Under the current Privacy Rule, individuals, with limited exceptions, have the right to access their own PHI. However, DHHS believes there are certain procedures imposed by covered entities which act as barriers to access. Such procedures diminish the speed, practicality, and ease of access. The Proposed Rule includes several modifications which would remove such barriers, facilitate information sharing and benefit both patients and providers.
To promote care coordination and case management, the Proposed Rule includes several modifications creating more flexibility for covered entities to use and disclose PHI for such purposes. Specifically, DHHS proposes to clarify the definition of “health care operations” to include case management and care coordination. DHHS also proposes to add a new provision expressly permitting covered entities to disclose PHI to social services agencies, community based organizations, home and community based service providers and other similar third parties that provide health-related services, including social services or other supportive services, to the individual. A covered entity would be able to make such disclosures without the patient’s authorization, as part of the provider’s treatment activities or health care operations.
Additionally, under the Privacy Rule, covered entities are generally required to use, disclose, or request only the minimum necessary PHI to meet the purpose of such use, disclosure, or request. The Proposed Rule includes an express exception to the minimum necessary standard for disclosures to, or requests by, a health plan or provider for care coordination and case management of a specific individual.
Under the Privacy Rule, covered entities can disclose PHI in certain circumstances in the “exercise of professional judgment.” To encourage covered entities to disclose PHI more broadly in cases involving substance use disorder, serious mental illness, and emergency situations, DHHS proposes to replace “exercise of professional judgment” with “good faith belief” as the standard to allow covered entities to disclose PHI in certain circumstances in the best interests of individuals. DHHS would make the modification in the following sections:
Acording to DHHS, a good faith standard may be exercised by other workforce members, not just licensed professionals, thereby allowing more individuals to make the determination. DHHS also proposes a presumption that the provider has complied with the good faith requirement, absent evidence to the contrary. DHHS reminds covered entities that they must still assess the facts and circumstances surrounding the disclosures, including an individual’s prior expressed privacy preferences.
Additionally, to broaden a covered entity’s ability to disclose PHI to address threats of harm, DHHS proposes to replace the “serious and imminent threat” standard with a “serious and reasonably foreseeable threat” standard. “Reasonably foreseeable” would be based on a reasonable person standard, without assumptions unwarranted by the individual’s diagnosis and specific circumstances.
The Privacy Rule currently requires covered health care providers that have a direct treatment relationship with an individual to make a good faith effort to obtain the individual’s written acknowledgement of the provider’s Notice of Privacy Practices (NPP). If the provider is unable to obtain such acknowledgement, the provider must document its efforts and reasons for not obtaining the acknowledgement. To reduce paperwork burdens and confusion among patients and office staff, DHHS proposes to eliminate this requirement and replace it with an individual right to discuss the NPP with a person designated by the provider.
Additionally, to help increase patients’ understanding of the NPP, DHHS proposes the following changes to the contents of the NPP:
The Proposed Rule may have a significant impact on the current HIPAA policies and procedures adopted by covered entities. If finalized, the rule will require changes to the NPPs and procedures for patient access to their health records. We suggest a careful review of the Proposed Rule to prepare for possibly significant changes. There is an opportunity to comment and suggest alternatives or voice concerns up to January 4, 2021.