HHS Proposes HIPAA Modifications to Better Serve Patients

On December 10, 2020, the Office of Civil Rights (“OCR”) at the Department of Health and Human Services (“HHS”) announced a proposal to modify the Health Insurance Portability and Accountability Act (“HIPAA”) Privacy Rule. The overarching goal of the proposed rule is to get patients more engaged in their own healthcare, provide easier access to coordinated care, and reduce the burdensome regulations that have an impact on quality of care. HHS has recently rolled out a Regulatory Sprint to Coordinated Care, and the proposed modifications to the HIPAA rule support this measure.

The Regulatory Sprint facilitated a nationwide transformation to value-based care. The public had determined that there were far too many regulatory burdens to have sufficient coordinated care, which made it difficult for patients to have high quality value-based care. In response to this feedback, CMS proposed changes to the Anti-Kickback Statute, Civil Monetary Penalty rules, and the Physician Self-Referral Regulations. As such, the HIPAA rule was the next regulatory burden that needed to be addressed to further the Regulatory Sprint.

For a complete list of the proposed changes to the HIPAA rule, please see the HHS notice. Here are some highlights:

• Defining: Electronic Health Record, personal health application, and health care operations.
• Right to access changes: (1) stronger ability for a patient to inspect their Personal Health Information (“PHI”) in person; (2) shortening covered entities’ response time from 30 days to 15 days; (3) clarifying PHI request format; (4) requiring covered entities to notify patients that they still have a right to obtain full PHI if only a summary is offered; (5) better pathways for sharing PHI through EHR to various health care providers; (6) specifying when electronic PHI must be provided to the patient for free; and (7) requiring entities to post fee schedules on their websites for PHI requests. These are just a few among a variety of other right to access changes.
• An exception to the minimum necessary standard so covered entities can provide more coordinated care.
• Replacing the “professional judgment” use and disclosure standard to now have a “good faith” standard. It will now be a presumption that a covered entity acted in good faith—this presumption can be overcome with a showing of bad faith.
• Expanding the ability of covered entities to disclose PHI if there is a “serious and reasonably foreseeable” threat to health or safety of a patient.

HHS asks that stakeholders, patients, covered entities, and business associates comment on the proposed changes. Public commenting will close 60 days after this proposal is published in the Federal Register.

For over 35 years, Wachler & Associates has represented healthcare providers and suppliers nationwide in a variety of health law matters, and our attorneys can assist providers and suppliers in understanding new proposed regulations. If you or your healthcare entity has any questions pertaining to healthcare compliance, please contact an experienced healthcare attorney  at 248-544-0888 or wapc@wachler.com.