Proposed HHS changes for the privacy rule
The move to eliminate patient consent is generating a lot of controversy, but it was not the only change to the federal privacy regulation proposed by the Department of Health and Human Services (HHS). The proposal would make the following revisions:
• Strengthen notice provisions and remove consent requirements hindering access to care. This change would ensure that patients can consider a provider’s privacy policies before making health care decisions, but would eliminate barriers to patients’ access to care.
• Maintain the "minimum necessary" rule, while allowing treatment-related conversations. As long as a covered entity met the minimum necessary standards and took reasonable safeguards to protect personal health information, incidental disclosures — such as another patient hearing a snippet of conversation — would not be subject to penalties.
• Assure appropriate parental access to their children’s records.
• Prohibit use of records for marketing, while allowing appropriate communications. The proposal would explicitly require covered entities to first obtain specific authorization before sending a patient any marketing materials. At the same time, the proposal would permit doctors and other covered entities to communicate freely with patients about treatment options and other health-related information, including disease-management programs.
The proposal also would make other revisions to simplify the rule’s paperwork requirements. It would, for example:
• Assure privacy, without impeding research.
The proposal would eliminate the need for researchers to use multiple consent forms — one for informed consent to the research and one or more related to information privacy rights.
• Provide model business associate provisions. The changes also would give covered entities up to an additional year to change existing contracts, easing the burden of renegotiating contracts all at once.
• Simplify authorizations. The changes would allow the use of a single type of authorization form to obtain a patient’s permission for a specific use or disclosure that otherwise would not be permitted under the rule.
HHS published information about these proposed changes along with comments and other public input used to develop them in the March 27 Federal Register. After reviewing comments from the 30-day comment period, HHS plans to issue a final rule. As it stands now, most covered entities have until April 14, 2003, to comply with the patient privacy rule. The American Pharmaceutical Association (APhA) in Washington, DC, however, has requested that the implementation date be changed.
"You should have a certain period of time to implement the regulations. It is hard to implement them if they are not final," says Susan C. Winckler, RPh, JD, APhA’s group director of policy and advocacy. They should be coordinated and implemented with federal security standards, as well, she adds.
You have reached your article limit for the month. Subscribe now to access this article plus other member-only content.
- Award-winning Medical Content
- Latest Advances & Development in Medicine
- Unbiased Content