Who Accessed My Health Records? Recommendation for Quality over Quantity in Access Reports

By Kathie McDonald-McClure, Ann F. Triebsch and Margaret Young Levi

Group of Healthcare Professionals
Accounting for Disclosures Would Include Disclosures of PHI to All Staff

The Office of National Coordinator (ONC) Health IT Policy Committee voted in December 2013 to recommend that the United States Department of Health & Human Services (HHS) scale back its 2011 proposed rules requiring covered entities to provide patients with reports showing the name of every staff member who accessed their information in an electronic health record (EHR). As reported by Government Health IT, the committee’s Privacy and Security Tiger Team opposes a requirement that entities covered by the Health Insurance Portability & Accountability Act of 1996 (HIPAA) give such broad “accounting of disclosure” reports to patients. Continue reading

CMS Extends Stage 2 Meaningful Use through 2016

Keyboard and stethoscopeOn Friday, November 6, 2013, the Centers for Medicare & Medicaid Services (CMS) and the Office of National Coordinator of Health Information Technology (ONC) announced its proposal to extend the timeline by which eligible healthcare providers must demonstrate a “meaningful use” (MU) of a certified electronic health record (EHR) in compliance with the MU Stage 2 criteria set forth in regulations issued pursuant to the Health Information Technology for Economic and Clinical Health (HITECH) Act of 2009.   Originally, eligible providers who demonstrated Stage 1 MU by the end of 2013 would have had to demonstrate at least 3 months of Stage 2 MU by September 30, 2014 for eligible hospitals and critical access hospitals (CAHs) and by December 31, 2014 for eligible professionals, do one more year of Stage 2 in 2015, and then move to Stage 3 by 2016.  The CMS – ONC apparently will give all eligible providers more time to stay in Stage 2, stating: “Under the revised timeline, Stage 2 will be extended through 2016 and Stage 3 will begin in 2017 for those providers that have completed at least two years in Stage 2.” In essence, the start of Stage 3 is being delayed and, apparently (pending further rule making), nothing else.

Continue reading

Conducting HIPAA Breach Risk Assessments Using the “LoProCo” Analysis

by Margaret Young Levi and Kathie McDonald-McClure

clip_image009The U.S. Department of Health & Human Services Office for Civil Rights (“OCR”) has a new acronym, “LoProCo,” relating to assessing data breaches under HIPAA, as amended by the Health Information Technology for Economic and Clinical Health (HITECH) Act of 2009 and the HIPAA Omnibus Rule that became effective March 26, 2013.

It is OCR’s position that a breach is Continue reading

Technical Corrections to HIPAA Omnibus Rule Released

The U.S. Department for Health & Human Services (HHS) announced it is releasing technical corrections to the HIPAA Omnibus Rule tomorrow. These technical corrections are “to address public comment received on the interim final Breach Notification Rule, and to make certain other modifications to the HIPAA Rules to improve their workability and effectiveness and to increase flexibility for and decrease burden on the regulated entities.” HHS “determined that the corrections in this final rule are minor, routine determinations in which the public would not be particularly interested, or about which the public has already been put on notice, given the context of the errors or omissions to be corrected.”

These technical corrections are scheduled to be published on June 7, 2013, but until then, you can download the pre-publication, PDF version here.

HHS Announces Dramatic Increase in Adoption of Electronic Health Records

Doctors Using EHROn May 22, 2013, Kathleen Sebelius,  Secretary of the United States Health & Human Services Department, announced that over 50 percent of doctors and over 80 percent of hospitals are making a “meaningful use” of electronic health records (EHRs) and have received incentives for such use.   By comparison, in 2008, just nine percent had adopted EHRs.  Secretary Sebelius credits the “dramatic increase” in adoption of EHRs to the Health Information Technology for Economic and Clinical Health Act (HITECH Act) that was passed as part of the American Recovery and Reinvestment Act of 2009 (ARRA).  The HITECH Act awards incentives to eligible professionals (physicians) and hospitals who make a “meaningful use” of EHR technology that has been certified by the HHS Office of National Coordinator of Health Information Technology (ONC).  The HHS press release with further information is available here.