Health Information Exchange, Data Privacy, and Federal Standards Alignment – Information Blocking, HIPAA Updates, and Part 2 Flexibility
As we struggle to emerge from the effects of the pandemic, several key federal agencies have implemented substantial changes affecting privacy standards, patient consent requirements, and the use of electronic health records in the exchange of health information. Although many changes have been postponed and the app has been lenient given the continued struggles of the healthcare industry, the pandemic emergency has been extended until April 14, 2022 and other priorities will likely be highlighted this coming year. This information note will begin the process of notifying you of the following changes:
Office of the National Health Information Technology Coordinator:
- Providers must provide patients with real-time access to their electronic health information.
- Failure to put in place a system allowing patients to consult their medical records could be considered as blocking information.
Substance Abuse and Mental Health Services Administration (SAMHSA)
Civil Rights Office of the Department of Health and Human Services
Regulatory changes have a constant impact on the healthcare industry, making it difficult for healthcare providers to keep up with, but also to understand and interpret correctly, in order to stay in compliance with regulations. We hope to help you understand these changes with the information presented by the firm’s health care and long-term care practices.
Office of the National Health Information Coordinator Implements Information Blocking Standards
Effective April 5, 2021, the Office of the National Health Information Technology Coordinator (ONC) implemented a new information blocking rule. Under the Cures Act, information blocking is defined as a practice that may interfere with, prevent, or materially discourage access to, sharing, or use of electronic health information. This new rule applies to physicians, healthcare providers, certified health informatics developers, HIEs and HINs.
This means for the health field that providers are now required to allow patients to access their electronic health information (EHI) in real time, without them having to go through the process of requesting records or test results, with a delay for the patient. to access their information. Essentially, providers must be able to provide patients with near-instant access to their EHI when and how they want. The Cures Act does not require a provider to take proactive steps to provide electronic health information to its patients who have not requested it. However, if a patient requests their electronic health information, the provider must have a system in place to be able to easily provide this information in a timely manner – failure to do so may implicate the information blocking provisions. Although the law does not directly specify how providers must provide access to their patients, it is suggested and apparently preferred that providers implement electronic portals or applications.
SAMHSA changes under the CARES Act
The CARES Act has resulted in several updates to privacy policies regarding substance use disorder records. The Federal Drug Information Act (42 CFR Part 2) covers any information, recorded or unrecorded, relating to a patient that identifies a person directly or indirectly, as having a current or past drug or alcohol problem, or as a participant in a substance use disorder treatment program. A drug treatment program is defined as any program that receives federal financial assistance (directly from the federal government or indirectly from state or municipal agencies) that purports to provide prevention, treatment, or referral services. for the diagnosis of alcohol or drugs. The CARES Act amends the law authorizing the regulations codified in CFR 42 Part 2, also known as the Public Health Services Act. The goal is to expand the ability of health care providers to share records of patients with substance use disorders while maintaining appropriate confidentiality in this sensitive area. The CARES Act also strengthens requirements for privacy breaches and mandates alignment with 42 CFR Part 2 and HIPAA.
To address the pressing need to protect patient substance use information, amended Part 2 regulations under the CARES Act: Now require broad consent for disclosure of substance use disorder treatment records substances; allow disclosure of covered records for healthcare treatment, payment, and operations to designated recipients, including Part 2 programs, HIPAA-covered entities, and business associates, so long as such subsequent disclosure is made in accordance with HIPAA; allow the disclosure of anonymized DUU records to public health authorities; prohibit the use of substance use records in civil, criminal, statutory or administrative proceedings other than by court order or patient consent; adopt HIPAA fines and penalties in place of the old Part 2 criminal enforcement mechanisms; provide updated obligations to comply with HIPAA breach notification practices; and provide new protections against discrimination based on the intentional or inadvertent disclosure of SUD records.
Significantly, SAMHSA is required to issue new regulations to implement the CARES Act changes, and these new rules will take effect after March 27, 2022. will become effective only when the Secretary of Health and Human Services consults with other federal agencies, including SAMHSA, to implement and enforce the changes.
HIPAA aligns with care coordination
Another rule that will be important to watch out for is the HIPAA privacy rule. The HIPAA Privacy Rule regulates what medical information is considered protected health information (PHI) retained by covered entities and defines the circumstances under which PHI may be disclosed. HIPAA has remained virtually unchanged for the past 10 years. In a regulatory sprint toward coordinated care, the Civil Rights Office released a Notice of Proposed Rulemaking to amend the HIPAA Privacy Rule to support individuals’ engagement in their healthcare, remove barriers to care and reduce regulatory burdens on the healthcare industry, while continuing to protect the privacy interests of individuals’ health information. On December 10, 2020, a regulatory proposal was released that would expand an individual’s rights to access protected health information, including electronic information; improve information sharing for care coordination and case management for individuals; facilitate greater involvement of family and caregivers in the care of people in emergency or health crisis; improving flexibilities for disclosure in emergency or threatening circumstances, such as public health emergencies related to opioids and COVID-19; and reducing administrative burdens for health care providers and health plans covered by HIPAA, while continuing to protect the privacy interests of individuals in health information.
Looking to 2022
Our team will provide individual assessments of the above areas during 2022. Each area will require substantial changes or new policy development in healthcare operations. Please keep an eye out for further educational material to be released in this regard.