HHS Proposes Access Report for Patients: Proposed changes to HIPAA Privacy Rule

The Department of Health and Human Services (HHS) is now reviewing comments from healthcare industry participants about its proposed rule to modify the standard for accounting of PHI disclosures under the HIPAA Privacy Rule.  HHS has proposed revising the Privacy Rule by dividing it into two separate rights for individuals: the right to an access report of disclosures through electronic medical records; and the right to an accounting.

Under the Proposed Rule, covered entities would now be required to provide individuals with an “access report,” identifying all persons who have accessed an individual’s electronic “designated record set” information. The designated record set is the group of records maintained by or for a covered entity that is either (1) used, in whole or part, to make decisions about individuals; (2) a provider’s medical and billing records; or (3) enrollment, payment, claims, adjudication, and case or medical management record systems maintained by or for a health plan. This new access report applies only to electronic records and is intended in part, to fulfill a requirement established by the Health Information Technology for Economic and Clinical Health Act (HITECH) to provide individuals with information about disclosures of their PHI to carry out treatment, payment and health care operations if such disclosures are through an electronic health record.

Distinct from, but complementary to the access report is the proposed right to an accounting.  While the access report would provide information on who has accessed the individual’s electronic PHI, the accounting would provide additional information about the disclosure of the “designated record set” information to persons outside the covered entity and its business associates for certain purposes, such as law enforcement, or public health investigations.  The purpose of the access report is to allow individuals to learn if specific persons have accessed the individual’s electronic designated record set information.  The accounting disclosure, on the other hand is intended to provide more detailed information for certain disclosures that are most likely to impact the individual.

The deadline for submitting a comment to be considered by HHS was August 1, 2011.  The Final Rule will be published after HHS has reviewed, analyzed and if necessary responded to the comments, which can be viewed at:

http://www.regulations.gov/#!docketDetail;dct=PR+N+O+SR+PS;rpp=10;so=ASC;sb=postedDate;po=0;D=HHS-OCR-2011-0011.

 Christine Salimbene, Vice President & General Counsel

Ms. Salimbene joined MTBC in 2009 as General Counsel, Vice President and Company Secretary. She and her team focus on mitigating business risk and ensuring compliance with all legal requirements.