On December 10, 2020, the Office for Civil Rights (OCR) of the HHS proposed modifications to the HIPAA Standards for the Privacy of Individually Identifiable Health Information (Privacy Rule) (collectively the proposed rule). The Notice of Proposed Rulemaking, found here, was published on January 21, 2021. HHS is soliciting comments on the proposed rule until May 6, 2021.
The proposed rule was introduced as part of former HHS Deputy Secretary Eric Hargan's Regulatory Spring to Coordinated Care, which focused on reducing regulatory burdens on care coordination and also promoted the importance of value-based healthcare. Through this initiative, HHS also updated the Confidentiality of Substance Use Disorder Patient Records regulation (42 CFR Part 2) as well as Stark Law and Anti-Kickback Statute regulatory reforms.
To achieve better care coordination, the proposed rule includes the following revisions:
a. Shorten the time required for CEs to respond to individuals' request for their PHI from 30 to no later than 15 calendar days upon receipt of a request.
b. Permit individuals to control sharing of their PHI via an electronic health record among covered health care providers and health plans by requiring such providers and plans to submit an individual's access request to another provider and to receive the requested electronic copies back in the electronic health record.
c. Enhance individuals' right to inspect their PHI in person by permitting individuals to take notes or use other resources to view and capture images of their PHI, including using a mobile phone to take pictures of their PHI.
d. Clarify the form and format required to respond to individuals' request for their PHI.
e. Reduce the requirements for verifying individuals' identity when such individuals exercise their access rights.
f. Specify when electronic PHI must be provided free of charge.
g. Require CEs to display estimated fee schedules for a right-of-access request and for valid authorization disclosures on the CEs' webpages.
h. Require CEs to provide individuals, upon request, with an itemized bill for completed requests for PHI.
i. To reduce administrative burden, eliminate the requirement for CEs to obtain individuals' written acknowledgment of receipt of the CE's notice of privacy practices. Similarly, CEs will no longer need to retain copies of an individual's acknowledgment for six years.
j. To ensure that individuals understand how to access their PHI, modify the notice of privacy practices content requirements, including amending required headings.
k. To provide for disclosures to entities providing accessible services, CEs are expressly permitted to disclose PHI to telecommunications relay services communications assistants. This will ensure that individuals, CEs and business associates are able to share PHI as permitted by HIPAA without the worry of involving a telecommunications relay services assistant. Specifically, the definition of "business associate" is modified to exclude telecommunications relay services providers.
l. To better align the permitted uses and disclosures related to armed forces personnel with those of the uniformed services, CEs will be permitted to use and disclose PHI of U.S. Public Health Services Commissioned Corps and the National Oceanic and Atmospheric Administration Commissioned Corps in the same manner as those of armed forces personnel.
We are continually monitoring the proposed rule and are poised to assist you with compliance efforts when the proposed rule becomes final.
Would you like to receive our Day Pitney C.H.A.T. Newsletter? Sign up here.
Day Pitney Healthcare, Life Sciences, and Technology Counsel Damian Privitera's arrival was featured in the Law360 article "Moses & Singer Healthcare Atty Joins Day Pitney in Hartford."
Day Pitney Healthcare Partner Magda Rodriguez authored the article "When Physician Retirement Arrangements May Be Legal" for Law360.
Day Pitney Cybersecurity, Healthcare and Technology (C.H.A.T.) Newsletter – February 2024
Day Pitney Cybersecurity, Healthcare and Technology (C.H.A.T.) Newsletter – February 2024
Day Pitney Artificial Intelligence Committee Chair Kritika Bharadwaj and Healthcare and Technology Associate Colton Kopcik authored the article "Generative AI in Health Care: Diagnosing the Legal Landscape for Dr. GenAI" for the New York Law Journal's Legal Technology Special Section.
Day Pitney Alert
Day Pitney Miami Healthcare Partner Magda Rodriguez was recently featured in a Q&A with her alma mater, Gulliver Prep's, alum newsletter.
Day Pitney Cybersecurity, Healthcare and Technology (C.H.A.T.) Newsletter – December 2023
Day Pitney Cybersecurity, Healthcare and Technology (C.H.A.T.) Newsletter – December 2023
Copyright © 2024 Day Pitney LLP, all rights reserved.