The rules having to do with patient access of records need to be reflected in every health care-related organization’s policies and procedures. The guidance provides clear and detailed information on how to provide access, what can be charged for in fees, and what the individual’s rights are when it comes to access of information. The rallying cry for easy patient access and transfer of information increases daily and is no longer escapable. The proposed changes to the HIPAA Privacy Rule would put into regulation the access guidance, and provide new avenues for patients to request copies of their records be sent to their current providers.
A recent Federal court decision changed some of the aspects of the individual access rules pertaining to transmitting records to third parties at the request of the individual. Additionally, HHS has issued guidance when HIPAA Business Associates are involved, regarding the responsibility for the timing, and form and format of replies to requests for access, and the responsibilities for compliance with the fee requirements. To top it off, individual access rules may be modified under the proposed HIPAA rule changes, reducing the time to provide requested information, and making access easier for individuals. The changes would also enable easier sharing of information for purposes of care coordination.
The COVID-19 Emergency has created new demands on communications, and has made clear the need to provide services remotely to the extent possible. Providers need to communicate more, between themselves and with their patients, and the time to implementation of new services to meet these needs is almost zero, leaving no room for the usual processes of approval and adoption that health care is used to. In order to facilitate the delivery of services and necessary communications during the emergency, the US Department of Health and Human Services has issued guidance relaxing some HIPAA requirements pertaining to teleconferencing tools and reiterating HIPAA allowances for communication with family and friends of patients.
Social distancing to help prevent the spread of the novel coronavirus is effective, but patient care has typically required a face-to-face encounter. It is essential to be able to provide telemedicine services in order to reach the most individuals without risking more harm. HHS has announced the relaxation of enforcement pertaining to the use of teleconferencing technologies to provide remote medical services, allowing the use of such services to expand quickly, but limits on "public-facing" conferencing technologies remain. Providers need to adopt the necessary technologies without fear of HIPAA violation enforcement actions during the COVID-19 Emergency and must understand the limits of what is permitted in order to best serve patients and their families.
HHS has also issued guidance to remind healthcare providers of the allowances for communications with family and friends, with disaster relief organizations, and to prevent a serious and imminent threat to the health or safety of individuals or the public.
This session will discuss the issues surrounding the use of various communication technologies under HIPAA controls, and the recent guidance and declarations from HHS about HIPAA and the response to COVID-19, including a discussion of Business Associate responsibilities for compliance under new guidance from HHS.
Why should you Attend:
Over many years, the heads of the US DHHS have indicated that patient access of information is a key priority in order to improve the health of the nation. Patient rights under HIPAA have been expanded to include several rights of access, and detailed guidance has been issued on access of records. And more than two dozen of the most recent HIPAA enforcement actions have been against entities that did not provide patient access to records properly. HHS is now using HIPAA Individual Access Rights to effectively implement new rules on prohibitions to Data Blocking.
HHS has also proposed changes to the HIPAA privacy rule to enhance patient access as well as ease the burdens of sharing information for purposes of care coordination, and other modifications that will require entities to update their Notices of Privacy Practices.
In addition, compliance activities relation to information security are continuing, with recent settlements for systemic noncompliance with the Security Rule, including the lack of risk analysis, policy development, and training activities related to information security. With the continuing threats of hackers and ransomware, good practices in information security can pay off if there’s a problem, as the HIPAA Safe Harbor Law calls for limited investigations and penalties, if good practices can be shown.
This session will look at the current state of HIPAA and identify recent guidance and court decisions affecting HIPAA, as well as expected changes in the rules in the coming year, and the focus and results of various HIPAA enforcement actions.
Areas Covered in the Session: