Proposed HIPAA Overhaul to Ease Access to Patient Health Info

The US Department of Health and Human Services (HHS) is proposing an overhaul of the Health Insurance Portability and Accountability Act (HIPAA) that will make it easier to access patients' personal health information, including the health records of patients with mental illness. The proposal would also do away with the requirement that all patients sign a notice of privacy practices.

The changes are contained in a 357-page proposed rule, which was unveiled by federal officials December 10. Roger Severino, director of HHS' Office for Civil Rights, said in a briefing that the sweeping proposal would empower patients, reduce the administrative burden for healthcare providers, and pave the way to better-coordinated care.

HHS estimated that the rule could save $3.2 billion over 5 years, but it's not clear how much of that would accrue to clinical practices.

The most obvious cost-saving aspect for medical and dental practices is the proposal that practitioners would no longer have to provide and collect signed notifications of privacy practices.

"This has been a tremendous waste of time and effort and has caused massive confusion," said Severino. He said some patients thought they were waiving privacy rights and that in some cases, physicians refused to administer care unless patients signed the notices. "That was never the intent," he said.

Requiring that patients sign the form and that practices keep copies for 6 years is an "unnecessary burden," said Severino. "We've lost whole forests from this regulation," he said.

Under the new proposal, healthcare providers would merely have to let patients know where to find their privacy policies.

Sharing Mental Health Info

The rule would also ease the standard for sharing information about a patient who is in a mental health crisis, such as an exacerbation of a serious mental illness or a crisis related to a substance use disorder, including an overdose.

Currently, clinicians can choose to disclose protected health information — to a family member, a caregiver, a law enforcement official, a doctor, or an insurer — if they believe that doing so is advisable in their "professional judgment." The rule proposes to ease that to a "good faith" belief that a disclosure would be in the best interest of the patient. In both instances, the patient can still object and block the disclosure.

As an example, HHS said that in the case of a young adult who had experienced an overdose of opioids, a licensed healthcare professional could make the determination to "disclose relevant information to a parent who is involved in the patient's treatment and who the young adult would expect, based on their relationship, to participate in or be involved with the patient's recovery from the overdose."

HHS is also proposing to let clinicians disclose information in cases in which an individual might be a threat to himself or others, provided the harm is "serious and reasonably foreseeable."

Currently, information can only be disclosed if it appears there is a "serious and imminent" threat to health or safety. If an individual experienced suicidal ideation, for instance, a healthcare professional could notify family that the individual is at risk.

Fast, No-Cost Access

The rule also aims to make it easier for patients to get access to their own healthcare information quickly — within 15 days of a request — instead of the 30 days currently allowed, and sometimes at no cost.

The 30-day time frame is "a relic of a pre-internet age that should be dispensed with," said Severino.

Patients can also request that a treating physician get his or her records from a clinician who had previously treated the individual. The request would be fulfilled within 15 days, although extensions might be possible.

"That takes away the burden of coordination from the patient and puts it on those parties that are responsible for the actual provision of care and that are better positioned to do that coordination," Severino said.

Healthcare professionals will also have to share with patients a fee schedule for records requests. However, if records are shared through a patient portal with view, download, and transmit capabilities, the provider can't charge the patient for the time it took to upload the information into the system.

"We do not believe a patient's personal medical record should be profit centers for providers," Severino said.

Patients will be allowed to take photos with a smartphone of personal health information — such as an x-ray or sonogram — while receiving care.

The rule is open for public comment until mid-February. After that, it will become final in 180 days. The agency said it would not begin enforcement until 240 days after the final rule was published.

For more Medscape Psychiatry news, join us on Facebook and Twitter.

Comments

Commenting is limited to medical professionals. To comment please Log-in.

Comments on Medscape are moderated and should be professional in tone and on topic. You must declare any conflicts of interest related to your comments and responses. Please see our Commenting Guide for further information. We reserve the right to remove posts at our sole discretion.