|
Privacy Rules Update
By Practice Performance Partners (PPP)
As expected, 2025 will bring about massive changes in the HIPAA Privacy and Security Rules. All of these changes are nearing the end of the comment period and will almost certainly need to be implemented by the end of 2025. There are moderate changes to the privacy standards and very significant changes in the security standards. In Part One, we will cover the changes to the Privacy Rules.
MEDICAL RECORD ACCESS
Most changes to HIPAA over the past decade have been attempts to strengthen regulations ensuring transparency and access to medical records. The current changes also include a landmark rule creating a special protected health information (PHI) class with additional privacy for certain restricted information.
• Failure to provide rapid access to medical records is one of the most common HIPAA complaints against optometrists. The new rule sets the timeline for record requests at 15 days, overriding any state law with a longer allowed period. PPP recommends you strive for immediate access whenever possible. Electronic medical records take little to no effort to release and delaying information is only an inconvenience to the patient. Release of records to a patient may occur ONLY through encrypted email, encrypted text, patient portals or live. You can still obtain individual authorization from each patient to release their records through unsecured channels, but this option is complex and fraught with additional recordkeeping issues.
• Release of records directly to the patient or their designee does not require signed patient authorization and is actually discouraged by HHS. While always an assumed policy, the new rule finally clarifies this issue.
• Covered entities must ensure that patients and individuals or entities designated by the patient may obtain full access to their medical records at no charge. There are no stated exceptions to this rule change.
• Patients may view their medical records, take notes and capture images on their personal devices (specifically smartphones). This includes diagnostic test results. You may still limit this to a scheduled time when there can be staff oversight.
• More latitude for medical records release for military personnel. Several times, clients have asked if they can release medical information to military superiors without authorization from the patient. The past rules implied that formal acknowledgment was not necessary, but the new rules clarify that patient acknowledgment is not required.
The Department of Health & Human Services (HHS) is also reviewing potential changes that will provide even more ability for the patient to direct when and how they want their medical information shared. These changes are expected to be accompanied by the implementation of the 24/7 record access requirement. PPP will keep you updated as these rules are implemented.
PROTECTED INFORMATION CLASSES
HHS has designated new data types that have more restricted access. This is stated by HHS to be due to changes in our current socio-political climate.
• Any care related to Substance Use Disorders (SUD) is now fully protected as PHI. An interesting HIPAA twist, but before this rule change, SUD information was not included in the HIPAA data set. Current or past SUD is now considered part of the medical record and falls under all the protection and release rules of other PHI.
• Reproductive Health Information (RHI), including all procedures, contraceptive use and related treatments, is now considered a separate data classification (unique PHI). The standard exclusion of certain privacy rules related to treatment, payment and operations (TPO) no longer apply to RHI. This is only the second time specific health care information requires more complex protection and release rules (the other being mental health records). Under the new rules, any information related to reproductive health history or decisions may not be released to courts or officers of the law. Additionally, such PHI should not be included in a standard medical release unless the provider determines that the inclusion of such data is necessary for the continuation or coordination of care for the patient. How much leniency a provider has in making this determination is vague. To be safe, we recommended that providers obtain a signed release specific to reproductive health data whenever the medical record includes such information. You may also simply remove the information from the record. Another consideration is the necessity of including any RHI in the patient’s medical history. Unless such information is essential to the care of the patient, simply not collecting such data solves all of the complications related to this new rule.
PPP has already made changes to some of the privacy information and rules in the HIPAA package but will add more over the year as the comments and interpretation of the new rules potentially become clearer.
Questions on the new privacy rules can be directed to info@practiceperformancepartners.com.
|