|
|
 |
| |
| |
|
| |
CHANGES
TO ACCOUNTING OF DISCLOSURES OF PROTECTED HEALTH INFORMATION
On February 17, 2009, President Obama signed into law the American
Recovery and Reinvestment Act of 2009 (the "Recovery Act").
Title XIII of the Recovery Act is known as the Health Information
Technology for Economic and Clinical Health Act ("HITECH").
Among other provisions, HITECH makes several changes to the Privacy and
Security Rules of the Health Insurance Portability and Accountability
Act of 1996 ("HIPAA"). Due to the significance of those
changes, we will be issuing a series of Alerts providing an analysis of
each of those changes in detail. This is the sixth in a
series of seven such Alerts.
One of the more interesting changes made by HITECH regards the
requirement that covered entities provide individuals with an
accounting of disclosures of protected health information
("PHI"). Currently, HIPAA provides each individual with the
right to receive an accounting of disclosures of PHI made by a covered
entity in the six (6) years prior to the date of the individual's
request. However, that right does not extend to several types
of disclosures, including disclosures for treatment, payment, and
health care operations. The primary purpose for that
exclusion is that disclosures for treatment, payment, and health care
operations are necessary for the day-to-day operation of a covered
entity and occur in great numbers, so tracking them could be unduly
burdensome on a covered entity.
In light of the increasing use of electronic medical record technology,
HITECH changes the accounting for disclosures requirement to include
even disclosures for treatment, payment, and health care
operations. Under HITECH, if a covered entity utilizes an
electronic health record ("EHR"), the covered entity will be required
to account for disclosures for treatment, payment, and health care
operations. Upon receiving a request for such a disclosure,
the covered entity will be required to provide individuals with an
accounting of disclosures of PHI which occurred within the three (3)
years prior to the date of the request. Note that the time
period to which the accounting requirement applies is half the length
of time as currently exists under HIPAA.
The effective date of this new requirement varies depending on when the
covered entity obtains its EHR. For covered entities that had
an EHR as of January 1, 2009, the effective date is January 1,
2014. For covered entities that acquire an EHR after January
1, 2009, the effective date is the later of January 1, 2011, or the
date the EHR is acquired. The Secretary of Health and Human
Services ("Secretary") may delay these dates by up to two (2) years, if
necessary. The reason for the different effective dates is
based on the assumption that EHRs acquired prior to January 1, 2009
likely will not have the technical capability to account for
disclosures for treatment, payment, and health care
operations. Therefore, covered entities that had EHRs as of
January 1, 2009 are given additional time to either update their
existing EHR or acquire a new EHR.
HITECH also addresses the impact of this new accounting requirement on
business associates. HITECH provides covered entities with
two (2) methods to account for disclosures by business
associates. First, the covered entity may simply include
disclosures made by a business associate in the covered entity's own
accounting. Alternatively, the covered entity may account
only for its own disclosures and include a list of all business
associates and their contact information to the individual.
With the second method, if a business associate of a covered entity
receives a request for an accounting of disclosures directly from an
individual, the business associate is required to provide the
accounting to the individual directly.
With respect to the content of the accounting, HITECH requires the
Secretary to adopt regulations that take into consideration both the
individual's interest in knowing how PHI is used and disclosed, and the
administrative burdens to covered entities in providing the
accounting. The Secretary is required to issue those
regulations by June 18, 2010. Therefore, additional
information regarding this new requirement is forthcoming.
This change to HIPAA is an important change that will require covered
entities and their business associates to revise their policies,
procedures, and practices as well as their Business Associate
Agreements. Covered entities affected by these changes should
determine which effective date applies to their organization and start
planning to make the necessary adjustments so that they will be in full
compliance by the applicable deadlines. If your organization
has questions about these changes or needs assistance assessing HIPAA
compliance and implementing the changes, please contact us.
To register for the complete Impact Series:
HIPAA goes HITECH, please visit:
hallrender.com/impact
HIPAA Impact Series: HIPAA goes HITECH
- Increased Enforcement (3/30/09)
- Breach Notification Requirements (04/13/09)
- Changes to Business Associate Agreements
and Duties (04/27/09)
- Changes to the Minimum
Necessary Rule (05/11/2009)
- Changes to Fundraising, Marketing, and
other Restrictions on Disclosure (05/25/09)
- Changes to Accounting of Disclosures
Requirements (06/08/09)
- How Changes to HIPAA Impacts HIEs, RHIOs,
etc. (06/22/09)
If you need additional information about this topic,
please contact your regular Hall Render attorney or:
Mark J. Swearingen at
(317) 977-1458 or mswearingen@hallrender.com
This information is intended for general
information purposes only and does not and is not intended to
constitute legal advice. The reader must consult with legal counsel to
determine how laws or decisions discussed herein apply to the reader's
specific circumstances.
|
|
|
Printer-friendly version: Download
|
|
| |
| Click here to return to the Impact Series homepage. |
This publication is intended for general information purposes only and does not and is not intended to constitute legal advice. The reader must consult with
legal counsel to determine how laws or decisions discussed herein apply to the reader's specific circumstances.
|
