclosures.
While many of the proposed changes to the Privacy Rule are intended to make the disclosure of PHI more permissible and reduce burdens, this is not the case for covered entities when it comes to responding to an individual’s request for records. The proposed change to the Privacy Rule will change timing typically allowed for covered entities to respond to an individual’s request for PHI, shortening the time period from 30 calendar days to 15 calendar days.
The Privacy Rule’s “Right of Access” has been on HHS’ radar the last several years. In 2019 HHS launched the HIPAA Right of Access Initiative to ensure that individuals get timely access to their health records. Robert Severino, outgoing HHS Office of Civil Rights (OCR) Director, touted a total of 14 enforcement actions under the initiative while he was the OCR Director and noted that many of the proposed modifications to the Privacy Rule are directly related to the Right of Access Initiative. The enforcement actions under the initiative primarily involve health care providers who failed to provide an individual access to their records or took a significantly long time is producing the requested records.
Providers should pay attention to the proposed change involving a response to an individual’s request for records, since it may involve a change to existing policies and workflow, as well as education and training of staff responsible for responding to an individual’s request for records. HHS has already demonstrated its commitment to hold covered entities that fail to comply with the current standard for responding to requests for records accountable through the recent Right of Access Initiative, and will likely monitor compliance with the new standard and take action on complaints if it is adopted. Currently, HHS has proposed a compliance date of 180 days after the effective date of the final rule for any new and revised standards in the final rule. Enforcement of any new and revised standards will begin 240 days after publication of the final rule.
HHS is currently accepting comments on the proposed changes to the Privacy Rule through Feb. 10, 2021. Comments may be submitted at http://www.regulations.gov by searching for the Docket ID number HHS-OCR0945-AA00. For additional information or assistance please contact Rolf Lowe of Wachler & Associates at (248) 544-0888.