Changes proposed to HIPAA rules
Less paperwork and hassle predicted
Proposed changes to the Health Insurance Portability and Accountability Act (HIPAA) of 1996 will remove roadblocks to delivering good patient care and operating hospitals efficiently, says Dick Davidson, president of the Chicago-based American Hospital Association. Davidson was author of an editorial in the March 26 USA Today. Under the changes, patients will continue to receive a comprehensive notice of their privacy rights in a 10-plus-page document, Davidson said, and patients will be asked to simply acknowledge that they received this notice. "We believe this approach will accomplish the same goal, and we’re not alone," he wrote in the editorial.
The proposal retains patient rights but results in less paperwork, Davidson says. "The result: better access to care and less paperwork for everyone," he says. "That’s a goal patients and providers can all support."
The rule was published in the March 27 Federal Register. The American Hospital Association highlights these proposed changes:
• Notice provisions are strengthened, and consent requirements are removed. The proposal removes the consent requirement for treatment, payment, and health care operations. It strengthens requirements for providers to notify patients about their privacy rights and practices. Patients would be asked to acknowledge the privacy notice; if they don’t acknowledge it, they still can be treated.
• The "minimum necessary" rule is maintained, but allows treatment-related conversations. The proposed changes continue to cover oral communication and limit the use of personal health information to the "minimum necessary." However, they make it clear that doctors could discuss a patient’s treatment with other professionals involved in their care. Providers are expected to take reasonable safeguard to protect personal health information. As long as they do that and follow the "minimum necessary" rule, then incidental disclosures, such as another patient hearing a small part of a conversation, would not be penalized. Improper disclosures would still violate the rule.
• Providers follow state law concerning appropriate parental access to their children’s records. The proposal clarifies that state law governs disclosure to parents. If the state law is silent or unclear, the revisions permit a provider to use discretion to provide or deny a parent access to the records, as long as that decision is consistent with state or other law.
• Records can’t be used for marketing, but appropriate communications are allowed. The proposal explicitly requires providers to first obtain the individuals specific authorization before sending them marketing materials. The proposal continues to allow doctors and others to communicate freely with patients with health-related information, including disease-management programs.
• Privacy is ensured, without blocking research. The proposal eliminates the need for researchers to use multiple consent forms, such as one for informed consent to the research and one or more related to information privacy rights. Researchers can use a single form for both. The proposal doesn’t modify the list of patient identifiable information that can be used for research, but officials with the Department of Health and Human Services say they will strongly consider comments before issuing the final rule. Davidson has predicted that the rule will change.
• Model business associate provisions are used. The existing rule requires providers to have contracts with their business associates to ensure they will follow the privacy rule’s requirements. The proposal includes model business associate contract provisions, which would make it easier and less costly for providers. The changes also would give providers up to an additional year to change existing contracts, which means all contracts don’t have to be renegotiated at one time.
• Authorizations are simplified. The proposal allows a single type of authorization form to obtain a patient’s permission for a specific use or disclosure that otherwise wouldn’t be permitted. Patients still need to give permission in advance each time; however, the proposal eliminates the requirement for different types of forms.
Most providers have until April 14, 2003 to comply. Certain small health plans have until April 14, 2004, to comply.
You have reached your article limit for the month. Subscribe now to access this article plus other member-only content.
- Award-winning Medical Content
- Latest Advances & Development in Medicine
- Unbiased Content