Dykema Gossett PLLC

Homeostasis: Health Care Law Blog

If You Have Suggestions for Improving the HIPAA Privacy or Security Rule, Now Is the Time to Speak Up


If You Have Suggestions for Improving the HIPAA Privacy or Security Rule, Now Is the Time to Speak Up

Authored by Joanne Lax (retired Member of Dykema)

On December 14, 2018, the U.S. Department of Health and Human Services’ Office for Civil Rights (OCR) published a Request for Information (RFI) about ways to modify the HIPAA Privacy and Security Rules[1] to promote the transition of the health care industry to a value-based Medicare payment model and improve care coordination for patients. See “Request for Information on Modifying HIPAA Rules to Improve Coordinated Care,” 83 FR 64302 Page:64302-64310. OCR will accept responses to the RFI until February 12, 2019.

OCR seeks information about four broad topics, but also welcomes information about other aspects of the HIPAA Privacy and Security Rules that may have proven burdensome or ineffective for HIPAA Covered Entities (e.g. health care providers that transmit data electronically in connection with a HIPAA standard financial or administrative transaction, health plans, and health care clearinghouses). The specific topics are:

  • Promoting information sharing for treatment and care coordination and/or case management by amending the Privacy Rule to encourage, incentivize, or require covered entities to disclose PHI to other covered entities. OCR is interested in industry experience with the individual’s right of access, the minimum necessary rule, the role of health care clearinghouses and other business associates in information sharing, and whether information sharing should extend to social services agencies assisting patients in addressing the social determinants of health.
  • Encouraging covered entities, particularly providers, to share treatment information with parents of minor children and with parents, loved ones and caregivers of adults facing health emergencies, particularly opioid use disorder and serious mental illness.
  • Implementing the HITECH Act requirement to account for disclosures for treatment, payment, and health care operations from an electronic health record. OCR is particularly interested in the capacity of EHRs to produce this information, what information would be useful to patients, and what the role of business associates should be in generating these accountings. OCR seeks to avoid the burdens upon the industry contained in its 2010 Notice of Proposed Rulemaking on this subject, which it now officially withdraws.
  • Eliminating or modifying the requirement for covered health care providers to make a good faith effort to obtain individuals’ written acknowledgment of receipt of providers’ Notice of Privacy Practices (NPP). OCR additionally seeks information about the content and utility of the NPP, including its model NPP.

One area that HIPAA Covered Entities may wish to raise with OCR is pre-emption of state law. As currently structured, HIPAA establishes a minimum floor of privacy protection, but states can enforce stricter standards. It is often difficult to determine whether a state privacy law or HIPAA controls. This is a particular problem with mental health, HIV/AIDs, and genetic information which often receives heightened protection via state laws. OCR could significantly decrease the burden on Covered Entities by clarifying pre-emption in a more robust way than is presently available in its regulations or secondary guidance.

Whatever your concerns about the HIPAA Privacy or Security Rule, do not miss your chance to make them known to OCR. They appear ready to entertain all suggestions to reduce burden while still protecting individual privacy and security.

To sign up for Dykema’s Health Care Blog e-mail updates, please click here.

[1] 45 CFR Parts 160 and Part 164 subparts C and E.

Joanne R. Lax is a retired member of Dykema. Her career with Dykema’s Health Care Practice Group spanned 40 years, starting in 1978. Her areas of concentration included post-acute and long-term care, behavioral health, clinical ethics, data privacy/HIPAA, and assisted reproductive technology. Joanne presently serves on the Board of Directors of the American Health Lawyers Association (term expected to end in 2021), after serving for nine years as Chair and Vice Chair of AHLA’s Post-Acute and Long-Term Care Practice Group. She also served as Chair of the State Bar of Michigan’s Health Care Law Section. During her career, Joanne earned many honors and awards, including designation as a Super Lawyer, designation as a Best Lawyer and Best Lawyer’s Lawyer of the Year for health care in Detroit in 2012, Fellow of the State Bar of Michigan Health Care Law Section, and designation as a Leading Lawyer. In her retirement, Joanne is a guest blogger for Homeostasis.