Advanced Search

Health Information Compliance Alert

HIPAA Privacy:

CHANGES TO 'FINAL' PRIVACY RULE

Published on Fri Mar 01, 2002

Health care providers have long decried certain elements of the consent provisions of the Health Insurance Portability and Accountability Act privacy rule but proposed changes to the rule outlined March 21 would dramatically lessen the burdens of HIPAA privacy compliance.

In a proposed rule slated for publication in the Federal Register March 27, the Department of Health and Human Services plans to remove consent requirements for information disclosures connected with treatment, payment and health care operations purposes. Under the proposal, covered entities would instead need to have patients acknowledge receipt of a plan or provider's notice of privacy rights and practices. (See article 2)

"These are common-sense revisions that eliminate serious obstacles to patients getting needed care and services quickly while continuing to protect patients' privacy," HHS Secretary Tommy Thompson said. "For example, sick patients will not be forced to visit the pharmacy themselves to pick up prescriptions and could send a family member or friend instead. Doctors will be able to consult with nurses and others involved in a patient's care to ensure that they get the best care."

Though most of the changes are designed to ease the pain of HIPAA privacy compliance, experts say revising the rule at such a late date may cause even more headaches for covered entities."Some people are saying this is the end of HIPAA as a major topic of conversation, but I don't think so at all," says Bill Sarraille, with Arent Fox Kintner Plotkin & Kahn in Washington. "It's still going to be a major implementation hassle for folks."

The following months will present a challenge to covered entities particularly providers because the modifications aren't yet final, says Kristen Rosati an attorney with Coppersmith Gordon Schermer Owens & NelsoninPhoenix."I hope that the [DHHS] moves very quickly after the comment period to finalize the modifications because it's going to be very difficult for providers to know which direction to go with the consent requirements in particular," she notes.

Docs Don't Have To Whisper

In addition to consent, the proposal addresses a number of other issues that have stoked the discontent of covered entities. Among them, according to an HHS fact sheet:

  • Oral communications. The rule makes clear that health care professionals can discuss a patient's care without fearing they'll be slapped with a HIPAA violation if they're overheard. As long as a covered entity abides by the "minimum necessary" standard (see HICA Vol. ..) and takes "reasonable safeguards to protect health information," incidental disclosures are not privacy rule violations.

  • Business associates. The proposal will include model business associate contract provisions to ease covered entities' compliance efforts. The changes will also grant covered entities (except small health plans) an extra year to change existing business associate contracts.

  • Authorizations. The rule allows the use of a single authorization form for the various uses and disclosures that would not otherwise be allowed under the privacy rule.

  • Parents and minors. The rule clarifies that state law governs the disclosure of children's health information to their parents. In any instance where the state law is unclear, the revisions permit a provider to use discretion to provide or deny a parent access to a child's health information.

  • Research. The rule eases the consent paperwork burden for researchers by eliminating the use of multiple consent forms.

  • De-identification. In response to concerns from the research community, HHS asks for comments and proposals regarding the development of a de-identified limited data set. Also, HHS proposes to allow the disclosure of that limited data set only when the recipient signs an agreement to "limit the use of the data set to the purposes for which it was given as well as not to re-identify the information or use it to contact any individual."

  • Marketing. Marketing, however, remains an area where HHS is reluctant to stand down. While the revisions narrow the definition of marketing, the proposal would explicitly require covered entities to obtain an individual's specific authorization before sending them any marketing materials. (See article 3)

    Editor's note: To see the HHS fact sheet on the proposed changes go to www.hhs.gov/news/press/2002pres/20020321.html.

    • Other Articles in this issue of

    Health Information Compliance Alert

    View All