Erika Riethmiller (erika.riethmiller@uchealth.org) is Chief Privacy Officer at UCHealth Inc. in Aurora, CO.
On May 6, the comment period for the U.S. Department of Health & Human Services’ (HHS) notice of proposed rulemaking (NPRM) for Proposed Modifications to the HIPAA Privacy Rule to Support, and Remove Barriers to, Coordinated Care and Individual Engagement will close.[1] The stated aim of the NPRM, published in the Federal Register on January 21, was to support HHS’s Regulatory Sprint to Coordinated Care, led by the former HHS Deputy Secretary Eric Hargan under the Trump administration. The proposed changes outlined in the NPRM build on public comments previously received by HHS in response to a 2018 request for information on modifying the Health Insurance Portability and Accountability Act (HIPAA) rules to improve coordinated care.[2] Any final rule changes implemented as a result of the NPRM will be the first major modifications to HIPAA since 2013, when HIPAA was updated to reflect requirements mandated by the Health Information Technology for Economic and Clinical Health Act.[3] Now, several months into the new Biden administration, the question as to what future HHS rulemaking may hold for us as compliance professionals, under a potentially revised and updated Privacy Rule, is worth exploring.
A look back at 2020 provides insight into which parts of the last administration’s proposed changes may stay and which may go. Several major achievements, designed to improve how health data are shared in the United States, were realized in 2020 and align closely with proposed changes in the NPRM. In March 2020, final rules on interoperability and information blocking were published jointly by HHS’s Centers for Medicare & Medicaid Services and the Office of the National Coordinator for Health Information Technology (ONC).[4] These long-anticipated rules, which became effective this year, are designed to ensure a robust exchange of medical information among and between healthcare stakeholders, with particular focus on facilitating and enforcing patients’ rights to access their health information, encouraging interoperability among health information technology systems, prohibiting information blocking by key health industry stakeholders, and promoting value-basedcare.
Also in 2020, the Coronavirus Aid, Relief, and Economic Security (CARES) Act, passed by Congress in March to address the provision of healthcare during the COVID-19 pandemic, contained a “Miscellaneous Provisions” subsection in Subtitle A – Health Provisions.[5] This section contained changes that, for the first time in decades, changed federal law regarding confidentiality and disclosure requirements of substance use disorder (SUD) records regulated under 42 U.S.C. § 290dd-2 . This law, with its implementing regulations, is commonly known as 42 C.F.R. Part 2 . These changes, effective upon the president’s signing of the CARES Act into law, enhanced the ability of Part 2 providers to share SUD medical records with other non-Part 2 treatment providers to ensure safe and effective treatment plans for SUD patients. Congress’s stated intent was to better align Part 2 with HIPAA by addressing risks that patients’ SUD treatment would be withheld from other providers due to Part 2 restrictions, resulting in poor outcomes due to treatment occurring in the absence of complete information. Implementing regulations for the CARES Act changes to Part 2 was due out by the HHS secretary no later than March 27, 2021.
