HHS announces proposed changes to HIPAA Privacy Rule

The U.S. Department of Health and Human Services’ (HHS) Office for Civil Rights (OCR) is proposing changes to HIPAA privacy rules.

This proposed rule represents an important step in our continued efforts to promote accountability across the health care system, ensuring that providers properly safeguard private health information. We need to protect peoples’ rights so that they know how their health information has been used or disclosed.

While covered entities are currently required to track electronic accesses of health care records, they are not currently required to provide a report upon request. There is some odd wording in the announcement from HHS  as it uses people instead of patients or guardians, “People would obtain this information by requesting an access report, which would document the particular persons who electronically accessed and viewed their protected health information.”  It is unclear after reading the rule, which “people” will be allowed to request and review this information.

The rule is also conflicting on which type of health record access is reportable. While the announcement and early clauses discuss electronic access to electronic records, this clause mentions hard copy.

The right to an accounting of disclosures would encompass disclosures of both hard copy and electronic protected health information that is maintained in a designated record set. It would cover a three-year period, and would require a covered entity and its business associates to account for the disclosures of protected health information that we believe are of most interest to individuals.

This could complicate an earlier premise in the rule that it would be of low-impact to involved entities.

We believe that these changes to the accounting requirements will provide information of value to individuals while placing a reasonable burden on covered entities and business associates.

The full proposed rule can be viewed at https://www.federalregister.gov/articles/2011/05/31/2011-13297/hipaa-privacy-rule-accounting-of-disclosures-under-the-health-information-technology-for-economic#p-3.