Civil rights office seeks review of privacy rule

The Office for Civil Rights at HHS has sent to the White House Office of Management and Budget for review a new privacy rule covering an expanded requirement that healthcare providers track and be able to report to patients any disclosures of their medical records.

Patients have long had limited rights under the privacy provisions of the Health Insurance Portability and Accountability Act of 1996 to demand that providers and other “covered entities” provide them with an accounting of disclosures of their personally identifiable medical information.

Patients have long had limited rights under the privacy provisions of the Health Insurance Portability and Accountability Act of 1996 to demand that providers and other “covered entities” provide them with an accounting of disclosures of their personally identifiable medical information.

The American Recovery and Reinvestment Act of 2009, however, expanded patients' privacy rights and closed a HIPAA exemption that covered entities were not required to audit and account for disclosures for treatment, payment and a broad, catch-all category known as other “healthcare operations,” if the covered entity uses an electronic health-record system. The ARRA eliminated that exemption and the new rule before the OMB provides language to implement the rule change. Patients can demand an accounting of disclosures going back three years from the date the demand is made. The accounting requirement also applies to business associates of covered entities.

In a May 3, 2010, request for public comment on the disclosure rules (PDF), the Office for Civil Rights at HHS noted that the new rule would require covered entities who have acquired an EHR after Jan. 1, 2009, to comply with the new accounting requirement by Jan. 1, 2011, unless the OCR extends the deadline, which is allowed but only no later than 2013.