■ The HIPAA privacy rule currently requires providers to NOTIFY PATIENTS WHEN THEIR PROTECTED HEALTH INFORMATION (PHI) IS DISCLOSED TO OTHERS, EXCEPT IN CASES WHEN THE DISCLOSURE IS FOR THE PURPOSE OF TREATMENT, PAYMENT AND HEALTH CARE OPERATIONS. However, this rule will be expanded soon because of the Health Information Technology for Economic and Clinical Health (HITECH) Act, which was passed as part of the American Recovery and Reinvestment Act of 2009. The HITECH Act calls for the Department of Health and Human Services Office for Civil Rights (OCR) to require HIPAA-covered entities to notify individuals about disclosures of their PHI made via electronic health records—including those for the purposes of treatment, payment, and health care operations. It is important to note that this rule only addresses disclosures via electronic health records , but the new regulation has the potential to cover requests for records for claims review, FMLA forms, disability claims, attending physician statements, CMS audits/reviews, referrals, hospital records, and outside tests, labs and surgeries. According to the rule, disclosures must include: • the date of disclosure • the name and address of the entity or person receiving the disclosure • a description of the information disclosed, and • a copy of the request for disclosure or a brief description of the reason for disclosure. However, the HITECH Act does require the HHS Secretary to balance the individual's right to notification with the administrative burden placed upon covered entities to fulfill this requirement. OCR is requesting information from affected entities and is accepting comments on or before Tuesday, May 18, 2010 . Providers and practices are encouraged to go to http://edocket.access. gpo.gov/2010/pdf/2010-l0054.pdfto read about the rulemaking process, background information on the regulations involved, specific questions on which OCR is seeking comment, and instructions on how to submit comments to OCR for consideration. After comments are considered, a proposed rule will be drafted and publicized, at which time there will be additional opportunity to comment. continues from page 8
