HHS proposes greater flexibility for providers in sharing patient information under HIPAA

The Office for Civil Rights with the Department of Health and Human Services today issued a Notice of Proposed Rulemaking to create changes to the Health Insurance Portability and Accountability Act Privacy Rule.

The changes would empower patients to be more engaged in their care, remove barriers to coordinated care and reduce regulatory burdens to the industry at large, HHS said in its announcement.

OCR is accepting comments from all stakeholders on the proposed rule, which will be due 60 days after its publication in the Federal Register.

WHAT'S THE IMPACT

The rule itself would add definitions to terms like "electronic health record" and "personal health application."

It would modify an individual's right to access their personal health information by shortening providers' response time from 30 days to 15 days.

The rule updates when covered entities may share or use patient health information. It changes the current requirement to use "professional judgment," to now allow for sharing based on their "good faith" that it's in the best interest of the patient.

This would also update the rule that covered entities may share patient health information when harm is "serious and imminent," to when a threat to health or safety is  "serious and reasonably foreseeable."

It works to improve care coordination by clarifying the scope of when a covered entity may share patient health information with social services agencies, community-based organizations, home and community-based service providers and other similar third parties.

Under the new rule, providers would be required to post estimated fee schedules on their websites for access and for disclosures of individuals' personal health information. If there are no labor fees associated with moving a patient record, such as in the case of electronic records, the rule specifies that they must be provided at no charge.

It would also help to facilitate greater family and caregiver involvement in the care of individuals experiencing emergencies or health crises.

If the rule is finalized, the agency estimates an overall net cost savings of $3.2 billion over five years.

THE LARGER TREND

By the time that the rule would take effect, President-elect Joe Biden will have already taken office. Officials are confident that the rule will be finalized regardless of the administration and during a press call on Thursday, Deputy Secretary of HHS Eric Hargan called the rule specifics "bipartisan" and "common-sense reforms."

This proposed rule follows past rules that work to empower patients' engagement in their healthcare while reducing provider burden.

In March of this year, the Office of the National Coordinator for Health Information Technology issued new interoperability rules that prevent information-blocking practices and anti-competitive behaviors by healthcare providers, developers of certified health IT products, health information exchanges and other information networks.

Because of the pandemic and the stress it put on providers and payers trying to meet the required deadline, ONC pushed the date back to April 5, 2021.

The other rule that was recently finalized is the Physician Self-Referral Law, also known as the Stark Law, which prohibited a physician from sending a patient for many types of services to a provider that the physician-owned, was employed by, or otherwise received payment from.

ON THE RECORD

"Our proposed changes to the HIPAA Privacy Rule will break down barriers that have stood in the way of commonsense care coordination and value-based arrangements for far too long," said HHS Secretary Alex Azar. "As part of our broader efforts to reform regulations that impede care coordination, these proposed reforms will reduce burdens on providers and empower patients and their families to secure better health."

Twitter: @HackettMallory
Email the writer: mhackett@himss.org