Feds Issue More HIPAA Guidance in Push for Patient Access

Millions of patients in the United States may need to see their health records, but many don’t know their rights under HIPAA for accessing them. Other patients are frustrated by having to ask multiple providers and sometimes being told they can’t access certain records.

See Also: New Attacks. Skyrocketing Costs. The True Cost of a Security Breach.

The federal government is trying to address persistent problems of patient access and interoperability through the Trump administration’s “Make Health IT Great Again” unveiled last month, and on Tuesday the Department of Health and Human Services’ Office for Civil Rights released more guidance on HIPAA Privacy Rule rights of access (see: HHS Data Plan Aims to Make Health Technology Great Again).

While experts say the two FAQs offer no new guidance for people who thoroughly know HIPAA, it may help clarify rights and responsibilities for others, including a group of more than 60 tech firms, healthcare providers and insurers that have pledged to comply with new interoperability standards and data sharing criteria, spearheaded by HHS’ Centers for Medicare and Medicaid Services.

The interoperability initiative is aimed at helping patients more easily access their electronic health information and glean personalized insights from the data through third-party mobile apps and AI-assistants, and to transmit records from one doctor to another doctor, HHS said.

The agency hopes to foster “a patient-centric, digital healthcare ecosystem that will improve patient outcomes, reduce provider burden and drive value.” The HHS plan centers on promoting voluntary industry stakeholder compliance with a CMS Interoperability Framework, “an open, standards-based” infrastructure for secure health information exchange.

Guidance Details

HHS OCR’s “deregulatory” guidance in the form of FAQs on the HIPAA Privacy Rule opens with a question on whether healthcare providers are permitted to disclose patients’ PHI to “value-based care” organizations – such as accountable care organizations – for treatment purposes without the patient’s authorization. HHS’ short answer is yes, although the guidance provides more details.

The second FAQ deals with the HIPAA Privacy Rule’s right for an individual to access, upon request, the PHI contained about them in one or more “designated record sets” maintained by, or for, the patient’s healthcare providers and health plans.

Designated record sets include medical records, billing records, payment and claims records, health plan enrollment records, case management records, as well as other records used for a covered entity to make decisions about individuals, HHS said.

While a patient has a right under HIPAA to a wide range of PHI about themselves in a designated record set, a covered organization is only required to provide access to the PHI to which the individual requests access.

Plus, patients don’t have the right to access certain PHI, such as psychotherapy notes that a mental health professional maintains separately from the individual’s medical record. Another exception is PHI that is not used to make decisions about a patient. That could include PHI that’s used by a regulated entity for business planning decisions, improving customer service or peer reviews, HHS said.

So, What’s New?

Some regulatory experts said the FAQs do not really make any substantial changes to previous HHS OCR guidance or cover new ground for those well-versed in the HIPAA rules, but do potentially highlight some areas where the agency might see a level of confusion among regulated entities, patients and others.

“For those who understand HIPAA, nothing is new,” said regulatory attorney Rachel Rose. “Clarification on certain items like peer review not being included in designated record sets, may stem from inquiries that have been received,” she said.

“Privacy concerns are integral to the FAQs and the concepts inherent in the ‘Make Health IT Great Again,'” she added. “Because the designated record sets appear in both FAQs, it signals to covered entities what should be accessible and what should be walled off,” she said.

Attorney Aleksandra Vold, a partner at law firm BakerHostetler, said the only change from guidance was HHS OCR including “consent forms for treatment” in the list of what is considered part of the designated record set. “But my colleagues and I have been taking that position already,” she said.

“We have seen an uptick in patients requesting metadata from the electronic health record application, which is not part of the designated record set to which they are entitled – as the metadata, like the time stamp when a provider looked at an image, is not information used to make a decision about the individual’s care,” she said. “This would have been a great opportunity for OCR to clarify that metadata is not part of the designated record set,” she said.

While HHS OCR said the updated guidance supports CMS’ interoperability and patient access push, Vold said she doesn’t really see anything in the FAQs “doing anything to clarify or advance or pave the way for the new initiative. These are normal interpretations of long-standing rules,” she said.

Rose suggested that HHS OCR may be emphasizing to covered entities and business associates that they set up adequate privacy and security safeguards, “while also directing patients to a resource that clarifies the types of information they may request and receive” – under the overall HHS theme of improving interoperability and access.

HHS’ interoperability plan includes patients being able to retrieve their health records from a “CMS aligned network” or personal health record apps and share them with healthcare providers using QR codes, smart health cards or links supporting Fast Healthcare Interoperability Resources, or FHIR, which was created years ago by Health Level Seven International for exchanging healthcare information electronically.

“Interoperability has landmines and ensuring that FHIR standards, APIs and Security Rule requirements are in place to mitigate backdoors, rogue QR codes and Part 2 compliance is essential,” Rose said.

It’s also worth noting that HHS OCR has also over the last several years shined a spotlight on the HIPAA right of patient access in dozens of HIPAA enforcement actions against regulated organizations that have refused or delayed complying with individuals’ requests for their health records.

Looking ahead, HHS OCR should consider other areas to address in updated guidance, such as confidentiality over certain substance disorder records handled by federal programs, Rose suggested.

“What is missing is the nuances associated with 42 CFR Part 2 and SAMHSA, which although more aligned with HIPAA has patient permissions and provider-to-provider requirements that exceed HIPAA’s treatment disclosures to other providers,” she said.

Another area that HHS OCR should consider for future guidance is clarification around a Texas federal court ruling last year that effectively eliminated certain enhanced protections for reproductive health information that HHS OCR had finalized in a HIPAA privacy rule update, she said (see: Texas AG Hopes to Upend HIPAA Rules to Investigate Abortions).