HITECH Disclosures Rule Proposed
Guidelines for Revealing Who Accesses Patient Data
The HITECH Act mandated the accounting of disclosures rule, which would modify the HIPAA privacy rule.
The Department of Health and Human Services' Office for Civil Rights, which drafted the proposal, says it provides two separate rights for individuals.
The proposal would give patients the right to obtain an "access report" for electronic health records. Such a report would identify "electronic access by both workforce members and persons outside the covered entity." The access report would "provide information on who has accessed electronic protected health information in a designated record set, including access for purposes of treatment, payment and healthcare operations."
In addition, the rule would provide patients with the separate right to an "accounting of disclosures" that "would provide additional information about the disclosure of designated record set information, whether hard-copy or electronic, to persons outside the covered entity and its business associates for certain purposes (e.g. law enforcement, judicial hearings, public health investigations)."
In explaining the difference between these two provisions, the proposal states: "The intent of the access report is to allow individuals to learn if specific persons have accessed their electronic designated record set information (it will not provide information about the purposes of the person's access.) In contrast, the intent of the accounting of disclosures is to provide more detailed information ... for certain disclosures that are most likely to impact the individual."
A Reasonable Burden?
Summing up the two-pronged approach, OCR states: "We believe that these changes to the accounting requirements will provide information of value to individuals while placing a reasonable burden on covered entities and business associates."OCR notes that it plans to work with the Office of the National Coordinator for Health IT to ensure that certification standards for electronic health record software that qualifies for future stages of the HITECH Act EHR incentive program will align with the new disclosure requirements.
The notice of proposed rulemaking was published in the Federal Register May 31. OCR will accept comments on the notice for 60 days before it begins work on finalizing the rule.
