The Department of Health and Human Services’ Office for Civil Rights has issued new guidance for HIPAA-covered entities to streamline HIPAA authorizations for uses of protected health information for research purposes, as required by the 21^st Century Cures Act of 2016.

Uses and Disclosure of PHI for Research

The HIPAA Privacy Rule does permit covered entities to use patients’ PHI for research without obtaining individual authorizations under certain circumstances, such as if documented Institutional Review Board (IRB) or Privacy Board Approval has been obtained – see 45 CFR § 164.512(i)(1)(i) and (ii). However, in most cases, prior to using patients’ PHI for research, individual authorizations must be obtained from patients in writing. Without a valid authorization from a patient, their PHI can only be used or disclosed for purposes permitted by the Privacy Rule.

The new guidance explains the content that must be included in individual authorizations to meet HIPAA requirements.

OCR explains that individual authorizations must:

• Be written in plain language to ensure they can be easily understood;
• Include, in a specific and meaningful fashion, a description of the information that will be used and disclosed;
• Include the names of the persons authorized to disclose and receive the information;
• A description of the purpose of the requested use or disclosure, and;
• An expiration date or expiration event after which the authorization will be invalid.

In addition, the individual authorization must make clear the following rights of the individual:

• The right to revoke authorization in writing and any exceptions to that right;
• Details of how that right can be exercised;
• The ability or inability to condition treatment, payment, enrollment, or eligibility for benefits on the authorization, and;
• The potential for information disclosed in accordance with the authorization to be redisclosed by the recipient and no longer be protected by the HIPAA Privacy Rule.

There has been some confusion about the content of individual authorizations with respect to future research, which may not have been determined at the time that the authorization is obtained. In such situations, the requirement to describe ‘each purpose’ that PHI will be used or disclosed may not be possible.

OCR has clarified that in such situations, specific future uses do not need to be described. Instead, to comply with 45 CFR § 164.508(c)(1)(iv) “the authorization must adequately describe such purposes such that it would be reasonable for the individual to expect that his or her protected health information could be used or disclosed for such future research.”

OCR also clarifies the requirement to include “an expiration date or an expiration event that relates to the individual or the purpose of the use or disclosure,” and explains it is sufficient “to state ‘end of the research study,’ ‘none,’ or similar language,” such as when the PHI will be included in the creation and maintenance of a research database or study repository. It is also permitted to state, “the authorization will remain valid unless and until it is revoked by the individual.”

While patients are given the right to revoke an authorization in writing at any time, there will be situations when exercising that right will not stop the individual’s PHI from being used in a particular research study. Patients should be made aware of this when giving their authorization.

“A covered entity may continue to use and disclose PHI that was obtained before the individual revoked authorization to the extent that the entity has taken action in reliance on the authorization,” explains OCR. “In cases where the research is conducted by the covered entity, the exception to revocation would permit the covered entity to continue using or disclosing the PHI to the extent necessary to maintain the integrity of the research —for example, to account for a subject’s withdrawal from the research study, to conduct investigations of scientific misconduct, or to report adverse events.”

OCR explains that it is not necessary for periodic reminders about the right to revoke authorization to be sent to patients as patients must be provided with a copy of the signed authorization in which their rights will be explained. However, covered entities are encouraged to implement procedures for revocation of authorizations such as creating a standard revocation form or adding current authorizations to a patient portal and allowing revocations to be submitted through that portal.

OCR’s Guidance on Individual Authorization of Uses and Disclosures of PHI for Research can be downloaded on this link (PDF).

The post OCR Issues Guidance on Individual Authorization of Uses and Disclosures of PHI for Research appeared first on HIPAA Journal.

The Department of Health and Human Services’ Office for Civil Rights is the primary enforcer of HIPAA Rules and has issued numerous financial penalties for HIPAA violations in response to complaints and data breaches. State attorneys general are also permitted to fine HIPAA-covered entities when violations of HIPAA Rules are discovered, and several state attorneys general have exercised that right. While the HHS’ Centers for Medicare & Medicaid Services is mandated to assist OCR with the enforcement of HIPAA Rules related to compliance with the HIPAA Administrative Simplifications, to date the CMS has not issued any fines.

The Medical Group Management Association (MGMA) believes that should change and the CMS should start enforcing compliance with HIPAA Rules that aim to reduce the administrative burden on healthcare providers.

In a recent letter to CMS, the MGMA explained it has received many complaints from members related to the failure of health plans to comply with HIPAA and ACA administrative simplification requirements. The lack of enforcement activity by the CMS in this area means there is no incentive for health plans to comply with the requirements relating to mandated transactions, national identifiers, code sets, and operating rules.

The letter, written by Anders Gilberg, MGA, Senior Vice President, Government Affairs, was submitted in response to a call for comments on the CMS complaint form. While comments specific to the complaint form were included in the letter, the MGMA also took it as an opportunity to criticize the CMS HIPAA administrative simplification enforcement process.

The CMS compliant form allows physician practices to formally file complaints against healthcare clearinghouses and health plans and notify CMS about HIPAA violations, although little action appears to be taken in response to those complaints.

MGMA explained in the letter that many health plans are not supporting national standards. Use of X12 270/271 (Eligibility & Benefit Verification) remains below 80%, X12 835 (Remittance Advice) is around 56%, use of the Electronic Funds Transfer transaction for payments has fallen from 62% to 60%, and use of the X12 278 (Prior Authorization) transaction has fallen from 18% to 8%.

MGMA notes that health plans are also trying to move providers away from using HIPAA standards to online portals. While there are benefits to the use of online portals, MGMA notes that “proprietary portals create a manual workflow process for providers and decreased revenue cycle automation.”

MGMA suggests CMS should step up its enforcement efforts to encourage health plans to comply with the HIPAA and ACA administrative simplification regulations. OCR has conducted HIPAA compliance audits, investigates complaints, and has issued multiple fines. Those fines are clearly communicated to the industry through news posts and press releases, making it clear that non-compliance will not be tolerated. OCR’s enforcement activities motivate HIPAA-covered entities to step up their efforts to comply with HIPAA Rules and also encourage individuals to report violations knowing that action will be taken.

“Health plans and clearinghouses unable or unwilling to support the administrative simplification standards and operating rules force providers to employ manual methods such as phone calls, facsimiles, and web portals, thus diverting scarce provider resources away from patient care,” wrote MGMA. Potentially millions of dollars in saving opportunities are going unrealized.

MGMA suggests CMS should implement random audits of health plans and healthcare clearinghouses to assess compliance with the administrative Simplifications, publish the names of covered entities that fail CMS audits, and list fines and corrective action plans that have been issued. MGMA also suggests the CMS should halt the voluntary Optimization Pilot for Administrative Simplification Transactions as it is likely to delay the commencement of an effective compliance-based audit program.

The post CMS Urged to Aggressively Enforce Compliance with HIPAA Administrative Simplifications appeared first on HIPAA Journal.