Medicare Compliance & Reimbursement

The NPRM is fairly extensive and proposes several updates to HIPAA to protect patients and providers. From definitions to attestations to regulatory reform, the modifications touch on several aspects of the law and privacy concerns. Take a look at these four action points you should know:

1. Expect some new definitions. OCR proposes revising the definition of “person” while “adopting new definitions of ‘public health’ surveillance, investigation, or intervention, and ‘reproductive health care,’” the rule notes.

2. Get ready for a slew of prohibitions. The agency offers several Privacy Rule-related proposals devoted to “prohibiting the use and disclosure of PHI by a regulated entity,” according to the NPRM:

• When a criminal, civil, or administrative investigation into or proceeding against any person in connection with seeking, obtaining, providing, or facilitating reproductive health care, where such health care is lawful under the circumstances in which it is provided.
• Identifying the patient or provider for the purposes of investigating them.
• When reproductive healthcare takes place outside the state where the investigation was authorized, but in a state where the services are legal.
• When reproductive healthcare is mandated by EMTALA and federal law supersedes state law.
• When a patient receives reproductive healthcare in the state where it’s permitted by law and where the investigation is authorized.

Experts warn that depending on the state, the prohibitions could prove tricky, especially in a state like Idaho or Texas. “While the proposed rule largely avoids conflicting with state law by mostly limiting the prohibition to circumstances where the health care was lawful under state law, it still may place HIPAA-regulated entities between a rock and a hard place if finalized,” caution attorneys Adam H. Greene and Rebecca L. Williams with law firm Davis Wright Tremaine LLP in online legal analysis of the rule.

3. Prepare for attestations before PHI can be shared. OCR proposes requiring PHI requesters to attest that the data isn’t for a prohibited purpose before they can receive the health information.

4. Understand that the use and disclosure of PHI isn’t going away. The proposals hope to promote privacy and security, but that doesn’t mean PHI sharing will go away. “The proposed rule would continue to allow a regulated entity to use or disclose PHI for purposes otherwise permitted under the Privacy Rule where the request for PHI is not made primarily for the purpose of investigating or imposing liability on any person for the mere act of seeking, obtaining, providing, or facilitating reproductive health care,” explains an OCR fact sheet on the NPRM.

OCR is accepting comments on the proposals through June 16.

Resources: Review the NPRM and comment at www.federalregister.gov/documents/2023/04/17/2023-07517/ hipaa-privacy-rule-to-support-reproductive-health-care-privacy and read the OCR fact sheet at www.hhs.gov/hipaa/for-professionals/regulatory-initiatives/hipaa-reproductive-health-fact-sheet/index.html.