Dusting off the NPP
Perhaps it’s not the biggest challenge within the proposed modifications to the accounting of disclosure provision, but it will require planning and budget. As the implementation date draws near, covered entities will be dusting off the master copy of their notice of privacy practices and distributing updated versions to consumers.
On May 31 the Office for Civil Rights published a proposed rule expanding an individual’s right to an accounting of disclosures of his or her protected information. The change, called for in the 2009 HITECH Act, will require that covered entities begin accounting for disclosures of protected health information made for purposes of treatment, payment, and healthcare operations if they maintain the information in an electronic format. These disclosures were previously exempt under HIPAA.
Within the rule OCR also proposed a new patient right to an access report. The report would name the individuals who accessed the patient’s information. The new right is intended to “ensure that individuals are receiving the information that is of most interest,” OCR wrote in the rule.
The changes would require healthcare providers revise their HIPAA notice of privacy practices documents to add the new rights to expanded disclosures and the new access report.
HIPAA requires that healthcare providers that directly treat patients must make the revised notice available upon request on or after the effective date of the revision. Those that maintain a “physician service delivery site” must post the notice and make it available to patients “promptly.”
The revisions, however, won’t be required any time soon. Covered entities need not revise their notices of privacy practices until the earliest applicable compliance date—either January 2013 or January 2014, depending on when they purchases their health IT system.
Though the proposed rule would require health plans to notify their members of the change in rights within 60 days of the revision’s effective date (as is required by the privacy rule), OCR acknowledged that this may be unreasonable and cause undue burden. One option OCR is considering would allow plans to notify individuals of the rights revisions in the plan’s next annual mailing distributed after the effective date.