HHS announces proposed changes to HIPAA Privacy Rule

July 5, 2011, 3:17 PM

A Notice of Proposed Rulemaking concerning the accounting of disclosures requirement under the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule, is currently available for public comment. The proposed rule would give individuals the right to get a report on who has electronically accessed their protected health information (PHI).

The Department of Health and Human Services (HHS) Office for Civil Rights (OCR) is proposing changes to the Privacy Rule, pursuant to the Health Information Technology for Economic and Clinical Health (HITECH) Act.

This proposed rule represents an important step in our continued efforts to promote accountability across the health care system, ensuring that providers properly safeguard private health information, said OCR Director Georgina Verdugo. We need to protect peoples rights so that they know how their health information has been used or disclosed.

Individuals would obtain this information by requesting an access report, which would document the particular persons who electronically accessed and viewed their PHI. Although covered entities are currently required by the HIPAA Security Rule to track access to electronic PHI, they are not required to share this information with individuals.

The proposed rule requires an accounting of more detailed information for certain disclosures that are most likely to affect a persons rights or interests. According to HHS, the proposed changes to the accounting requirements are expected to provide information of value to individuals while placing a reasonable burden on covered entities and business associates.

Comments on the Proposed Rule must be submitted by August 1, 2011. --Christopher L. McLean