HIPAA Regulatory Alert: HHS outlines major changes in privacy
The Department of Health and Human Services (HHS) has said for months that HIPAA would continue to be a work in progress. The agency proved that again last month when it added a new section to the guidance on public health disclosures and another on workers’ compensation disclosures. In addition, HHS updated and expanded the guidance with regard to research. These areas shared a common theme, namely that disclosures are permissible in these areas, says Sue McAndrew, senior advisor for HIPAA privacy policy in HHS’ Office of Civil Rights.
According to McAndrew, HHS heard from many varied sources that the final rule threatened the flow of information. She says the agency wanted to use the guidance to assure people that it is permissible to disclose information for public health purposes as well as workers’ compensation purposes.
According to McAndrew, it also is important to cooperate with researchers to keep those activities moving forward. She says there were a number of questions regarding research, and some of them have been addressed in the guidance. For example, the guidance addresses recruitment policies and how the privacy rule may affect recruitment for these studies.
The guidance also addresses questions about ongoing research where consent had been obtained prior to the implementation date. "Those types of research projects will be grandfathered in based on the consent that was received prior to the compliance date," she reports.
HHS makes more changes
Here are several other areas where HHS recently has made significant changes:
• Marketing. The definition of marketing is one of the areas that was changed substantially in the modifications, according to McAndrew. If a third party is paying to obtain a list of patients for its own marketing efforts, that clearly is marketing, she says. With limited exceptions, all marketing will require an authorization, she adds.
In addition, CMS has tried to clarify both in the rule and in the guidance material what kind of communications do not constitute marketing. For example, McAndrew says that communications with individuals regarding their own health-related products and services have been expressly carved out. "It is not marketing when they are communicating about their own health-related products or services," she says.
Other carve-outs pertain to communications related to the individual’s treatment or care coordination, case management, or alternative therapy recommended to the individual. "All these types of communications can go on freely," she says. "That is not marketing."
• Incidental uses and disclosures. Another area that was modified is incidental uses and disclo-sures. "Clearly, these are permissible provided that they are incidental to another permitted use or disclosure," says McAndrew. This issue arises in many treatment settings where the patient may be in a semiprivate room and the conversation between a patient and a physician may be overheard by other patients or visitors. Likewise, physicians and nurses might confer at areas of the hospital where others could potentially overhear the conversation.
• Business associates. Another area that was the focus of many questions that resulted in the guidance being expanded is business associates. HHS expanded the guidance to try to address more situations where a business associate contract would be required, says McAndrew. The agency also provided some examples of instances where a business associate arrangement would not be necessary.
The Department of Health and Human Services (HHS) has said for months that HIPAA would continue to be a work in progress. The agency proved that again last month when it added a new section to the guidance on public health disclosures and another on workers compensation disclosures.You have reached your article limit for the month. Subscribe now to access this article plus other member-only content.
- Award-winning Medical Content
- Latest Advances & Development in Medicine
- Unbiased Content