New HIPAA Proposals Affect Current Privacy Laws

Under a newly proposed rule by the U.S. Department of Health and Human Services, patients would have the right to get a report on who has electronically accessed their personal health information. 

The proposed change to the current Health Insurance Portability and Accountability (HIPAA) Act privacy rule was announced by HHS on May 31 and is open for public comment through August 1.

The HHS Office of Civil Rights is proposing the changes to the privacy rule in accordance with the Health Information Technology for Economic and Clinical Health (HITECH) Act, part of the American Recovery and Reinvestment Act of 2009. The Office of Civil Rights says the proposal is an effort to "safeguard private health information.”

Under current HIPAA law, insurers and healthcare providers are required to track access to protected electronic health information, but they are not mandated to share this information with people.

"We need to protect peoples’ rights so that they know how their health information has been used or disclosed,” OCR Director Georgina Verdugo said in a statement.

The second change HHS has proposed would give individuals the right to obtain a hard-copy or electronic version of detailed accounting of certain health information disclosures that could affect an individual, such as treatment, payment and healthcare operations. This report would cover a three-year period.

The proposed rule change takes effect January 1, 2013.

These two proposals – the right to an access report and to an accounting of disclosures report – would be separate but complementary, according to the 24-page proposed rule change (a PDF version can be found here: http://www.regulations.gov/#!documentDetail;D=HHS-OCR-2011-0011-0001).

"We believe that these two rights, in conjunction, would provide individuals with greater transparency regarding the use and disclosure of their information,” according to the HHS proposed rule change.

In May 2010, HHS published a request for information seeking comments on health information disclosures and the potential burden to health providers and insurers to provide these reports to patients who ask for them. The agency received about 170 comments from numerous organizations representing health plans, healthcare providers, privacy advocates, and other healthcare entities.

More than 80 respondents indicated that providing an accounting report of treatment, payment and healthcare operations disclosures to patients would provide little to no benefit to individuals. More than 120 respondents said providing such information to patients would mean healthcare providers, insurers and other parties would incur substantial administrative, staffing and monetary burdens.

The HIPAA guidelines were adopted in 1996 to provide a set of national standards to protect the privacy and security of personal health information.

Those interested can submit comments to the proposed rule changes at http://www.regulations.gov (search for Proposed Rule).

HHS will post all comments received before the close of the comment period at the same website address. Since comments will be public, HHS asks that individuals do not include any personal information in their feedback.