Healthcare information advocacy groups raise concerns around proposed HIPAA rules changes

Image credit – HHS.gov

PARCA eNews – May 13, 2021 – The department of Health and Human Services (HHS) has issued several proposed rule changes largely aimed at improving data sharing for care coordination, however, several patient information advocacy groups, including CHIME have voiced concerns about the changes pointing to conflicting regulations between federal and state regulations, according to a report in the HIPAA Journal.

The advocacy groups are calling for changes the would align HIPAA Privacy Rule with the 21st Center Cures Act, particularly around federally assisted substance use disorder (SUD) treatment programs so that the HHS changes would more closely match those of state health data privacy laws. The issue is that providers are facing so many regulations that confusion could ultimately result in new privacy and security risks.

Another major area of concern regards the burgeoning role of personal health applications (PHAs) that are largely unregulated at this point. These applications send protected health information (PHI) to the app vendors that fall outside the scope of HIPAA, which could result in misuse of patient information, as well as security risks from third parties.

The College of Healthcare Information Management Executives (CHIME) has expressed concern about HHS proposal for how covered entities provide patient-requested protected health information to such PHAs, particularly when the PHA does not have appropriate privacy and security protections. HHS has proposed shortening the time covered entities have to provide such information from 30 to 15 days.

The association for Behavioral Health and Wellness (ABHW) and CHIME have expressed objections to the 15 day rule as placing additional administrative burden on providers. CHIME has stated it may not be possible to provide such patient information within the shortened timeframe, and is calling form HHS to not issue its final rule, and instead reissue the questions raised to the proposed rules.

Source: HIPAA Journal, "Healthcare Groups Raise Concerns about Proposed HIPAA Privacy Rule Changes"