This has been a busy week for the Department of Health and Human Services / Office for Civil Rights (HHS/OCR). It has started releasing guidance on various provisions of the Omnibus HIPAA final rule (the "Final Rule") in advance of the September 23, 2013 compliance date. The guidance includes:
1. Model Notices of Privacy Practices
A significant provision of the Final Rule requires covered entities to update their Notices of Privacy Practices ("NPP") to conform with new requirements under HITECH. On September 16, 2013 , OCR released a set of model NPPs (the "Forms") for both health care providers and health plans both in editable .pdf and text formats.
The Forms include key revisions to the NPP required by the Final Rule including:
-
the patient's right to restrict disclosures to a health plan when a procedure is paid for out of pocket and to receive notice if there has been a breach of the patient's protected health information ("PHI");
-
a description of the types of uses and disclosures that require authorization, including uses and disclosures for certain marketing activities and for the sale of PHI by a covered entity;
-
the individual’s right to opt out of certain fundraising disclosures;
-
the health plan's inability to use or disclose a person's genetic information for underwriting purposes; and
-
if there is a material change to the NPP, the health plan's obligation to post the revised NPP on the plan's website or provide a notice of revision to plan participants within sixty (60) days.
While the Forms can serve as the baseline for covered entities to come into compliance with the new requirements by September 23, 2013, health care providers and health plans should also consider applicable state law and their particular operations.
2. Delay in Enforcement of NPP Requirement for Certain CLIA and CLIA-Exempt Labs
On September 19, 2013, HHS announced that it was delaying enforcement of the requirement that labs that are subject to the Clinical Laboratory Improvement Amendments of 1988 ("CLIA") or exempt from CLIA and that are not required to provide an individual with access to his or her laboratory results under the HIPAA Privacy Rule. HHS issued the enforcement delay because it anticipates publishing an amendment to the HIPAA Privacy Rule and the CLIA regulations regarding the right of individuals to receive their test results directly from CLIA and CLIA-exempt labs. The enforcement delay will relieve CLIA and CLIA-exempt labs from potentially having to revise their NPPs twice within a relatively short time and the associated burdens that would impose.
3. Guidance on Decedents and Student Immunizations
On September 19, 2013, OCR released guidance on uses and disclosures of PHI of decedents and disclosures of student immunization records. In addition to the guidance, OCR published FAQs addressing both topics.
Under the Omnibus Rule, PHI of decedents is protected for 50 years following the date of death of the individual. After that, the information is no longer subject to HIPAA protections. During the 50-year period of protection, the personal representative of the decedent, can exercise the rights under the Privacy Rule to protect the health information of the decedent. Covered entities may also release to family members and others involved in the person's healthcare PHI that is relevant to that involvement. The guidance and FAQs address issues that may arise in implementing this new requirement.
The Omnibus Rule also explicitly permits covered entities to disclose student immunization information directly to a school that is required by state or other law to have proof of required immunizations before admitting the student. The covered entity needs only agreement (and not written authorization) from a parent, guardian, or the emancipated minor to make the disclosure. While the agreement does not need to be in writing, the health care provider must document the agreement to disclosure. The new guidance and FAQs address what is suitable documentation and other issues that may arise.
4. What's next?
OCR has also released clarification on prescription drug refill reminder programs (to be addressed in a separate Akerman Health Law Rx Blog). More guidance is sure to follow so….stay tuned!
