On Friday, the HHS Office for Civil Rights posted a proposed rule governing the sharing of and access to protected health information, Health Data Management reports.
The proposed rule is mandated by the HITECH Act, part of the 2009 economic stimulus package, and is meant to strengthen HIPAA privacy rules (Goedert, Health Data Management, 5/27).
The proposed rule is designed to:
- Strengthen "accounting of disclosures" of patient information taken from electronic health records; and
- Establish parameters on delivering an "access report" to patients indicating who has accessed their data.
Accounting of Disclosures Provision
Under the proposed rule, health care providers, health plans and business associates would be obligated to specify disclosures of patient data in EHRs for treatment, payment and other health care operations.
The report also would specify whether the disclosure was electronic or a hard copy (Mosquera, Government Health IT, 5/27).
According to the rule, "the right to an accounting would provide additional information about the disclosure of designated record set information (whether hard copy or electronic) to persons outside the covered entity and its business associates for certain purposes," such as for public health investigations or law enforcement.
Access Report Provision
Meanwhile, the proposed rule would expand a HITECH Act provision to give individuals the right to obtain a report showing who has accessed their electronic protected health information (Health Data Management, 5/27).
The access report would provide information on who opened patients' information and at what date and time (Government Health IT, 5/27).
The rule states, "The right to an access report would provide information on who has accessed electronic protected health information in a designated record set (including access for purposes of treatment, payment and health care operations)" (Health Data Management, 5/27).
Next Steps
The civil rights office will publish the proposed rule in the Federal Register on May 31 (Health Data Management, 5/27).
HHS will accept public comments on the rule for 60 days after it is published (Government Health IT, 5/27).