March 25, 2013.  Today, we continue going through the HIPAA Privacy Rule, section by section, as modified in the Final Rule:  Modifications to the HIPAA Privacy, Security, Enforcement, and Breach Notification Rules Under the Health Information Technology for Economic and Clinical Health Act [HITECH Act] and the Genetic Information Nondiscrimination Act; Other Modifications of the HIPAA Rules, which was published in the Federal Register on January 25, 2013.  The effective date of the Final Rule is March 26, 2013, and covered entities and business associates must comply by September 23, 2013.

We began a two-day examination of the modifications pertaining to 45 CFR 164.520:  Notice of Privacy Practices for Protected Health Information on Friday, March 22, looking at Content of Notice in subsection (b). Today, we focus on modifications to 164.520(c): Implementation specifications:  Provision of Notice, with modification in bold:

“(c) Implementation specifications:  Provision of Notice.  A covered entity must make the notice required by this section available on request to any person and to individuals as specified in paragraphs (c)(1) through (c)(3) of this section, as applicable.

(1) Specific requirements for health plans.  (i) a health plan must provide notice:

...

(B) Thereafter, at the time of enrollment, to individuals who are new enrollees.

…

(v) If there is a material change to the notice:

(A) A health plan that posts its notice on its web site in accordance with paragraph (c)(3)(i) of this section [Specific requirements for electronic notice] must prominently post the change or its revised notice on its web site by the effective date of the material change to the notice, and provide the revised notice, or information about the material change and how to obtain the revised notice, in its next annual mailing to individuals then covered by the plan.

(B) A health plan that does not post its notice on a web site pursuant to paragraph (c)(3)(i) of this section must provide the revised notice, or information about the material change and how to obtain the revised notice, to individuals then covered by the plan within 60 days of the material revision to the notice.

We provide here the content of the Final Rule preamble that underpins the Notice of privacy practices for protected health information:  Provision of Notice:

“Section 45 CFR 164.520(c)(1) of the final rule requires a health plan that currently posts its NPP on its Web site in accordance with164.520(c)(3)(i) to: (1) Prominently post the material change or its revised notice on its web site by the effective date of the material change to the notice (e.g., the compliance date of this final rule) and (2) provide the revised notice, or information about the material change and how to obtain the revised notice, in its next annual mailing to individuals then covered by the plan, such as at the beginning of the plan year or during the open enrollment period. Health plans that do not have customer service web sites are required to provide the revised NPP, or information about the material change and how to obtain the revised notice, to individuals covered by the plan within 60 days of the material revision to the notice. These requirements apply to all material changes including, where applicable, the rule change adopted pursuant to GINA to prohibit most health plans from using or disclosing genetic information for underwriting purposes.

“We believe these distribution requirements best balance the right of individuals to be informed of their privacy rights with the burden on health plans to provide the revised NPP. We also note that health plans should provide both paper- and web-based notices in a way accessible to all beneficiaries, including those individuals with disabilities. These modifications provide an avenue for an individual to be informed of material changes upon their effective date while better aligning the NPP distribution with health plans’ normal mailings to individuals.

“For health care providers, the final rule does not modify the current requirements to distribute revisions to the NPP. As such, 45 CFR 164.520(c)(2)(iv) requires that when a health care provider with a direct treatment relationship with an individual revises the NPP, the health care provider must make the NPP available upon request on or after the effective date of the revision and must comply with the requirements of 164.520(c)(2)(iii) to have the NPP available at the delivery site and to post the notice in a clear and prominent location. In response to several comments expressing concern about printing costs for new NPPs, we clarify that providers are not required to print and hand out a revised NPP to all individuals seeking treatment; providers must post the revised NPP in a clear and prominent location and have copies of the NPP at the delivery site for individuals to request to take with them. Providers are only required to give a copy of the NPP to, and obtain a good faith acknowledgment of receipt from, new patients. As a result, we do not believe that the current requirement is overly burdensome to providers, nor is it overly costly. We also clarify that while health care providers are required to post the NPP in a clear and prominent location at the delivery site, providers may post a summary of the notice in such a location as long as the full notice is immediately available (such as on a table directly under the posted summary) for individuals to pick up without any additional burden on their part. It would not be appropriate, however, to require the individual to have to ask the receptionist for a copy of the full NPP.

“To the extent that some covered entities have already revised their NPPs in response to the enactment of the HITECH Act or State law requirements, we clarify that as long as a covered entity’s current NPP is consistent with this final rule and individuals have been informed of all material revisions made to the NPP, the covered entity is not required to revise and distribute another NPP upon publication of this final rule. Finally, we note that to the extent a covered entity is required to comply with Section 504 of the Rehabilitation Act of 1973 or the Americans with Disabilities Act of 1990, the covered entity has an obligation to take steps that may be necessary to ensure effective communication with individuals with disabilities, which could include making the revised NPP or notice of material changes to the NPP available in alternate formats, such as Braille, large print, or audio.”

78 Federal Register 5625

Tomorrow is the effective date of the Final Rule discussed herein.

Today, we continue going through the HIPAA Privacy Rule, section by section, as modified in the Final Rule:  Modifications to the HIPAA Privacy, Security, Enforcement, and Breach Notification Rules Under the Health Information Technology for Economic and Clinical Health Act [HITECH Act] and the Genetic Information Nondiscrimination Act; Other Modifications of the HIPAA Rules, which was published in the Federal Register on January 25, 2013.  The effective date of the Final Rule is March 26, 2013, and covered entities and business associates must comply by September 23, 2013.

Our focus yesterday was on the modified rule: 45 CFR 164.502(f): Standard:  Deceased individuals. Today, we finish up with a related modified rule: 164.510(b):  Disclosures about a decedent to family members and others involved in care, which is in 164.510(b)(5):

“Uses and disclosures when the individual is deceased. If the individual is deceased, a covered entity may disclose to a family member, or other persons identified in paragraph (b)(1) of this section who were involved in the individual’s care or payment for health care prior to the individual’s death, protected health information of the individual that is relevant to such person’s involvement, unless doing so is inconsistent with any prior expressed preference of the individual that is known to the covered entity.”

For reference, we provide modified 164.510(b)(1) here:

“(b) Standard:  Uses and disclosures for involvement in the individual’s care and notification purposes—(1) Permitted uses and disclosures.

"(i) A covered entity may, in accordance with paragraphs (b)(2), (b)(3), or (b)(5) of this section, disclose to a family member, other relative, or a close personal friend of the individual, or any other person identified by the individual, the protected health information directly relevant to such person’s involvement with the individual’s health care or payment related to the individual’s health care.

"(ii) A covered entity may use or disclose protected health information to notify, or assist in the notification of (including identifying or locating), a family member, a personal representative of the individual, or another person responsible for the care of the individual of the individual’s location, general condition, or death.  Any such use or disclosure of protected health information for such notification purposes must be in accordance with paragraphs (b)(2), (b)(3), (b)(4), or (b)(5) of this section, as applicable.”

78 Federal Register 5699

We provide here the content of the Final Rule preamble that underpins the Disclosure about a decedent to family members and others involved in care:

“The final rule adopts the proposal to amend 45 CFR 164.510(b) to permit covered entities to disclose a decedent’s protected health information to family members and others who were involved in the care or payment for care of the decedent prior to death, unless doing so is inconsistent with any prior expressed preference of the individual that is known to the covered entity.

“In response to commenters who opposed this provision, we believe the provision strikes the appropriate balance in allowing communications with family members and other persons who were involved in the individual’s care or payment for care prior to death, unless doing so is inconsistent with the prior expressed wishes of the individual. This will ensure family members and others can find out about the circumstances surrounding the death of their loved ones, unless the individual prior to his or her death objected to the covered entity making such communications. Further, the Privacy Rule limits such disclosures, similar to the other disclosures permitted under 164.510(b), to the protected health information relevant to the family member or other person’s involvement in the individual’s health care or payment for health care. For example, a covered health care provider could describe the circumstances that led to an individual’s passing with the decedent’s sister who is asking about her sibling’s death. In addition, a covered health care provider could disclose billing information to a family member of a decedent who is assisting with wrapping up the decedent’s estate. However, in both of these cases, the provider generally should not share information about past, unrelated medical problems. Finally, these disclosures are permitted and not required, and thus, a covered entity that questions the relationship of the person to the decedent or otherwise believes, based on the circumstances, that disclosure of the decedent’s protected health information would not be appropriate, is not required to make the disclosure.”

78 Federal Register 5615

Tomorrow, we begin two days presentation of modifications to the Notice of Privacy Practices for Protected Health Information.

March 12, 2013.  Today, we continue going through the HIPAA Privacy Rule, section by section, as modified in the Final Rule:  Modifications to the HIPAA Privacy, Security, Enforcement, and Breach Notification Rules Under the Health Information Technology for Economic and Clinical Health Act [HITECH Act] and the Genetic Information Nondiscrimination Act; Other Modifications of the HIPAA Rules, which was published in the Federal Register on January 25, 2013.  The effective date of the Final Rule is March 26, 2013, and covered entities and business associates must comply by September 23, 2013.

Our focus last week and early this week has been on 45 CFR 164.502: Uses and disclosures of protected health information:  General Rules.  Today, we finish up with this modified rule with: 164.502(f): Standard:  Deceased individuals.

“164.502(f): Standard:  Deceased individuals.  A covered entity must comply with the requirements of [the HIPAA Privacy Rule] with respect to the protected health information of a deceased individual for a period of 50 years following the death of the individual.”

We provide here the content of the Final Rule preamble that underpins the Uses and disclosures of protected health information:  General Rules pertaining to deceased individuals:

“We believe 50 years is an appropriate period of protection for decedent health information, taking into account the remaining privacy interests of living individuals after the span of approximately two generations have passed, and the difficulty of obtaining authorizations from a personal representative of a decedent as the same amount of time passes. For the same reason, we decline to shorten the period of protection as suggested by some commenters or to adopt a 100-year period of protection for decedent information. We also believe the 50-year period of protection to be long enough so as not to provide an incentive for covered entities to change their record retention policies in order to profit from the data about a decedent once 50 years has elapsed.

“With respect to commenters’ concerns regarding protected health information about decedents that is sensitive, such as HIV/AIDS, substance abuse, or mental health information, or that involves psychotherapy notes, we emphasize that the 50-year period of protection for decedent health information under the Privacy Rule does not override or interfere with State or other laws that provide greater protection for such information, or the professional responsibilities of mental health or other providers. Covered entities may continue to provide privacy protections to decedent information beyond the 50-year period, and may be required to do so under other applicable laws or as part of their professional responsibility. Alternatively, covered entities may choose to destroy decedent information although other applicable law may prescribe or limit such destruction.

“We also decline to limit protections under the Privacy Rule to a certain period beyond the last date in the medical record. While we appreciate the challenges that may be present in determining the date of death of an individual in cases in which it is not sufficiently clear from the age of the record whether the individual is deceased, we believe that this determination is necessary in closer cases to protect the individual, as well as living relatives and others, who may be affected by disclosure of the information. Further, as we stated in the [July 14, 2010, Notice of Proposed Rule Making], this modification has no impact on a covered entity’s disclosures permitted under other provisions of the Privacy Rule. For example, a covered entity is permitted to disclose protected health information of decedents for research that is solely on the information of decedents in accordance with 45 CFR 164.512(i)(1)(iii) [Uses and disclosures for which an authorization or opportunity to agree or object is not required], without regard to how long the individual has been deceased.

“Finally, we clarify that the 50-year period of protection is not a record retention requirement. The HIPAA Privacy Rule does not include medical record retention requirements and covered entities may destroy such records at the time permitted by State or other applicable law. (We note that covered entities are subject to the accounting requirements at 45 CFR 164.528 [Accounting of disclosures of protected health information] and, thus, would need to retain or record certain information regarding their disclosures of protected health information.) However, if a covered entity does maintain decedent health information for longer than 50 years following the date of death of the individual, this information will no longer be subject to the Privacy Rule.”

78 Federal Register 5614

Tomorrow, we look at a related modified HIPAA Privacy Rule pertaining to decedents:  45 CFR 164.510(b):  Disclosures about a decedent to family members and others involved in care.