Health Information Compliance Alert

The proposed changes to the Health Insurance Portability and Accountability Act privacy rule will cut net compliance costs by $100 million over ten years, according to estimates from the Department of Health and Human Services.

The biggest savings come from changes to waiver requirements for medical researchers. HHS originally pegged the cost of provisions requiring waivers of individual authorization for the use of protected health information for research at $40 million for the first year and $585 million over ten years. The proposed simplification of those provisions will reduce the ten-year costs by $146 million.

Further savings will come from the eliminating the consent requirement the most controversal change which required covered entities to obtain written consent from patients to use or disclose protected health information for treatment, payment or health care operations. HHS had set the ten-year cost of the consent requirement at $103 million, though many who commented on the rule said the cost would be much higher. Eliminating the requirement erases those costs.

The consent requirement, however, will be replaced with a requirement compelling covered health care providers "to make a good faith effort" to obtain written acknowledgment from their patients indicating that they have received notice of their provider's privacy practices. The new acknowledgment requirement will add $184 million to HIPAA compliance costs, according to HHS estimates.

In addition, the inclusion of model business associate contract language in the proposed rule changes should shave another $35 million from compliance costs. HHS originally estimated covered providers would pay out $103 million in the first year to develop their own business associate contracts. By offering model contract language, however, HHS expects to reduce by a third the time required by covered entities to develop those contracts.