Author Archives: Ed Jones III

HHS Publishes Technical Corrections to January 25, 2013, HIPAA Privacy, Security, and Enforcement Rules

Posted by Ed Jones III
HHS Publishes Technical Corrections to January 25, 2013, HIPAA Privacy, Security, and Enforcement Rules

June 7, 2013.  Today, HHS published in the Federal Register "Technical Corrections to the HIPAA Privacy, Security, and Enforcement Rules" that were published on January 25, 2013, as the Final Rule: "Modifications to the HIPAA Privacy, Security, Enforcement, and Breach Notification Rules Under the Health Information Technology for Economic and Clinical Health Act [HITECH Act] and the Genetic Information Nondiscrimination Act; Other Modifications of the HIPAA Rules."

According to the "Summary" in today's Corrections Final Rule:  "These technical corrections address certain inadvertent errors and omissions in the HIPAA Privacy, Security, and Enforcement Rules that are located at 45 CFR parts 160 and 164.

The effective date of the Corrections Final Rule is June 7, 2013.

HIPAA Final Rule: Today is Effective Date—Covered Entities and Business Associates Have 180 Days to Comply

Posted by Ed Jones III
HIPAA Final Rule: Today is Effective Date—Covered Entities and Business Associates Have 180 Days to Comply

March 26, 2013.  Today is the first big milestone since the January 25, 2013, publication in the Federal Register of the Final Rule:  Modifications to the HIPAA Privacy, Security, Enforcement, and Breach Notification Rules Under the Health Information Technology for Economic and Clinical Health Act [HITECH Act] and the Genetic Information Nondiscrimination Act; Other Modifications of the HIPAA Rules. Today is the effective date of the Final Rule, and covered entities and business associates must comply by September 23, 2013.

"Significant rules (defined by Executive Order 12866) and major rules (defined by the Small Business Regulatory Enforcement Fairness Act) are required to have a 60 day delayed effective date," which was the case with the Final Rule discussed herein.

Here are comments from the preamble of the Final Rule pertaining to the effective and compliance dates:

"The final rule is effective on March 26, 2013.  Covered entities and business associates of all sizes will have 180 days beyond the effective date of the final rule to come into compliance with most of the final rule's provisions, including the modifications to the Breach Notification Rule and the changes to the HIPAA Privacy Rule under GINA.  We understand that some covered entities, business associates, and subcontractors remain concerned that a 180-day period does not provide sufficient time to come into compliance with the modifications. However, we believe not only that providing a 180-day compliance period best comports with section 1175(b)(2) of the Social Security Act, 42 U.S.C. 1320d–4, and our implementing provision at 45 CFR 160.104(c)(1), which require the Secretary to provide at least a 180-day period for covered entities to comply with modifications to standards and implementation specifications in the HIPAA Rules, but also that providing a 180-day compliance period best protects the privacy and security of patient information, in accordance with the goals of the HITECH Act.

“In addition, to make clear to the industry our expectation that going forward we will provide a 180-day compliance date for future modifications to the HIPAA Rules, we adopt the provision we proposed at 45 CFR 160.105, which provides that with respect to new or modified standards or implementation specifications in the HIPAA Rules, except as otherwise provided, covered entities and business associates must comply with the applicable new or modified standards or implementation specifications no later than 180 days from the effective date of any such change. In cases where a future modification necessitates a longer compliance period, the Department will expressly provide for one, as it has done in this rulemaking with respect to the time permitted for business associate agreements to be modified.

“For the reasons proposed, the final rule also retains the compliance date provisions at 45 CFR 164.534 and 164.318, which provide the compliance dates of April 14, 2003, and April 20, 2005, for initial implementation of the HIPAA Privacy and Security Rules, respectively. We note that 160.105 regarding the compliance date of new or modified standards or implementation specifications does not apply to modifications to the provisions of the HIPAA Enforcement Rule, because such provisions are not standards or implementation specifications (as the terms are defined at 160.103). Such provisions are in effect and apply at the time the final rule becomes effective or as otherwise specifically provided. In addition, as explained above, our general rule for a 180-day compliance period for new or modified standards would not apply where we expressly provide a different compliance period in the regulation for one or more provisions. For purposes of this rule, the 180-day compliance period would not govern the time period required to modify those business associate agreements that qualify for the longer transition period in 164.532….

“Finally, the provisions of section 13402(j) of the HITECH Act apply to breaches of unsecured protected health information discovered on or after September 23, 2009, the date of the publication of the interim final rule. Thus, during the 180 day period before compliance with this final rule is required, covered entities and business associates are still required to comply with the breach notification requirements under the HITECH Act and must continue to comply with the requirements of the interim final rule. We believe that this transition period provides covered entities and business associates with adequate time to come into compliance with the revisions in this final rule and at the same time to continue to fulfill their breach notification obligations under the HITECH Act.”

78 Federal Register 5569-5570

For provisions of the modifications of the Final Rule, you may access them through electronic Code of Federal Regulation links available at www.ecfr.gov.  On the opening screen, scroll down to "Title 45:  Public Welfare" and click "Go."  Then, click on "1-199:  Subtitle A--Department of Health and Human Services."  Scroll down to "Subchapter C: Administrative Date Standards and Related Requirements" for the "Parts" and "Subparts" of interest, click, and you can then access desired sections.  For example, Part 164 is "Security and Privacy," and Subpart C is "Security Standards for the Protection of Electronic Protected Health Information," Subpart D is "Notification in the Case of Breach of Unsecured Protected Health Information," and Subpart E is" Privacy of Individually Identifiable Health Information."

HIPAA Final Rule: Notice of Privacy Practices for Protected Health Information: Provision of Notice (2)

Posted by Ed Jones III
HIPAA Final Rule: Notice of Privacy Practices for Protected Health Information: Provision of Notice (2)

March 25, 2013.  Today, we continue going through the HIPAA Privacy Rule, section by section, as modified in the Final Rule:  Modifications to the HIPAA Privacy, Security, Enforcement, and Breach Notification Rules Under the Health Information Technology for Economic and Clinical Health Act [HITECH Act] and the Genetic Information Nondiscrimination Act; Other Modifications of the HIPAA Rules, which was published in the Federal Register on January 25, 2013.  The effective date of the Final Rule is March 26, 2013, and covered entities and business associates must comply by September 23, 2013.

We began a two-day examination of the modifications pertaining to 45 CFR 164.520:  Notice of Privacy Practices for Protected Health Information on Friday, March 22, looking at Content of Notice in subsection (b). Today, we focus on modifications to 164.520(c): Implementation specifications:  Provision of Notice, with modification in bold:

“(c) Implementation specifications:  Provision of Notice.  A covered entity must make the notice required by this section available on request to any person and to individuals as specified in paragraphs (c)(1) through (c)(3) of this section, as applicable.

(1) Specific requirements for health plans.  (i) a health plan must provide notice:

...

(B) Thereafter, at the time of enrollment, to individuals who are new enrollees.

…

(v) If there is a material change to the notice:

(A) A health plan that posts its notice on its web site in accordance with paragraph (c)(3)(i) of this section [Specific requirements for electronic notice] must prominently post the change or its revised notice on its web site by the effective date of the material change to the notice, and provide the revised notice, or information about the material change and how to obtain the revised notice, in its next annual mailing to individuals then covered by the plan.

(B) A health plan that does not post its notice on a web site pursuant to paragraph (c)(3)(i) of this section must provide the revised notice, or information about the material change and how to obtain the revised notice, to individuals then covered by the plan within 60 days of the material revision to the notice.

We provide here the content of the Final Rule preamble that underpins the Notice of privacy practices for protected health information:  Provision of Notice:

“Section 45 CFR 164.520(c)(1) of the final rule requires a health plan that currently posts its NPP on its Web site in accordance with164.520(c)(3)(i) to: (1) Prominently post the material change or its revised notice on its web site by the effective date of the material change to the notice (e.g., the compliance date of this final rule) and (2) provide the revised notice, or information about the material change and how to obtain the revised notice, in its next annual mailing to individuals then covered by the plan, such as at the beginning of the plan year or during the open enrollment period. Health plans that do not have customer service web sites are required to provide the revised NPP, or information about the material change and how to obtain the revised notice, to individuals covered by the plan within 60 days of the material revision to the notice. These requirements apply to all material changes including, where applicable, the rule change adopted pursuant to GINA to prohibit most health plans from using or disclosing genetic information for underwriting purposes.

“We believe these distribution requirements best balance the right of individuals to be informed of their privacy rights with the burden on health plans to provide the revised NPP. We also note that health plans should provide both paper- and web-based notices in a way accessible to all beneficiaries, including those individuals with disabilities. These modifications provide an avenue for an individual to be informed of material changes upon their effective date while better aligning the NPP distribution with health plans’ normal mailings to individuals.

“For health care providers, the final rule does not modify the current requirements to distribute revisions to the NPP. As such, 45 CFR 164.520(c)(2)(iv) requires that when a health care provider with a direct treatment relationship with an individual revises the NPP, the health care provider must make the NPP available upon request on or after the effective date of the revision and must comply with the requirements of 164.520(c)(2)(iii) to have the NPP available at the delivery site and to post the notice in a clear and prominent location. In response to several comments expressing concern about printing costs for new NPPs, we clarify that providers are not required to print and hand out a revised NPP to all individuals seeking treatment; providers must post the revised NPP in a clear and prominent location and have copies of the NPP at the delivery site for individuals to request to take with them. Providers are only required to give a copy of the NPP to, and obtain a good faith acknowledgment of receipt from, new patients. As a result, we do not believe that the current requirement is overly burdensome to providers, nor is it overly costly. We also clarify that while health care providers are required to post the NPP in a clear and prominent location at the delivery site, providers may post a summary of the notice in such a location as long as the full notice is immediately available (such as on a table directly under the posted summary) for individuals to pick up without any additional burden on their part. It would not be appropriate, however, to require the individual to have to ask the receptionist for a copy of the full NPP.

“To the extent that some covered entities have already revised their NPPs in response to the enactment of the HITECH Act or State law requirements, we clarify that as long as a covered entity’s current NPP is consistent with this final rule and individuals have been informed of all material revisions made to the NPP, the covered entity is not required to revise and distribute another NPP upon publication of this final rule. Finally, we note that to the extent a covered entity is required to comply with Section 504 of the Rehabilitation Act of 1973 or the Americans with Disabilities Act of 1990, the covered entity has an obligation to take steps that may be necessary to ensure effective communication with individuals with disabilities, which could include making the revised NPP or notice of material changes to the NPP available in alternate formats, such as Braille, large print, or audio.”

78 Federal Register 5625

Tomorrow is the effective date of the Final Rule discussed herein.

HIPAA Final Rule: Notice of Privacy Practices for Protected Health Information: Content of Notice (1)

Posted by Ed Jones III

March 22, 2013.  Today, we continue going through the HIPAA Privacy Rule, section by section, as modified in the Final Rule:  Modifications to the HIPAA Privacy, Security, Enforcement, and Breach Notification Rules Under the Health Information Technology for Economic and Clinical Health Act [HITECH Act] and the Genetic Information Nondiscrimination Act; Other Modifications of the HIPAA Rules, which was published in the Federal Register on January 25, 2013.  The effective date of the Final Rule is March 26, 2013, and covered entities and business associates must comply by September 23, 2013.

We begin a two-day examination of the modifications pertaining to 45 CFR 164.520:  Notice of Privacy Practices for Protected Health Information.  Today, we focus on modifications to 164.520(b): Implementation specifications:  Content of Notice, and Monday, March 25, on modifications to 164.520(c):  Implementation specifications: Provision of notice.

Modifications to 164.520(b):  Implementation specifications:  Content of notice

“(1) Required elements.

“(ii) Uses and disclosures

.  The notice must contain:

“(E) A description of the types of uses and disclosures that require an authorization under 45 CFR 164.508(a)(2)–(a)(4), a statement that other uses and disclosures not described in the notice will be made only with the individual’s written authorization, and a statement that the individual may revoke an authorization as provided by 164.508(b)(5).”

78 Federal Register 5701

Here are the provisions for 45 CFR 164.508 referenced in 164.520(b)(1)(ii)(E), with modifications shown in bold:

“(a)(2) Authorization required:  Psychotherapy notes.

“(a)(3) Authorization required:  Marketing.  (ii) If the marketing involves financial remuneration, as defined in paragraph (3) of the definition of marketing at 164.501, to the covered entity from a third party, the authorization must state that such remuneration is involved.

“(a)(4) Authorization required:  Sale of protected health information. (i) Notwithstanding any provision of [the HIPAA Privacy Rule], other than the transition provisions in 164.532, a covered entity must obtain an authorization for any disclosure of protected health information which is a sale of protected health information, as defined in 
164.501 of [the HIPAA Privacy Rule]. (ii) Such authorization must state that the disclosure will result in remuneration to the covered entity.

“(b)(5) Revocation of authorizations.”

78 Federal Register 5699

Continuing with the modifications to 45 CFR 164.520(b)(1):  Content of Notice:  Required elements:

“(iii) Separate statements for certain uses or disclosures

.  If the covered entity intends to engage in any of the following activities, the description required by paragraph (b)(1)(ii)(A) of this section must include a separate statement informing the individual of such activities, as applicable:

“(A) In accordance with 164.514(f)(1) [Fundraising communications: Standard:  Uses and disclosures for fundraising, as modified at 78 Federal Register 5700], the covered entity may contact the individual to raise funds for the covered entity and the individual has a right to opt out of receiving such communications;

“(B) In accordance with 164.504(f) [Standard:  Requirements for group health plans, as modified at 78 Federal Register 5698], the group health plan, or a health insurance issuer or HMO with respect to a group health plan, may disclose protected health information to the sponsor of the plan; or

“(C) If a covered entity that is a health plan, excluding an issuer of a long-term care policy falling within paragraph (1)(viii) of the definition of health plan, intends to use or disclose protected health information for underwriting purposes, a statement that the covered entity is prohibited from using or disclosing protected health information that is genetic information of an individual for such purposes.”

78 Federal Register 5701

Here are two references mentioned in the provisions immediately above:

In (iii), “(b)(1)(ii)(A)” is:  “ A description, including at least one example, of the types of uses and disclosures that the covered entity is permitted by [the HIPAA Privacy Rule] to make for each of the following purposes:  treatment, payment, and health care operations.”

In (C), “(1)(viii) of the definition of health plan” is:  “An issuer of a long-term care policy, excluding a nursing home fixed indemnity policy.”  78 Federal Register 5689

“(iv) Individual rights

.

“(A) The right to request restrictions on certain uses and disclosures or protected health information as provided by 45 CFR 164.522(a), including a statement that the covered entity is not required to agree to a requested restriction, except in case of a disclosure restricted under 164.522(a)(1)(vi); “

78 Federal Register 5701

Here is the content, as modified (in bold), for 164.522(a)(1)(vi), as referenced immediately above:

“A covered entity must agree to the request of an individual to restrict disclosure of protected health information about the individual to a health plan if:

(A) The disclosure is for the purpose of carrying out payment or health care operations and is not otherwise required by law; and

(B) The protected health information pertains solely to a health care item or service for which the individual, or person other than the health plan on behalf of the individual, has paid the covered entity in full.”

78 Federal Register 5701

“(v) Covered entity’s duties

.

“(A) A statement that the covered entity is required by law to maintain the privacy of protected health information, to provide individuals with notice of its legal duties and privacy practices with respect to protected health information, and to notify affected individuals following a breach of unsecured protected health information;”

78 Federal Register 5701

We provide here the content of the Final Rule preamble that underpins the Notice of privacy practices for protected health information:  Implementation specifications—Content of Notice, with reference to the modified provisions above:

“First, the final rule adopts the modification to 45 CFR 164.520(b)(1)(ii)(E), which requires certain statements in the NPP regarding uses and disclosures that require authorization. We note that, contrary to some commenter concerns, the final rule does not require the NPP to include a list of all situations requiring authorization. Instead, the NPP must contain a statement indicating that most uses and disclosures of psychotherapy notes (where appropriate), uses and disclosures of protected health information for marketing purposes, and disclosures that constitute a sale of protected health information require authorization, as well as a statement that other uses and disclosures not described in the NPP will be made only with authorization from the individual.

“The final rule does not require the NPP to include a description of a covered entity’s recordkeeping practices with respect to psychotherapy notes; however, covered entities are free to include such additional information in their NPP if they choose. Additionally, in response to requests by some commenters, we clarify that covered entities that do not record or maintain psychotherapy notes are not required to include a statement in their NPPs about the authorization requirement for uses and disclosures of psychotherapy notes.

“Second, because the final rule treats all subsidized treatment communications as marketing communications, we have not adopted the proposal to require a statement in the NPP about such communications and the ability of an individual to opt out….

“The final rule, however, adopts the proposed requirement for a statement in the NPP regarding fundraising communications and an individual’s right to opt out of receiving such communications, if a covered entity intends to contact an individual to raise funds for the covered entity. Because individuals will be provided the opportunity to opt out of fundraising communications with each solicitation, the final rule does not require the NPP to include the mechanism for individuals to opt out of receiving fundraising communications, although covered entities are free to include such information if they choose to do so.

“The final rule also adopts the proposal that the NPP inform individuals of their new right to restrict certain disclosures of protected health information to a health plan where the individual pays out of pocket in full for the health care item or service. Only health care providers are required to include such a statement in the NPP; other covered entities may retain the existing language indicating that a covered entity is not required to agree to a requested restriction.”

78 Federal Register 5624

On Monday, March 25, we present 45 CFR 164.520(c): Implementation specifications:  Provision of Notice.

HIPAA Final Rule: More on Uses and Disclosures of Protected Health Information of Decedents

Posted by Ed Jones III
HIPAA Final Rule: More on Uses and Disclosures of Protected Health Information of Decedents

Today, we continue going through the HIPAA Privacy Rule, section by section, as modified in the Final Rule:  Modifications to the HIPAA Privacy, Security, Enforcement, and Breach Notification Rules Under the Health Information Technology for Economic and Clinical Health Act [HITECH Act] and the Genetic Information Nondiscrimination Act; Other Modifications of the HIPAA Rules, which was published in the Federal Register on January 25, 2013.  The effective date of the Final Rule is March 26, 2013, and covered entities and business associates must comply by September 23, 2013.

Our focus yesterday was on the modified rule: 45 CFR 164.502(f): Standard:  Deceased individuals. Today, we finish up with a related modified rule: 164.510(b):  Disclosures about a decedent to family members and others involved in care, which is in 164.510(b)(5):

“Uses and disclosures when the individual is deceased. If the individual is deceased, a covered entity may disclose to a family member, or other persons identified in paragraph (b)(1) of this section who were involved in the individual’s care or payment for health care prior to the individual’s death, protected health information of the individual that is relevant to such person’s involvement, unless doing so is inconsistent with any prior expressed preference of the individual that is known to the covered entity.”

For reference, we provide modified 164.510(b)(1) here:

“(b) Standard:  Uses and disclosures for involvement in the individual’s care and notification purposes—(1) Permitted uses and disclosures.

"(i) A covered entity may, in accordance with paragraphs (b)(2), (b)(3), or (b)(5) of this section, disclose to a family member, other relative, or a close personal friend of the individual, or any other person identified by the individual, the protected health information directly relevant to such person’s involvement with the individual’s health care or payment related to the individual’s health care.

"(ii) A covered entity may use or disclose protected health information to notify, or assist in the notification of (including identifying or locating), a family member, a personal representative of the individual, or another person responsible for the care of the individual of the individual’s location, general condition, or death.  Any such use or disclosure of protected health information for such notification purposes must be in accordance with paragraphs (b)(2), (b)(3), (b)(4), or (b)(5) of this section, as applicable.”

78 Federal Register 5699

We provide here the content of the Final Rule preamble that underpins the Disclosure about a decedent to family members and others involved in care:

“The final rule adopts the proposal to amend 45 CFR 164.510(b) to permit covered entities to disclose a decedent’s protected health information to family members and others who were involved in the care or payment for care of the decedent prior to death, unless doing so is inconsistent with any prior expressed preference of the individual that is known to the covered entity.

“In response to commenters who opposed this provision, we believe the provision strikes the appropriate balance in allowing communications with family members and other persons who were involved in the individual’s care or payment for care prior to death, unless doing so is inconsistent with the prior expressed wishes of the individual. This will ensure family members and others can find out about the circumstances surrounding the death of their loved ones, unless the individual prior to his or her death objected to the covered entity making such communications. Further, the Privacy Rule limits such disclosures, similar to the other disclosures permitted under 164.510(b), to the protected health information relevant to the family member or other person’s involvement in the individual’s health care or payment for health care. For example, a covered health care provider could describe the circumstances that led to an individual’s passing with the decedent’s sister who is asking about her sibling’s death. In addition, a covered health care provider could disclose billing information to a family member of a decedent who is assisting with wrapping up the decedent’s estate. However, in both of these cases, the provider generally should not share information about past, unrelated medical problems. Finally, these disclosures are permitted and not required, and thus, a covered entity that questions the relationship of the person to the decedent or otherwise believes, based on the circumstances, that disclosure of the decedent’s protected health information would not be appropriate, is not required to make the disclosure.”

78 Federal Register 5615

Tomorrow, we begin two days presentation of modifications to the Notice of Privacy Practices for Protected Health Information.

HIPAA Final Rule: Protected Health Information of Deceased Individuals

Posted by Ed Jones III
HIPAA Final Rule: Protected Health Information of Deceased Individuals

March 12, 2013.  Today, we continue going through the HIPAA Privacy Rule, section by section, as modified in the Final Rule:  Modifications to the HIPAA Privacy, Security, Enforcement, and Breach Notification Rules Under the Health Information Technology for Economic and Clinical Health Act [HITECH Act] and the Genetic Information Nondiscrimination Act; Other Modifications of the HIPAA Rules, which was published in the Federal Register on January 25, 2013.  The effective date of the Final Rule is March 26, 2013, and covered entities and business associates must comply by September 23, 2013.

Our focus last week and early this week has been on 45 CFR 164.502: Uses and disclosures of protected health information:  General Rules.  Today, we finish up with this modified rule with: 164.502(f): Standard:  Deceased individuals.

“164.502(f): Standard:  Deceased individuals.  A covered entity must comply with the requirements of [the HIPAA Privacy Rule] with respect to the protected health information of a deceased individual for a period of 50 years following the death of the individual.”

We provide here the content of the Final Rule preamble that underpins the Uses and disclosures of protected health information:  General Rules pertaining to deceased individuals:

“We believe 50 years is an appropriate period of protection for decedent health information, taking into account the remaining privacy interests of living individuals after the span of approximately two generations have passed, and the difficulty of obtaining authorizations from a personal representative of a decedent as the same amount of time passes. For the same reason, we decline to shorten the period of protection as suggested by some commenters or to adopt a 100-year period of protection for decedent information. We also believe the 50-year period of protection to be long enough so as not to provide an incentive for covered entities to change their record retention policies in order to profit from the data about a decedent once 50 years has elapsed.

“With respect to commenters’ concerns regarding protected health information about decedents that is sensitive, such as HIV/AIDS, substance abuse, or mental health information, or that involves psychotherapy notes, we emphasize that the 50-year period of protection for decedent health information under the Privacy Rule does not override or interfere with State or other laws that provide greater protection for such information, or the professional responsibilities of mental health or other providers. Covered entities may continue to provide privacy protections to decedent information beyond the 50-year period, and may be required to do so under other applicable laws or as part of their professional responsibility. Alternatively, covered entities may choose to destroy decedent information although other applicable law may prescribe or limit such destruction.

“We also decline to limit protections under the Privacy Rule to a certain period beyond the last date in the medical record. While we appreciate the challenges that may be present in determining the date of death of an individual in cases in which it is not sufficiently clear from the age of the record whether the individual is deceased, we believe that this determination is necessary in closer cases to protect the individual, as well as living relatives and others, who may be affected by disclosure of the information. Further, as we stated in the [July 14, 2010, Notice of Proposed Rule Making], this modification has no impact on a covered entity’s disclosures permitted under other provisions of the Privacy Rule. For example, a covered entity is permitted to disclose protected health information of decedents for research that is solely on the information of decedents in accordance with 45 CFR 164.512(i)(1)(iii) [Uses and disclosures for which an authorization or opportunity to agree or object is not required], without regard to how long the individual has been deceased.

“Finally, we clarify that the 50-year period of protection is not a record retention requirement. The HIPAA Privacy Rule does not include medical record retention requirements and covered entities may destroy such records at the time permitted by State or other applicable law. (We note that covered entities are subject to the accounting requirements at 45 CFR 164.528 [Accounting of disclosures of protected health information] and, thus, would need to retain or record certain information regarding their disclosures of protected health information.) However, if a covered entity does maintain decedent health information for longer than 50 years following the date of death of the individual, this information will no longer be subject to the Privacy Rule.”

78 Federal Register 5614

Tomorrow, we look at a related modified HIPAA Privacy Rule pertaining to decedents:  45 CFR 164.510(b):  Disclosures about a decedent to family members and others involved in care.

HIPAA Final Rule: More on Business Associate Uses & Disclosures in the Business Associate Contract

Posted by Ed Jones III
HIPAA Final Rule: More on Business Associate Uses & Disclosures in the Business Associate Contract

March 11, 2013.  Today, we continue going through the HIPAA Privacy Rule, section by section, as modified in the Final Rule:  Modifications to the HIPAA Privacy, Security, Enforcement, and Breach Notification Rules Under the Health Information Technology for Economic and Clinical Health Act [HITECH Act] and the Genetic Information Nondiscrimination Act; Other Modifications of the HIPAA Rules, which was published in the Federal Register on January 25, 2013.  The effective date of the Final Rule is March 26, 2013, and covered entities and business associates must comply by September 23, 2013.

Our focus last week was on 45 CFR 164.502: Uses and disclosures of protected health information:  General Rules, and, on Friday, March 8, on 45 CFR 164.502(e):  “(1) Standard: Disclosures to business associates, and (2) Implementation specification: Documentation." Today, we focus on the modified provisions at 164.504(e)(1):  Uses and disclosures: Organizational requirements--Standard:  Business associate contracts, that were referenced in 45 CFR 164.502(e):  164.504(e)(1), (e)(2), (e)(3), and (e)(5).

"164.504(e)(1) Standard: Business associate contracts.

"(i) The contract or other arrangement required by 45 CFR 164.502(e)(2) must meet the requirements of paragraph (e)(2), (e)(3), or (e)(5) of this section, as applicable.

"(ii) A covered entity is not in compliance with the standards in 164.502(e) and this paragraph, if the covered entity knew of a pattern of activity or practice of the business associate that constituted a material breach or violation of the business associate’s obligation under the contract or other arrangement, unless the covered entity took reasonable steps to cure the breach or end the violation, as applicable, and, if such steps were unsuccessful, terminated the contract or arrangement, if feasible.

"(iii) A business associate is not in compliance with the standards in 164.502(e) and this paragraph, if the business associate knew of a pattern of activity or practice of a subcontractor that constituted a material breach or violation of the subcontractor’s obligation under the contract or other arrangement, unless the business associate took reasonable steps to cure the breach or end the violation, as applicable, and, if such steps were unsuccessful, terminated the contract or arrangement, if feasible.

"164.504(e)(2) Implementation specifications: Business associate contracts. A contract between the covered entity and a business associate must:

"(i) Establish the permitted and required uses and disclosures of protected health information by the business associate. The contract may not authorize the business associate to use or further disclose the information in a manner that would violate the requirements of [the HIPAA Privacy Rule], if done by the covered entity, except that:

"(A) The contract may permit the business associate to use and disclose protected health information for the proper management and administration of the business associate, as provided in paragraph (e)(4) [Implementation specifications:  Other requirements for contracts and other arrangements, at 78 Federal Register 5698] of this section; and

"(B) The contract may permit the business associate to provide data aggregation services relating to the health care operations of the covered entity.

"(ii) Provide that the business associate will:

"(A) Not use or further disclose the information other than as permitted or required by the contract or as required by law;

"(B) Use appropriate safeguards and comply, where applicable, with [the HIPAA Security Rule] with respect to electronic protected health information, to prevent use or disclosure of the information other than as provided for by its contract;

"(C) Report to the covered entity any use or disclosure of the information not provided for by its contract of which it becomes aware, including breaches of unsecured protected health information as required by 45 CFR 164.410 [Breach Notification Rule:  Notification by a business associate, as modified at 78 Federal Register 5695];

"(D) In accordance with
 164.502(e)(1)(ii), ensure that any subcontractors that create, receive, maintain, or transmit protected health information on behalf of the business associate agree to the same restrictions and conditions that apply to the business associate with respect to such information;

"(E) Make available protected health information in accordance with 164.524 [Access of individuals to protected health information, as modified at 78 Federal Register 5701-5702];

"(F) Make available protected health information for amendment and incorporate any amendments to protected health information in accordance with 164.526 [Amendment of protected health information];

"(G) Make available the information required to provide an accounting of disclosures in accordance with
§ 164.528 [Accounting of disclosures of protected health information];

"(H) To the extent the business associate is to carry out a covered entity’s obligation under [the HIPAA Privacy Rule], comply with the requirements of [the HIPAA Privacy Rule] that apply to the covered entity in the performance of such obligation.

"(I) Make its internal practices, books, and records relating to the use and disclosure of protected health information received from, or created or received by the business associate on behalf of, the covered entity available to the Secretary for purposes of determining the covered entity’s compliance with this subpart; and

"(J) At termination of the contract, if feasible, return or destroy all protected health information received from, or created or received by the business associate on behalf of, the covered entity that the business associate still maintains in any form and retain no copies of such information or, if such return or destruction is not feasible, extend the protections of the contract to the information and limit further uses and disclosures to those purposes that make the return or destruction of the information infeasible.

"(iii) Authorize termination of the contract by the covered entity, if the covered entity determines that the business associate has violated a material term of the contract.

"(e)(3) Implementation specifications: Other arrangements. (i) If a covered entity and its business associate are both governmental entities:

"(A) The covered entity may comply with this paragraph and 164.314(a)(1) [HIPAA Security Rule: Standard:  Business associate contracts or other arrangements, as modified at 78 Federal Register 5694], if applicable, by entering into a memorandum of understanding with the business associate that contains terms that accomplish the objectives of paragraph (e)(2) of this section and 164.314(a)(2) [Implementation specifications], if applicable.

"(B) The covered entity may comply with this paragraph and 164.314(a)(1), if applicable, if other law (including regulations adopted by the covered entity or its business associate) contains requirements applicable to the business associate that accomplish the objectives of paragraph (e)(2) of this section and 164.314(a)(2), if applicable.

"(ii) If a business associate is required by law to perform a function or activity on behalf of a covered entity or to provide a service described in the definition of business associate in 45 CFR 160.103 [as modified at 78 Federal Register 5688] to a covered entity, such covered entity may disclose protected health information to the business associate to the extent necessary to comply with the legal mandate without meeting the requirements of this paragraph and 164.314(a)(1), if applicable, provided that the covered entity attempts in good faith to obtain satisfactory assurances as required by paragraph (e)(2) of this section and 164.314(a)(1), if applicable, and, if such attempt fails, documents the attempt and the reasons that such assurances cannot be obtained.

"(iii) The covered entity may omit from its other arrangements the termination authorization required by paragraph (e)(2)(iii) of this section, if such authorization is inconsistent with the statutory obligations of the covered entity or its business associate.

"(iv) A covered entity may comply with this paragraph and 164.314(a)(1) if the covered entity discloses only a limited data set to a business associate for the business associate to carry out a health care operations function and the covered entity has a data use agreement with the business associate that complies with 164.514(e)(4) [Implementation specifications:  [Limited data set] Data use agreement, as modified at 78 Federal Register 5700] and
 164.314(a)(1), if applicable.

"(e)(5) Implementation specifications: Business associate contracts with subcontractors. The requirements of
 45 CFR 164.504(e)(2) through (e)(4) apply to the contract or other arrangement required by 164.502(e)(1)(ii) between a business associate and a business associate that is a subcontractor in the same manner as such requirements apply to contracts or other arrangements between a covered entity and business associate."

78 Federal Register 5697

On January 25, 2013, the Office for Civil Rights (OCR) of the Department of Health and Human Services (HHS) launched a Business Associate Contract Web site with Sample Business Associate Agreement Provisions that provides guidance to covered entities on preparing appropriate business associate agreements with required provisions, including those discussed in this posting.

Tomorrow, we close the presentation of 45 CFR 164.502 with 164.502(f):  Standard:  Deceased individuals.