Contributed by Lee Kim
The Department of Health and Human Services has issued a Notice of Proposed Rule Making (NPRM) to modify the HIPAA Privacy Rule as necessary to implement the accounting of disclosures provisions of the HITECH Act. An advance copy of the NPRM has been posted here at the Office of the Federal Register website: http://www.ofr.gov/OFRUpload/OFRData/2011-13297_PI.pdf. The NPRM will be published soon in the Federal Register. The NPRM has been published as of May 31, 2011. It is available here: http://www.gpo.gov/fdsys/pkg/FR-2011-05-31/pdf/2011-13297.pdf. There is a 60-day comment period for those who wish to comment on the proposed rule.
The NPRM proposes expansions to the HIPAA Privacy Rule such as covered entities and business associates accounting for uses and disclosures of all of a patient’s protected health information ("PHI") within a designated record set, as opposed to just EHR information. It is proposed that there would be a right to an access report for all covered entities and business associates that maintain electronic designated record set information. The NPRM proposes that this be limited to ePHI (electronic PHI) because extending it to paper records may prove to be an unreasonable administrative burden.