Potential HIPAA Updates:

During the recent HIPAA Summit, the Director of U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR) announce three potential HIPAA updates. Prior to making any changes, OCR is planning on working with the healthcare sector and the public for input.

Specifically, OCR is looking at:

• A request for information on how the agency might distribute to victims a percentage of the funds it collects from HIPAA settlements and civil monetary penalties;
• A notice of proposed rulemaking for potentially changing the current HIPAA privacy rule requirement that patients sign.
• A notice clarifying that healthcare providers in certain circumstances are permitted; without patient authorization; to share information with a patients family.

Why is OCR looking at distributing a percentage of the funds it collects from HIPAA settlements and civil monetary penalties? According to Director, Roger Severino: "OCR is interested in hearing from industry advocates and patients about what would be the proper approach for creating a system for providing compensation to those hurt by breaches and HIPAA violations." He goes on to say, "a lot of breaches do end up causing significant stress, trauma and anxiety to people."

Notice of Privacy Practice requirements:

Regarding changing Notice of Privacy Practice requirements "When you go to the doctor, you get a big stack of forms . Very few people know what in the world they're signing,"Severino said. "We've heard from folks saying this causes a lot of confusion. People are uncertain if signing the acknowledgement of privacy practices is some type of contract or a waiver of privacy rights." he said. Severino then asked, "what is the net benefit of having to sign and collect this form? We're going to be looking at these questions."

OCR is also working on a proposal to explain situations when it is acceptable for healthcare providers to disclose information to family and friends. For example, in cases involving opioid drug abuse. According to Director Severino " the opioid crisis the president has declared it a national public health emergency." He goes on to say, "far too often we see examples where medical providers err so far on the side of caution, that the patient doesn't necessarily get the best treatment." Therefore, OCR would like to make regulations easy to understand to that healthcare providers understand when disclosures can be made "in good faith."

Presently there isn't a timeframe for when OCR will be seeking input; however, Healthcare Compliance Pros will be monitoring closely for any updates and will notify our clients when we learn of them.