HITECH Act requires use of EHRs as tools to inform about disclosures under Privacy Rule.
Health care organizations and providers thought they dodged a bullet long ago when they convinced HHS to exclude disclosures of patient data used in the process of treatment and payments from the HIPAA privacy rules. But now, thanks to the HITECH Act, HHS is back, wondering what would be so terrible about requiring an accounting of such disclosures now.
Through a request for information issued in early May titled HIPAA Privacy Rule Accounting of Disclosures Under the Health Information Technology for Economic and Clinical Health Act (75 Fed Reg 23214 May 3, 2010), the HHS Office for Civil Rights says it expects to learn more about the interests of individuals, and the administrative burden on covered entities as well as business associates, concerning accounting for such disclosures.
Under current standards of the HIPAA Privacy Rule, an individual has the right to receive a listing – known as an accounting of disclosures — that explains when a HIPAA covered entity discloses the individual’s information to others. The current rule, however, does not require a covered entity to list disclosures to carry out treatment, payment, and health care operations.
The HITECH Act of 2009 upgrades the current rule by providing an individual a right to receive information about disclosures made through a covered entity’s use of electronic health records for purposes of carrying out treatment, payment, and health care operations. To do this, the covered entity must have the capacity to track, store and compile a vast amount of information regarding EHRs.
Specifically, the OCR’s RFI seeks comments from health consumers and health care providers/organizations concerning:
- What are the benefits to the individual of an accounting of disclosures made for treatment, payment, and health care operations purposes?
- If you are a covered entity, how do you make clear to individuals their right to receive an accounting of disclosures? How many requests for an accounting have you received from individuals?
- What is the feasibility of an EHR module that is exclusively dedicated to accounting for disclosures (both disclosures that must be tracked for the purpose of accounting under the current HIPAA Privacy Rule and disclosures to carry out treatment, payment, and health care operations)? Would such a module work with covered entities that maintain decentralized EHR systems?
After reviewing comments from the RFI, HHS is expected to issue a Notice of Public Rulemaking on the new accounting for disclosures regulations with a 60-day comment period, according to the law firm McDermott Will & Emery. Final rules will follow thereafter.
There is money to be given out to medical practices for using EMRs. AUDIO: Medical Coding 101: The Need-to-Know for CEOs.