APA Urges Improvements to HIPAA Privacy Rule

Patients will have the right to obtain a report indicating who has electronically accessed their protected health information under a notice of proposed rulemaking issued by the Department of Health and Human Services (HHS) on May 31 that applies to electronic medical records.

APA submitted comments on the proposal on July 19, generally supporting the agency's efforts to ensure patients' health-data privacy while limiting the administrative burden on physicians in compiling and sharing disclosure and access details.

The HHS proposal comprises two "distinct but complementary" elements: (1) an individual's right to an "accounting of disclosures" of his or her protected health information and (2) an individual's right to an "access report" that indicates who has accessed his or her information.

According to HHS, an accounting of disclosures would encompass both hard-copy and electronic protected health information that is maintained in a designated record set, while an access report would apply only to information maintained in an electronic designated record set. HHS defines a designated record set as "a group of records which a covered entity uses to make decisions about individuals, [including] a health care provider's medical records and billing records, and a health plan's enrollment, payment, claims adjudication, and case or medical management record systems."

Although an accounting-of-disclosures requirement already exists under the HIPAA privacy rule, HHS said its proposed modification would provide "an accounting of more detailed information for certain disclosures that are most likely to affect a person's rights or interests."

In its comments on the proposal, APA supported most of the modifications designed to enhance the protection of patient privacy, but offered the following suggestions on how HHS could further reduce the burden on physicians in complying with the regulations:

• Retain the current 60-day response period allowed for physicians to fulfill a patient's accounting request, instead of decreasing it to 30 days as proposed.

• Allow physicians to charge patients a fee when providing an accounting of disclosures.

• Offer psychiatrists some discretion in responding to accounting requests, as the "heightened sensitivities" of some psychiatric patients upon receiving this information could result in "significant emotional distress ... and/or a potential risk to clinicians or their business associates."

According to HHS, access reports would indicate the type of information accessed and the user's action upon obtaining the data, but would not inform a patient about the purposes of the access. HHS added that the creation of access reports is an automated process that should prove less burdensome to physicians than creating an accounting of disclosures.

"The inclusion of both uses and disclosures in the access report greatly increases the benefits to individual patients by providing a holistic picture of who has accessed their information," wrote APA Medical Director and CEO James H. Scully Jr., M.D., in his comments to HHS.

The agency has proposed that physicians and their business associates begin providing patients with the right to access reports on January 1, 2013, or January 1, 2014, depending on the age of the entities' electronic designated record systems.

The proposed rule is posted at <www.gpo.gov/fdsys/pkg/FR-2011-05-31/pdf/2011-13297.pdf>. APA's letter to HHS on the proposed changes to the privacy rule is posted at <www.psych.org/MainMenu/AdvocacyGovernmentRelations/GovernmentRelations/RegulatoryComments/HIPAA-Privacy-Rule-7-25-11.aspx?FT=.pdf>.