Relaxing of the PHI Protections Introduced for Public Comment

The Department of Health and Human Services (HHS) this week submitted a 357-page proposal for publication to the Federal Register detailing proposed changes to the Privacy Rule under the HIPAA & HITECH Act standards.

The modifications address standards that may impede the transition to value-based health care by limiting or discouraging care coordination and case management communications among individuals and covered entities (hospitals, physicians, and other health care providers, payors, and insurers) or posing other unnecessary burdens. Once posted in the Federal Register, a 60-day comment period will commence. A link to the full pre-Federal Register posted document and online comments portal are provided at the end of this article.

At its core, the proposals seek to amend provisions of the Privacy Rule that could present barriers to coordinated care and case management – or impose other regulatory burdens without sufficiently compensating for, or offsetting, such burdens through privacy protections. “These regulatory barriers may impede the transformation of the health care system from a system that pays for procedures and services to a system of value-based health care that pays for quality care,” the document states.

In the summary of major provisions, the Department proposes to modify the Privacy Rule to increase permissible disclosures of PHI and improve care coordination and case management by:

1. strengthening individuals’ rights to inspect their PHI in person, shortening covered entities’ required response time to no later than 15 calendar days;
2. reducing the identity verification burden on individuals exercising their access rights;
3. creating a pathway for individuals to direct the sharing of PHI in an EHR among covered health care providers and health plans, by requiring covered health care providers and health plans to submit an individual’s access request to another health care provider and to receive back the requested electronic copies of the individual’s PHI in an EHR;
4. requiring covered health care providers and health plans to respond to certain records requests received from other covered health care providers and health plans when directed by individuals pursuant to the right of access;
5. and amending some definitions and exceptions to the “minimum necessary” standard for individual-level care coordination and case management use and disclosures.

These modifications come as part of the HHS response to the “Enforcing Regulatory Reform Agenda,” the Presidential Executive Order on Reducing Regulation and Controlling Regulatory Costs, and the value-based transformation of the Nation’s healthcare system and how it relates to a reduction of regulatory burden.

In 2018, Secretary of Health and Human Services Alex M. Azar II said in a speech to the Federation of American Hospitals that he was committed to addressing “government burdens that may be getting in the way of integrated, collaborative, and holistic care for the patient, and of structures that may create new value more generally.” In remarks to the Better Medicare Alliance, Azar said, “the barriers to effective coordination among providers are much steeper than just excessive paperwork. . . Addressing these regulations that impede care coordination are part of a much broader regulatory reform effort at HHS.”

In support of this priority, HHS Deputy Secretary Eric D. Hargan explained, before the Joint Commission on May 29, 2019, that care coordination is a necessary component of achieving value-based care:

“It’s about coordination, above all—we’re focused on understanding how regulations are impeding coordination among providers that can provide better, lower cost patient care, and then reforming these regulations consistent with the laws and their intents. And, finally, it’s about care. Regulating health care means regulating some of the most intimate decisions and relationships in our lives— deciding where and when to seek health care, how to make decisions with our doctors and family members, and more.”

More recently, the Secretary praised the advancement of coordinated care with the publication of final rules on interoperability, access to health information, and certification of electronic health record technology.

“These rules are the start of a new chapter in how patients experience American healthcare, opening up countless new opportunities for them to improve their own health, find the providers that meet their needs, and drive quality through greater coordination.”

And, when announcing the publication of a final rule modifying regulations on the confidentiality of substance use disorder treatment records, the Secretary stated, “This reform will help make it easier for Americans to discuss substance use disorders with their doctors, seek treatment, and find the road to recovery.”

Care coordination is a key aspect of systems that deliver value and may include a range of activities that link individuals to services and improve communication flow. The guidance states that the various definitions of this term share three key concepts:

1. comprehensive coordination (involving coordination of all services, including those delivered by systems other than the health system),
2. patient-centered coordination (designed to meet the needs of the patient),
3. and access and follow-up (described as ensuring the delivery of appropriate services and information flow among providers and back to the primary care provider).

Once published in the Federal Register, there will be a 60-day comment period. The Department seeks comment on all issues raised by the proposed regulation, including any unintended adverse consequences. Comment will be accepted by mail or via the Federal eRulemaking Portal: Federal eRulemaking Portal. You may submit electronic comments at http://www.regulations.gov by searching for the Docket ID number HHS-OCR0945-AA00. Follow the online instructions for submitting comments through this method.

Review the full document here: https://www.hhs.gov/sites/default/files/hhs-ocr-hipaa-nprm.pdf