How HIPAA comments could provide key tweaks to rules

The Office for Civil Rights is now seeking comments on whether certain aspects of the HIPAA privacy and security rules should be modified. The Request for Information is purely a solicitation of comments and ideas from the public on whether or how HIPAA could be modified.

That being said, the request is not without any parameters. The request focuses on soliciting comments in five primary categories:

• Does HIPAA create any barriers or hurdles to coordinating care or implementation of case management in connection with value-based care goals?
• Are their ways to promote care coordination or case management by encouraging, incentivizing or requiring covered entities to share protected health information with other covered entities?
• How can laws encourage covered entities to share protected health information with family members and caregivers with a focus on opioid issues?
• What are ways to Implement changes to the accounting for disclosures rule called for by the HITECH Act? and
• Should the government eliminate or modify the requirement for covered entities to make a good-faith effort to obtain a patient’s signature on the Notice of Privacy Practices?

The request follows similar requests from other agencies within the Department of Health and Human Services seeking to determine whether regulations should be modified to encourage or enable the transition to value-based care.

While those other requests made more apparent sense in connection with fraud and abuse laws, the same does not necessarily hold true for HIPAA. When the full scope of permissible or allowable uses and disclosures is reviewed, PHI can already flow quite freely and broadly. While there are likely some ways in which HIPAA can be modified to further help value-based care, those changes may not be as pervasive or fundamental.

The area of the request that may drive the greatest amount of commentary is the restart on changing the accounting of disclosures rule. The HITECH Act requires the update, though it has been long delayed and is much overdue at this point in time. OCR’s first attempt to implement the HITECH Act changes results in widespread panning of the proposal as unworkable. Will this time be any different? Hopefully, because the right can be a significant one. Comments on this rule should be watched carefully.

Overall, the request is and will generate a lot of attention, but the ability to make or the likelihood of making significant changes is probably not high. Ultimately, none of this should be surprising.

All that being said, all interested parties should review the questions laid out by OCR in the Request for Information and consider submitting comments. Even if changes may not happen, that is not a reason to abstain from participating.

With that in mind, comments must be submitted by February 11. Mark that date on your calendar and get reading and thinking.