HIPAA New Omnibus Rule Impacts Patient Data Privacy, Security

Sara Koliner, Policy Analysis Project Assistant, Project HealthDesign National Program Office

Last week, Bloomberg BNA’s Health IT Law & Industry report provided an insightful overview of the new Omnibus Rule issued by the Department of Health and Human Services to modify HIPAA. This final rule, created in response to the Health Information for Economic and Clinical Health (HITECH) Act, finalizes proposed rule changes regarding privacy, security, and breach notification requirements. While we encourage you to read the entire report, we would like to specifically highlight the rule’s modifications to individuals’ electronic access to their medical records.

As Project HealthDesign legal and policy consultant Robert Belfort et al. explain in their summary for Bloomberg BNA, this particular rule builds on the “right to an electronic copy on any PHI [Protected Health Information] maintained in an EHR” outlined in the HITECH Act. The limitation of the prior requirement to Electronic Health Records left a wide range of protected, electronically-maintained health information unaccounted for, creating a potential for disparate access requirements between EHRs and otherwise. The Omnibus Rule extends the right to an electronic copy to “all protected health information maintained in one or more designated record sets electronically, regardless of whether the designated record set is an EHR.” Should a copy of this information not be readily producible, it should be provided in a standard digital form (such as a .txt, .pdf, or .doc file).

Allowable fees are also identified. Covered entities will be able to charge a “reasonable, cost-based fee” for costs involved with the providing the service, such as supplies (such as a CD), labor, and postage, if necessary.  To clarify, “labor” would not include the cost of retrieval, and costs associated with the digital infrastructure or system maintenance would not be permissible.

Perhaps the most beneficial modification to consumers is the removal of the 60 day window within which requested health information maintained off-site must be delivered. Now, covered entities must respond to all requests within 30 days (maintaining the possibility of a one-time 30 day extension if necessary). Especially when technology has advanced to the point of near-instantaneous information delivery, this amendment incentivizes healthcare providers to meet the demands of the modern consumer. Furthermore, increasing the timeliness of health data delivery will significantly improve patient engagement, paving the way for information to flow more readily in both directions.

Aside from some exemptions, the Omnibus Rule requires compliance by September 23, 2013. Increasing the convenience and ease of access to protected health information is an important step in encouraging use among patients. We are happy to see HHS making strides in this direction.

 

Read more posts about legal and policy issues

ONC Releases Draft Health IT Action and Surveillance Plan

Robert D. Belfort,  Manatt, Phelps & Phillips, LLP, Proje­ct HealthDesign Regulatory and Assurance Advisory Group

Just before the holidays, on December 21, 2012, the Office of the National Coordinator for Health IT (ONC) released its draft “Health IT Patient Safety Action and Surveillance Plan.”  ONC released the Plan in response to a November 2011 Institute of Medicine (IOM) report called, “Health IT and Patient Safety, Building Safer Systems for Better Care.” I wrote a blog about the IOM’s report, which you can read here.

IOM released its November 2011 report in response to a request by ONC for recommendations about what a comprehensive health IT safety policy should look like.  Among other recommendations, IOM suggested that the federal government create a new independent watchdog agency, along the lines of the National Transportation Safety Board, to accept reports on patient deaths, serious injuries or potentially unsafe conditions associated with health IT. 

ONC stopped short of taking the IOM’s recommendation.  Instead, in its draft Plan, ONC proposed to leverage existing federal agencies’ authorities and private sector safety programs to increase knowledge about health IT safety among health care professionals and improve how health IT makes care safer.  The draft Plan prescribes a list of actions that are organized under three strategies:  (i) Learn: increase the quantity and quality of data and knowledge about health IT safety; (ii) Improve: target resources and corrective actions to improve health IT safety and patient safety; (iii) Lead: promote a culture of safety related to health IT.

Below are some highlights from the draft Plan:

• ONC will work with developers on a code of conduct that commits developers to (i) work with Patient Safety Organizations or similar entities to report, aggregate, and analyze health IT-related safety events; (ii) support providers in reporting safety events; and (iii) collaborate with private sector efforts to make comparative user experience with different EHR systems more available.
• ONC will leverage ONC-ACB surveillance and live testing to ensure EHR safety features are functional in live environments and that developers address safety complaints.  ONC will continue to incorporate safety into its standards and certification criteria.
• ONC will monitor health IT adverse event reports to the FDA’s Manufacturer and User Facility Device Experience (MAUDE) database.
• The Agency for Healthcare Research and Quality (AHRQ) and ONC will work with providers and PSOs to incorporate AHRQ Common Formats into providers’ health IT and reporting systems. AHRQ Common Formats allow for easy, real-time reporting and aggregation of patient safety events and risks.
• AHRQ, in collaboration with ONC, will work with PSOs, providers, and developers to add a focus of health IT to their collection, aggregation, analysis, and mitigation of providers’ adverse event reports. AHRQ will also provide guidance to PSOs on how they can work with providers to use health IT to improve reporting and mitigate health IT risks.
• The Centers for Medicare & Medicaid Services will align its safety standards for health care facilities, its interpretive guidance, and surveyor trainings to add a focus on health IT and patient safety.

Reactions to ONC’s proposed Plan are only beginning to trickle in.  Some stakeholders are suggesting it doesn’t go far enough while others are calling the proposal a necessary step in the right direction.  We thought it was interesting that, while the IOM’s report included an entire chapter devoted to the safety of health IT tools “designed to engage and support patients in health-related decision making and management of their own personal health information” (see chapter 5 “Patients and Families Use of Health IT: Concerns about Safety”), ONC’s proposed Plan includes no such references.  The IOM report specifically noted patients’ ability to use personal health records (PHRs) and other tools to record and share “activities of daily living.” It did not offer up a silver bullet for avoiding patient safety risks created by PHRs and other patient engagement tools but it noted that one important way to ensure patient safety is for health care providers to manage patient expectations about how information they include in a PHR or other patient engagement tool will be used. According to IOM, health professionals, patients and their families need to develop “a shared understanding of appropriate use of patient-centered, validated data.”

Do you think that ONC’s proposed Plan should include more of a focus on the unique patient safety challenges associated with PHRs and other health IT tools that enable patients to generate and share health information?  You have until February 4th to provide public comments, which can be submitted to [email protected].

You can read the draft Patient Safety Plan here:  http://www.healthit.gov/sites/default/files/safetyplanhhspubliccomment.pdf

 

Read more posts about legal and policy issues

Drawing from within: Implantable devices yield new types of patient generated data [Video]

Project HealthDesign National Program Office

We are in the final six-month stretch of Project HealthDesign, and we’re trying to share some of our project’s most relevant and dynamic findings with respect to patient-generated data. We learned through our recent grantees’ research that familiar consumer electronic devices, like cell phones and tablets, can help patients capture observations of daily living and personal insights, and allow them to easily share these data with their clinicians. 

There’s another type of patient-generated data out there. We’ve learned from conversations with people whose health lives depend on implantable devices like cardiac defibrillators and insulin pumps, that data derived from these devices  provide important information not only about how the device is performing but also about the patient’s health state.  It is timely to figure out how to make data acquired through such implantable devices accessible and useful to patients as well as clinicians and researchers. 

In this video, Patricia Flatley Brennan offers some compelling thoughts about the need to imagine and harness this novel patient-device data to make sure it serves the ultimate health interest of patients.  Device makers and federal bodies who regulate these devices should pay particular attention. While watching this video, keep these questions in mind:  How can we ensure that patient-device data are 1) understandable to and accessible by both patients and clinicians; 2) completely secure from disruption and tampering, and 3) regulated carefully and fittingly? 

Project HealthDesign wants your input on this important matter. If you have thoughts, suggestions, ideas about all types of patient-generated data, post your comments below or send them to [email protected]