Source: https://www.federalregister.gov/articles/2011/05/31/2011-13297/hipaa-privacy-rule-accounting-of-disclosures-under-the-health-information-technology-for-economic
Timestamp: 2016-06-25 08:42:48
Document Index: 298246195

Matched Legal Cases: ['§ 164', '§ 164', '§ 164', '§ 164', '§ 164', '§ 164', '§ 164', '§ 164', '§ 164', '§ 164', '§ 164', '§ 164', '§ 164', '§ 164', '§ 164', '§ 164', '§ 164', '§ 164', '§ 164', '§ 164', '§ 164', '§ 164', '§ 164', '§ 164', '§ 164', '§ 164', '§ 164', '§ 164', '§ 164', '§ 164', '§ 164', 'art 3', '§ 164', '§ 164', '§ 164', '§ 164', '§ 164', '§ 160', '§ 160', '§ 164', '§ 160', '§ 164', '§ 164', '§ 164', 'art 164', 'art 164', 'ART 164', 'art 164', '§ 164', '§ 164', '§ 164', '§ 164', '§ 164', '§ 164', '§ 164']

Dates: Submit comments on or before August 1, 2011.
-31449 (25 pages)
0991-AB62
Document Number: 2011-13297
Shorter URL: https://federalregister.gov/a/2011-13297 Related Topics
HIPAA Privacy Rule Accounting of Disclosures under the Health Information Technology for Economic and Clinical Health Act 2 actions from May 31st, 2011 to August 1st, 2011
76 FR 31426
A. The Accounting of Disclosures Under the Current Privacy Rule
B. Changes Required by the HITECH Act
IV. Section-by-Section Description of Proposed Rule
1. Standard: Right to an Accounting of Disclosures
2. Implementation Specification: Content of the Accounting
3. Implementation Specification: Provision of Accounting
4. Implementation Specification: Law Enforcement and Health Oversight Delay
5. Implementation Specification: Documentation
B. Right to an Access Report—Section 164.528(b)
1. Standard: Right to an Access Report
2. Implementation Specification: Content of the Access Report
3. Implementation Specification: Provision of the Access Report
4. Implementation Specification: Documentation
5. Accounting for Disclosures That Are Made Through Electronic Health Information Exchange
C. Confidentiality of Patient Safety Work Product
D. Notice of Privacy Practices—Section 164.520
B. Why are we proposing these regulations?
1. What are the current regulations?
2. What are we proposing?
3. What would be the impact of changes to accounting of disclosures requirements?
4. What would be the impact of adding the right to an access report?
5. What alternatives did we consider?
C. How much will it cost covered entities to notify individuals of their new privacy rights?
2. Estimated Annualized Burden Hours
Table 1—Number of Entities by NAICS Code1
You may submit comments, identified by RIN 0991-AB62, by any of the following methods (please do not submit duplicate comments):
Hand Delivery or Courier: Office for Civil Rights, Attention: HIPAA Privacy Rule Accounting of Disclosures, Hubert H. Humphrey Building, Room 509F, 200 Independence Avenue, SW., Washington, DC 20201. Please submit one original and two copies. (Because access to the interior of the Hubert H. Humphrey Building is not readily available to persons without Federal government identification, commenters are encouraged to leave their comments in the mail drop slots located in the main lobby of the building.)
The discussion below includes a description of the statutory and regulatory background of the proposed rule, a section-by-section description of the proposed modifications, and the impact statement and other required regulatory analyses. We solicit public comment on the proposed rule.
The Health Insurance Portability and Accountability Act of 1996 (HIPAA), title II, subtitle F—Administrative Simplification, Pubic Law 104-191, 110 Stat. 2021, provided for the establishment of national standards to protect the privacy and security of personal health information. The Administrative Simplification provisions of HIPAA apply to three types of entities, which are known as “covered entities”: health care providers who conduct covered health care transactions electronically, health plans, and health care clearinghouses.
Section 164.528(a)(1) provides that an accounting must include all disclosures of protected health information, except for disclosures:
To correctional institutions or law enforcement officials as provided in § 164.512(k)(5); As part of a limited data set in accordance with § 164.514(e); or
For disclosures for research in accordance with § 164.512(i) (such as disclosures subject to an Institutional Review Board's waiver of authorization) involving 50 or more individuals, § 164.528(b)(4) permits the covered entity to provide a list of research protocols rather than specific information about each disclosure. Accordingly, an individual who requests an accounting of disclosures may receive a list of research protocols with information about each protocol, including contact information, rather than specific information about disclosures for research.
The current accounting provision applies to disclosures of paper and electronic protected health information, regardless of whether such information is in a designated record set. While the obligation to provide an individual with an accounting of disclosures falls to the covered entity, the accounting must include disclosures to and by its business associates. Business associates are required, as a term of their business associate agreements, to make available the information required for the covered entity's accounting.
Section 13405(c) of the Health Information Technology for Economic and Clinical Health (HITECH) Act, Title XIII of Division A and Title IV of Division B of the American Recovery and Reinvestment Act of 2009 (ARRA) (Pub. L. 111-5), provides that the exemption at § 164.528(a)(1)(i) of the Privacy Rule for disclosures to carry out treatment, payment, and health care operations no longer applies to disclosures “through an electronic health record.” Section 13400 of the HITECH Act defines an electronic health record (“EHR”) as “an electronic record of health-related information on an individual that is created, gathered, managed, and consulted by authorized health care clinicians and staff.” Under section 13405(c), an individual has a right to receive an accounting of such disclosures made during the three years prior to the request. With respect to disclosures by business associates through an EHR to carry out treatment, payment, and health care operations on behalf of the covered entity, section 13405(c) requires the covered entity to provide either an accounting of the business associates' disclosures, or a list and contact information of all business associates (enabling the individual to contact each business associate for an accounting of the business associate's disclosures).
The HITECH Act provides that the effective date of the new accounting requirement for HIPAA covered entities that have acquired an EHR after January 1, 2009, is January 1, 2011, or the date that it acquires an EHR, whichever is later. For covered entities that acquired EHRs prior to January 1, 2009, the effective date is January 1, 2014. The statute authorizes the Secretary to extend both of these compliance deadlines to no later than 2013 and 2016, respectively.
On May 3, 2010, HHS published a request for information (RFI) seeking further information on individuals' interests in learning of disclosures, the burdens on covered entities in accounting for disclosures, and the capabilities of current technology. We received approximately 170 comments from numerous organizations representing health plans, health care providers, privacy advocates, and other non-covered entities. These comments are summarized below and were considered when drafting this proposed rule.
The first question in the RFI asked about the potential benefits to individuals from receiving an accounting of disclosures, particularly an accounting that included disclosures for treatment, payment, and health care operations. Approximately 10 respondents representing both consumers and covered entities endorsed the benefits of such an accounting in order to foster transparency and patient trust, as well as to discourage inappropriate behavior. Commenters pointed out that the use of audit trails and the right to an accounting of disclosures improves the detection of breaches and assists with the identification of weaknesses in privacy and security practices. Roughly 10 commenters representing covered entities agreed generally that there are potential benefits to transparency, but questioned whether general accountings would provide the type of information that individuals usually seek. The majority of comments, contributed mostly by covered entities, indicated that providing an accounting of treatment, payment, and health care operations disclosures would provide little to no benefit to individuals (over 80 respondents), while incurring substantial administrative, staffing and monetary burdens (over 120 respondents).
The final question of the RFI requested any other information that would be helpful to the Department regarding accounting for disclosures through an EHR to carry out treatment, payment, and health care operations. A large percentage of the comments expressed concerns with the burdens that this new accounting of disclosures requirement would create. These comments cited increased health care costs, reduced patient care time resulting from disruptions in provider workflow, and a potential chilling effect on the adoption of EHR systems, particularly for small providers. In addition, we received suggestions and requests for clarification on the scope of EHRs, disclosures, and disclosures through an EHR.
III. Overview of Proposed Rule Back to Top
We are proposing to revise § 164.528 of the Privacy Rule by dividing it into two separate rights for individuals: paragraph (a) would set forth an individual's right to an accounting of disclosures and paragraph (b) would set forth an individual's right to an access report (which would include electronic access by both workforce members and persons outside the covered entity). Our revisions to the right to an accounting of disclosures are based on our general authority under HIPAA and are intended to improve the workability and effectiveness of the provision. The right to an access report is based in part on the requirement of section 13405(c) of the HITECH Act to provide individuals with information about disclosures through an EHR for treatment, payment, and health care operations. This right to an access report is also based in part on our general authority under HIPAA, in order to ensure that individuals are receiving the information that is of most interest.
We are proposing that covered entities (including small health plans) and business associates comply with the modifications to the accounting of disclosures requirement beginning 180 days after the effective date of the final regulation (240 days after publication). We are proposing that covered entities and business associates provide individuals with a right to an access report beginning January 1, 2013, for electronic designated record set systems acquired after January 1, 2009, and beginning January 1, 2014, for electronic designated record set systems acquired as of January 1, 2009.
IV. Section-by-Section Description of Proposed Rule Back to Top
The following describes the provisions of the proposed rule section by section. Those interested in commenting on the proposed rule can assist the Department by preceding discussion of any particular provision or topic with a citation to the section of the proposed rule being discussed. While we request comment on several specific questions, we welcome comments on any aspects of the proposed rule.
We are proposing the following modifications to the existing accounting of disclosures requirements to improve the workability of the requirements and to better focus the requirements on providing the individual with information about those disclosures that are most likely to impact the individual's legal and personal interests, while taking into account the administrative burdens on covered entities and business associates.
Paragraph (a)(1)(i) of the proposed rule would maintain the general standard that an individual has a right to receive an accounting of disclosures by a covered entity or business associate, but would include a number of changes to this right. Specifically, we propose to change the scope of information subject to the accounting to the information about an individual in a designated record set, to explicitly include business associates in the language of the standard, to change the accounting period from six years to three years, and to list the types of disclosures that are subject to the accounting (rather than listing the types of disclosures that are exempt from the accounting).
Paragraph (a)(1)(i) also would address which disclosures are subject to the accounting requirement. We propose to explicitly list the types of disclosures that are subject to the accounting requirement. In contrast, under the current Privacy Rule, § 164.528 provides that disclosures are generally subject to the accounting requirement, but then lists a series of exceptions. We believe that by explicitly listing the exceptions, but not the types of disclosures that are subject to the accounting requirement, the current regulatory language may make it difficult to easily and readily understand the types of disclosures that are subject to the accounting requirement. Thus, our proposed rule takes the opposite approach and explicitly lists the types of disclosures that are subject to the accounting requirement.
As previously stated, the proposed rule explicitly lists the types of disclosures that are subject to the accounting requirement, rather than the previous approach of listing the types of disclosures for which an accounting was not required. Despite this change in regulatory approach, the following disclosures continue to be excluded from the accounting requirement: (i) To individuals of protected health information about them as provided in § 164.502; (ii) incident to a use or disclosure otherwise permitted or required by the Privacy Rule, as provided in § 164.502; (iii) pursuant to an authorization as provided in § 164.508; (iv) for the facility's directory or to persons involved in the individual's care or other notification purposes as provided in § 164.510; (v) for national security or intelligence purposes as provided in § 164.512(k)(2); (vi) to correctional institutions or law enforcement officials as provided in § 164.512(k)(5); (vii) as part of a limited data set in accordance with § 164.514(e); or (viii) that occurred prior to the compliance date for the covered entity. How these exceptions are treated for purposes of the access report is discussed below. Disclosures to carry out treatment, payment and health care operations as provided in § 164.506 would continue to be exempt for paper records. However, in accordance with section 13405(c) of the HITECH Act, an individual would be able to obtain information (such as the name of the person accessing the information) for all access to electronic protected health information stored in a designated record set for purposes of treatment, payment and health care operations.
We also request comment on whether the Department should exempt from the accounting requirements certain categories of disclosures that are currently subject to the accounting. In particular, for the reasons discussed below, we are proposing to exclude disclosures about victims of abuse, neglect, or domestic violence under § 164.512(c); disclosures for health oversight activities under § 164.512(d); disclosures for research purposes under § 164.512(i);
In this proposed rule, we are also considering removing from the accounting requirement disclosures for research under § 164.512(i), which includes research where an Institutional Review Board (IRB) or Privacy Board has waived the requirement for individual authorization because, among other reasons, it determined that the study poses no more than a minimal risk to the privacy of individuals and the waiver is needed to conduct the research.
The Department is considering excluding research disclosures from the accounting requirements because, even though the Privacy Rule includes this simplified accounting option for research disclosures to large studies, the Department continues to hear concerns from the research community regarding the administrative burden of the accounting requirements and the potentially resulting chilling effect the requirements have on human subjects research. For example, the Secretary's Advisory Committee for Human Research Protections (SACHRP) in its September 2004 letter to the Secretary recommended that the Department exempt research disclosures from the accounting requirements altogether. SACHRP indicated that a research protocol listing may be very extensive at larger institutions and the requirement for a covered entity to assist individuals in contacting the researchers and research sponsors places an unreasonable burden on covered entities. SACHRP further indicated that, since the accounting requirements apply only to research “disclosures” and not “uses,” whether access by researchers within institutions to protected health information must be accounted for depends entirely on whether the researchers are workforce members (uses) or physicians with staff privileges (disclosures), which is an “artificial” distinction. See Appendix A to SACHRP's September 27, 2004 letter to the Secretary, available at http://www.hhs.gov/ohrp/sachrp/appendixa.html.
Similarly, in a report on ways to enhance privacy and improve health through research, the Institute of Medicine (IOM) concluded that the Privacy Rule's current accounting provision for research disclosures places a heavy administrative burden on health systems and health services research but achieves little in terms of protecting privacy. Beyond the HIPAA Privacy Rule: Enhancing Privacy, Improving Health through Research, Institute of Medicine of the National Academies p. 51 (2009) (available at http://www.iom.edu). The IOM report recommended that the Department revise the Privacy Rule to exempt disclosures made for research from the Privacy Rule's accounting requirement. As an alternative, the IOM suggested that all institutions should maintain a list, accessible to the public, of all studies approved by an IRB/Privacy Board.
In addition, in paragraph (a)(1)(ii), we propose to make clear that most disclosures that fall under paragraph (a)(1)(i) (i.e., are for a purpose that would otherwise be subject to the accounting) but that are also required by law do not require an accounting. For example, if a disclosure to a public health authority or for workers' compensation is required by law (rather than merely authorized by law), then the covered entity or business associate is not required to include such a disclosure in a requested accounting. We propose, however, that covered entities and business associates account for disclosures for judicial and administrative proceedings and for law enforcement purposes, even when such disclosures are required by law. This is consistent with our general treatment of such disclosures under § 164.512(a)(2), where we provide that a disclosure that is required by law but that also falls within the law enforcement or judicial and administrative proceeding provisions at § 164.512(e) and (f) must meet the latter's requirements. As indicated above, we believe that disclosures for law enforcement purposes and judicial and administrative proceedings directly implicate an individual's legal and/or personal interests and thus believe the individual should have a right to learn of such disclosures.
If a covered entity has been subject to the Privacy Rule for less than three years, then the covered entity only need account for the period of time during which the covered entity was subject to the Rule.
Currently, the Privacy Rule at § 164.528(b)(2) requires an accounting of disclosures to include the date of disclosure, name and (if known) address of the recipient, a brief description of the type of protected health information disclosed, and a brief statement of the purpose of the disclosure. We are proposing to maintain these elements, but with some minor modifications.
Additionally, as in the current Privacy Rule, an individual may be required to pay for an accounting of disclosures if the covered entity has already provided the individual with an accounting within the prior twelve months. The individual should not have to pay for an accounting report that covers a three-year period if the individual is trying to learn of disclosures that occurred over a more limited period of time. Similarly, we expect that a covered entity can significantly reduce the cost of generating an accounting of disclosures by narrowing the scope of the report to that which is of interest to the individual.
Covered entities are permitted to also offer other options to individuals for how to limit an accounting request. For example, a covered entity may provide the individual with the option to limit the accounting of disclosures to disclosures by a specific organization, such as disclosures by the covered entity or disclosures by a particular business associate.
In paragraph (a)(3), we are proposing requirements regarding the provision of an accounting of disclosures, such as the timeframe for providing the accounting, the form of the request, and permissible charges for an accounting. We are proposing three modifications to the existing regulatory requirements: (a) Decreasing the permissible response time from 60 days to 30 days; (b) requiring that covered entities provide individuals with the accounting in the form and format requested by the individual if readily producible (e.g., an electronic copy of the accounting); and (c) clarifying that the covered entity may require the individual to submit the accounting request in writing.
Finally, we continue to provide that the covered entity may not charge for the first request for an accounting in a 12-month period, but may charge a reasonable and cost-based fee for providing an accounting in response to subsequent requests in the 12-month period (which may include the reasonable costs of including disclosures by business associates). The proposed rule requires the covered entity to inform the individual at the time of the first accounting request that all subsequent requests in the 12-month period may be subject to a fee. The proposed rule also requires the covered entity to inform the individual of the fee at the time of the subsequent request and to provide the individual with an opportunity to withdraw or modify the request in order to avoid or reduce the fee.
In paragraph (a)(4), we are proposing to retain the requirement for covered entities to delay the provision of an accounting of disclosures based on an ongoing law enforcement investigation. This request for delay by law enforcement is not subject to challenge. We also clarify in the proposed rule that if law enforcement requests a delay, a covered entity shall still account for all other disclosures in accordance with § 164.528(a) and shall supplement the accounting with information about the law enforcement disclosures upon expiration of the requested law enforcement delay. We propose to no longer include a delay for a health oversight investigation since we are proposing that disclosures for health oversight activities are no longer subject to the accounting requirements.
We propose at paragraph (a)(5) to revise the documentation requirements for the accounting of disclosures. The current rule provides that covered entities must document and retain the information necessary to generate an accounting of disclosures, a copy of the written accounting that is provided to the individual, and the titles of the persons or offices responsible for receiving and processing requests for an accounting by individuals in accordance with § 164.530(j). Section 164.530(j)(1)(ii) provides that if the Privacy Rule requires a communication to be in writing, then the covered entity must maintain the writing or an electronic copy of the writing as documentation. Similarly, § 164.530(j)(1)(iii) provides that if the Privacy Rule requires an action, activity, or designation to be documented, then the covered entity must maintain a written or electronic record of such action, activity, or designation. Section 164.530(j)(2) provides that any documentation required under § 164.530(j)(1) be retained for six years from the date of its creation or the date when it was last in effect, whichever is later. Accordingly, under the current rule, a covered entity must maintain for six years the information necessary to generate an accounting of disclosures, the written accounting that is provided to an individual, and the designation of the persons or offices responsible for receiving and processing accounting requests. In the case of the designation of who is responsible for handling accounting requests, the covered entity must retain the designation for six years from the date when it was last in effect.
We are proposing two changes to the documentation requirements. First, because we are proposing to reduce the accounting period from six years to three years, we do not believe there is a need to retain information that is solely being retained in order to provide an accounting of disclosures for more than three years. Of course, covered entities and business associates may choose to retain this information longer based on other legal requirements or internal policies. Second, we are revising the regulatory language to clarify that a covered entity must retain a copy of the accounting provided to the individual, and not the original accounting document. Accordingly, under the proposed rule, a covered entity must maintain the documentation necessary to generate an accounting of disclosures for three years (rather than for the six-year retention period that is set forth at § 164.530(j)), must retain a copy of any accounting that was provided to an individual for six years from the date the accounting was provided, and must retain documentation of the designation of who is responsible for handling accounting requests for six years from the last date the designation was in effect.
In addition to the right to an accounting of disclosures, we are proposing to provide individuals with a right to receive an access report that indicates who has accessed their electronic designated record set information (this right does not extend to access to paper records). In the below discussion of the proposed right to an access report, we refer to both “access logs” and “access reports.” For purposes of this discussion, the access log is the raw data that an electronic system containing protected health information collects each time a user (as the term is defined in the Security Rule at § 164.304) accesses information. The access report is a document that a system administrator or other appropriate person generates from the access log in a format that is understandable to the individual.
We propose to expand this privacy right beyond the statutory provision for a number of reasons. First, we believe that individuals are interested in learning who has accessed their information without regard to whether the access is internal (a use) or by a person outside the covered entity and its business associates (a disclosure). We believe that the inclusion of both uses and disclosures in the access report significantly increases the benefits to individuals by providing a more complete picture of who has accessed their information. We do not believe that the inclusion of “uses” of designated record set information in the access report represents an unreasonable burden on covered entities and business associates. In response to our RFI, most covered entity commenters indicated that their system is unable to automatically distinguish between uses and disclosures of information. Accordingly, the inclusion of all access, rather than only access that represents a disclosure, may actually be less burdensome on covered entities and business associates than the alternative of configuring systems to distinguish between uses and disclosures of information.
We note that section 13405(c)(3) of the HITECH Act specifies that a covered entity may provide either an accounting that includes disclosures by business associates or an accounting that is limited to its own disclosures and a list of business associates (with contact information for each business associate). Under the second option, the individual would then need to contact each business associate to learn of any disclosures. We believe that the second option places an undue burden on the individual. First, the individual generally will not have a relationship with many of the business associates and therefore may feel uncomfortable contacting them. Second, some of the business associates may not even have designated record set information and thus may have no information to provide to the individual. Accordingly, we are exercising our general authority under the HIPAA statute to propose that the covered entity's access report include uses and disclosures by business associates of electronic designated record set information maintained by the business associates, rather than merely providing a listing of business associates.
In paragraph (b)(2), we propose that the access report must set forth: (a) The date of access; (b) the time of access; (c) the name of the natural person, if available, otherwise the name of the entity accessing the electronic designated record set information; (d) a description of what information was accessed, if available; and (e) a description of the action by the user, if available (e.g.,“create,” “modify,” “access,” or “delete”). We expect that any access report will be readily capable of providing the date and time of access and the user name, and in many cases can also provide information about what information was accessed and the user's action (such as create, modify, print, etc.).
We are not proposing to require that access reports include a description of the purpose of the access. In response to our RFI, a majority of commenters indicated that we should not require that an accounting of disclosures for treatment, payment, and health care operations include the purpose of the disclosure. Commenters stated that this information is not currently captured when protected health information is accessed, and requiring the information would represent a significant disruption of workflow. The majority of commenters also indicated that individuals did not have a good understanding of terms such as “health care operations.” A minority of commenters (approximately 20%, representing consumers and covered entities) indicated that inclusion of the purpose of the disclosure is essential to a meaningful accounting. In addition to the RFI, we have received anecdotal reports that identifying the purpose of a disclosure is sometimes important, but that more often individuals are most interested in learning who has accessed their information.
We note that we have not proposed that the access report include the ultimate recipient of the electronic protected health information, unless the recipient is the natural person or entity with direct access to the electronic protected health information (see clarification above regarding documenting action by the user in the access report). We believe that this information, as well as the purpose of the access, is generally not captured by systems currently available today. As such, we have not proposed the same exceptions as for the accounting of disclosures requirement (e.g., for a law enforcement delay, or for reports to a government agency of suspected child abuse), since information that may merit an exception would not be included within the access report.
We are recommending—although not requiring—that covered entities offer individuals the option to limit the access report to specific organizations. For example, if the individual is not interested in learning of access at business associates, there is no reason for the covered entity to contact business associates to obtain their access reports. Conversely, if the individual is interested in learning about access at a particular business associate, then the covered entity need not run an internal access report nor obtain access reports from business associates other than the one that is of interest to the individual.
The above is not understandable because it is coded and requires the use of an external guide.
We are proposing at paragraph (b)(3)(i) the same timing requirements for provision of an access report as for provision of an accounting of disclosures. Accordingly, a covered entity would have 30 days to provide the access report, including the logs of business associates that create, receive, maintain or transmit electronic designated record set information. The covered entity may extend the time by 30 days where necessary, as long as the covered entity provides the individual with a written statement that includes the reason for the delay and the date by which the covered entity will provide the access report. The covered entity is only permitted one extension of time.
We are also proposing, in paragraph (b)(3)(iv), that the covered entity may require individuals to make requests for an access report in writing provided that it informs the individual of such a requirement. This same language is currently found in § 164.524 (access of individuals to protected health information) and § 164.526 (amendment of protected health information). As we discussed with respect to the provision of the accounting of disclosures, we encourage covered entities to create forms for individuals to request an access report that provides information about the information the individual will receive and allows the individual to narrow the request based on the individual's interests. We believe that it is in both the covered entity's and individual's best interests to use written requests to narrow access reports, so that the individual only receives the information of interest, and the covered entity does not have the administrative burden of responding to an overly broad request.
We are proposing at paragraph (b)(4) the same documentation requirements for access reports as for accountings of disclosures. Accordingly, we propose that a covered entity or business associate must retain the documentation needed to produce an access report (e.g., the necessary access log) for three years (rather than for the six-year retention period that is set forth at § 164.530(j)), the covered entity must retain for six years copies of access reports that were provided to individuals, and must maintain a designation of the persons or offices responsible for receiving and processing requests for access reports for six years from the last date the designation was in effect.
In addition to the right to an access report, we also considered providing individuals with the right to receive a full accounting for treatment, payment, and health care operations disclosures through an EHR when such disclosures are made through electronic health information exchange (i.e., disclosures that originate from an EHR that are received by another electronic system). For example, such a proposal would have required a full accounting, including a description of the purpose of the disclosure, when a covered entity or business associate transmits some or all of an EHR to another electronic system (such as another covered entity's EHR, a pharmacy, laboratory, or health plan). This would have included health information exchange when the disclosure is in response to a query, and health information exchange that is initiated by the disclosing covered entity.
After careful consideration of this option, we concluded that accounting for such disclosures at this time would be overly burdensome when compared to the potential benefit to individuals. Especially for EHR technology that is not certified pursuant to ONC standards and certification criteria, covered entities might need to make substantial and costly modifications to their existing EHR systems in order to track the purpose of disclosures for treatment, payment, and health care operations. However, as electronic health information exchange expands and standards for such exchange are adopted, we intend to work with ONC to assess whether such standards should include information about the purpose of each exchange transaction. Adoption of such standards may significantly reduce the burden on covered entities to account for treatment, payment, and health care operations disclosures through electronic health information exchange. We then intend to revisit this issue and determine whether the accounting requirements should be revised to encompass such disclosures, in light of the interests of individuals and the reduced burden on covered entities.
We note that, despite not proposing to adopt the above option with respect to treatment, payment, and health care operations disclosures, individuals still have a right to learn of disclosures through electronic health information exchange if such disclosures fall under proposed paragraph (a)(1), such as disclosures for public health. Additionally, each time electronic designated record set information is accessed for purposes of electronic health information exchange (regardless of the purpose of the exchange), the date, time, and identity of the user will be captured in the access report.
We recognize that there may be times when a covered entity or business associate may disclose electronic designated record set information to a patient safety organization pursuant to the Patient Safety and Quality Improvement Rule at 42 CFR part 3, which implements the Patient Safety and Quality Improvement Act of 2005.
Accordingly, we propose at paragraph (c) that a covered entity shall exclude from an accounting or access report under § 164.528 any information that meets the definition of patient safety work product at 42 CFR 3.20. This will avoid any conflicts between the two sets of regulations.
Under the Privacy Rule at § 164.520, a covered entity is required to provide an individual with a notice of privacy practices that includes descriptions of the individual's rights under the Privacy Rule. Section 164.520(b)(1)(iv)(E) provides that the notice must contain a statement of the individual's right to receive an accounting of disclosures of protected health information as provided by § 164.528. We are proposing to revise § 164.520(b)(1)(iv)(E) to also require a statement regarding an individual's right under the proposed rule to receive an access report.
However, even if the 60-day deadline to inform individuals of material changes is not modified by the Department in the other HITECH Act and/or GINA rulemakings, we believe that the cost to health plans to revise and distribute notices under this rule can be minimized in light of the lengthy compliance period we are considering. For example, a health plan can minimize its mailing costs by including notice of the new right to an access report in an annual mailing prior to the date that notification is required under § 164.520(c)(1)(i)(C) (i.e., prior to March 2, 2013, or 2014, the dates that are 60 days after the 2013 and 2014 compliance deadlines).
We propose separate compliance dates for the changes to the accounting of disclosures requirements and for the right to receive an access report. We propose that covered entities and business associates will be required to comply with the revised accounting of disclosures provision by no later than 180 days after the effective date of the final rule. The effective date of the final rule will be 60 days after publication in the Federal Register, so covered entities and business associates will have 240 days after publication of the final rule to come into compliance. This is consistent with our proposed changes to § 160.105 found in the notice of proposed rulemaking published at 75 FR 40,868, July 14, 2010. That proposal would establish at § 160.105 a 180-day compliance period for future modifications to the HIPAA Rules, unless otherwise specifically provided.
We believe that this compliance period is reasonable in light of current obligations on covered entities and business associates. For example, covered entities should currently be able to produce an accounting of disclosures on request. Business associates should currently be able to provide accounting information to a covered entity on request. The proposed changes to the existing accounting for disclosures requirements generally would streamline the requirements and otherwise make compliance easier, as well as shorten the accounting period from six years to three years. Therefore, we expect that covered entities and business associates can implement these changes expeditiously.
Under our proposed rule, access reports must cover a three-year period and covered entities and business associates must retain their access log information for three years. Because covered entities should already be maintaining access logs pursuant to the Security Rule, we believe that it is reasonable to require covered entities to produce access reports, upon request, covering access over the prior three years beginning on the proposed January 1, 2013, and January 1, 2014, compliance dates. We request comment on whether covered entities will be able to generate access reports covering the preceding three years on these compliance dates.
We have prepared a regulatory impact statement in compliance with Executive Order 12866 (September 1993, Regulatory Planning and Review), the Regulatory Flexibility Act (RFA) (September 19, 1980, 96), the Unfunded Mandates Reform Act of 1995 (Pub. L. 104-4), and Executive Order 13132 on Federalism.
Although we expect the economic impact of issuing privacy notices and the possibility of other non-quantifiable costs and savings discussed in the regulatory analysis below to be less than $100 million annually, we nevertheless conducted analysis of the costs of the proposed regulations.
The RFA requires agencies to analyze options for regulatory relief of small businesses if a rule has a significant impact on a substantial number of small entities. We present our regulatory flexibility analysis of this proposed rule in Section D below.
With respect to health insurers and third party administrators, the SBA size standard is $7.0 million in annual receipts. While some insurers are classified as nonprofit, it is possible they are dominant in their market. For example, a number of Blue Cross/Blue Shield insurers are organized as nonprofit entities; yet they dominate the health insurance market in the States where they are licensed. In addition, we lack the detailed information on annual receipts for insurers and plan administrators and, therefore, we do not know how many firms qualify as small entities. We welcome comments on the number of small entities in the health insurer and health plan administrator market.
Section 202 of the Unfunded Mandates Reform Act of 1995 (UMRA) requires that agencies assess anticipated costs and benefits before issuing any rule whose mandates would require spending in any one year of $100 million in 1995 dollars, updated annually for inflation. In 2010, that threshold is approximately $135 million. UMRA does not address the total cost of a rule. Rather, it focuses on certain categories of cost, mainly those “Federal mandate” costs resulting from: (1) Imposing enforceable duties on State, local, or tribal governments, or on the private sector; or (2) increasing the stringency of conditions in, or decreasing the funding of, State, local, or tribal governments under entitlement programs. We estimate the costs of the proposed rule will be approximately $20.2 million, largely due to the revision of privacy notices. This amount is not sufficient to warrant an analysis of costs and benefits under the UMRA provisions. However, as we explained under EO 12688, we are conducting an analysis of the costs that could result from the proposed rule.
In considering the principles in and requirements of Executive Order 13132, the Department has determined that these proposed modifications to the Privacy Rule will not significantly affect the rights, roles, and responsibilities of the States.
Section 13405(c) of the HITECH Act directs the Secretary to promulgate regulations requiring covered entities to account for disclosures of protected health information through an EHR for purposes of treatment, payment, and health care operations. In issuing the regulations, the Secretary is to balance the burden imposed on covered entities with the interests of individuals to know about the disclosure of their protected health information.
We are proposing these regulations to provide individuals with the expanded right to an accounting that is provided for in section 13405(c), to provide individuals with a more complete accounting through the right to receive an access report that includes information on each time a covered entity's or business associate's electronic designated record set information is accessed, and to improve the workability and effectiveness of the current accounting provision through a number of additional changes.
The current rule at § 164.528 provides an individual the right to an accounting of disclosures of his or her protected health information. A disclosure is defined at § 160.103 as “the release, transfer, provision of access to, or divulging in any other manner of information outside the entity holding the information.” An individual whose protected health information has been disclosed has the right to receive an accounting of such disclosures. This accounting does not include certain categories of disclosures, such as those for treatment, payment, or health care operations, based on an authorization, or to family, friends, and others involved in the individual's care (for a full list of the current exemptions from the accounting requirement, see § 164.528(a)(1)).
Additionally, §§ 164.308 and 164.312 of the Security Rule require covered entities to maintain and periodically review reports of who accesses electronic protected health information. Under current regulations, while covered entities are required to log access to individuals' electronic protected health information, covered entities do not have to provide the information from these access logs to individuals. 2. What are we proposing?
Under the proposed § 164.528, the section will be divided into an individual's right to receive an accounting of disclosures and a right to receive an access report. The access report would be limited to only electronic protected health information in a designated record set. For each time that electronic designated record set information is accessed, whether by a member of the covered entity's or business associate's workforce (a use) or by someone outside the organizations (a disclosure), an access report would include the date and time of the access, the identity of the person accessing the information, and, if available, a description of the information that was accessed and what actions were taken while in the system (e.g., create, modify, view, print, etc.). The covered entity would be required to permit the individual to narrow the request for an access report to a specific time frame or person. Covered entities would be required to provide the access report in the electronic form and format requested by the individual, if readily producible, unless otherwise requested by the individual in such other form and format as agreed to by the parties.
The requirements governing the accounting of disclosures would be modified in several ways. The current requirement to disclose six years of disclosures would be reduced to three years. Covered entities would no longer be required to provide the full accounting for certain categories of disclosures that are currently subject to the accounting requirement, such as disclosures that are required by law and for health oversight purposes (though limited information about such disclosures would be captured in the access report to the extent that they involve direct access to electronic designated record set information). The accounting requirement would be limited to disclosures of information about an individual in a designated record set, rather than disclosures of any protected health information. The proposal would reduce the time permitted for a covered entity to respond to a request for an accounting of disclosures from 60 days to 30 days. A covered entity still could use a one-time extension of 30 days. A covered entity also would be required to provide individuals with the option of limiting their request to a specific timeframe, type of disclosure, or recipient. Finally, covered entities would be required to provide the accounting in the form and format requested by the individual if readily producible, otherwise in a readable hard copy form or such other form and format as agreed to by the parties.
We believe that the proposed changes will benefit individuals by reducing the amount of time it takes for them to receive an accounting of disclosures. While we propose to exclude a number of categories of disclosures from the accounting requirements, as discussed in the preamble we have proposed to exclude disclosures that we believe are of limited interest to individuals. Accordingly, we believe the more limited scope of the accounting provision will not significantly diminish the benefit of the accounting, since individuals will continue to have a right to receive a full accounting for the disclosures that are most likely to have an immediate impact on their interests, such as disclosures for law enforcement, judicial proceedings, or public health investigations.
We have limited information on how long it takes to respond to an accounting request under the current rule. The information that we have received has suggested that not more than 30 days is needed to respond to an accounting request under the current rule. Furthermore, our proposed rule will reduce the scope of information that is subject to an accounting. Accordingly, we believe there will be little burden on covered entities to respond to requests in 30 days, rather than 60 days. In circumstances where more than 30 days is needed, we continue to permit a single 30-day extension. We solicit public comment on this issue.
We believe that the proposed right to an access report will provide a significant benefit to all individuals by providing them a means to learn who has accessed their electronic protected health information. This offers a significant benefit over the current accounting rule in that it provides individuals an opportunity to learn of access by members of the covered entity's workforce.
The covered entity must produce within 30 days the access report in the electronic form and format requested by the individual, if readily producible, unless the individual requests another mutually agreed upon format. We thus also request comment on the additional burden, if any, of providing electronic access reports (either in machine readable or other electronic format).
The provision permitting individuals to limit their requests to a time period or person may limit the burden to produce an access report. Yet, modifying a standard report may require additional programming which would increase burden on the covered entity and business associates. We solicit comment on the effects of this provision.
In light of the language of section 13405(c), we considered applying the access report requirements to only disclosures for treatment, payment, and health care operations through an EHR. We chose to expand the requirements for access reports to all electronic designated record set information because we believe that all such systems should be capable of logging access. We also believed that limiting the rule to EHR systems would lead to confusion among covered entities, business associates, and individuals regarding which systems were subject to the accounting provision. We chose to include uses, in addition to disclosures, because we believe that individuals have an interest in learning of access to their information by members of a covered entity's and business associate's workforces, and because it may be difficult for covered entities and business associates to distinguish between uses and disclosures through the use of automated systems.
We also considered requiring access reports to include the purpose of the disclosure. However, we believed the burden of collecting such information significantly outweighed the interests of most individuals in learning of such information, especially with respect to older EHR systems (where the burden of modifying systems may be highest). We will continue to reassess this option and to work with ONC to evaluate whether information about the purpose of disclosures should be part of future standards, such as standards governing electronic health information exchange.
Covered entities must provide individuals with notices of privacy practices that detail how the covered entity may use and disclose protected health information and individuals' rights with respect to their own health information. Beginning on January 1, 2013, individuals would have the right to receive a report of who accessed their electronic protected health information that covers a three-year period from the date of the request. Covered entities would have to revise their privacy notices to reflect this change.
The cost analysis for revising privacy notices is divided into an analysis of provider costs and an analysis of plan and insurer costs. For providers, given that the requirements described in this rule only require modification of one sentence in the notice of privacy practices, we estimate that drafting the updated notices will require approximately one-third of an hour of professional, legal time at approximately $90 per hour—or $30—that includes hourly wages of $60 plus 50 percent.
The total cost for attorneys for the approximately 669,000
With the exception of a few large health plans, most health plans do not self-administer their plans. The majority of plans are administered either by health insurance issuers (approximately 1,000) or by third party administrators that act on their behalf in the capacity as business associates. We identified approximately 3,500 third party administrators acting as business associates for approximately 446,400 ERISA plans identified by the Department of Labor. In addition, the Department of Labor identified 20,300 public non-Federal health plans that may use third party administrators. Almost all of the public and ERISA plans, we believe, employ third party administrators to administer their health plans. While the third party administrators will bear the direct costs of issuing the revised notices of privacy practices, the costs will generally be passed on to the plans that contract with them. Those plans that self-administer their own plans will also incur the costs of issuing the revised notices. We do not know how many plans administer as well as sponsor health plans and invite comments on the number of self-administered plans; however, unless there were many such plans it would not have much effect on these estimates.
1Office of Advocacy, Small Business Administration, http://www.sba.gov/advo/research/data.html.
2Centers for Medicare and Medicaid Service covered entities.
3The National Association of Chain Drug Stores.
Nursing Facilities (Nursing Care Facilities, Residential Mental Retardation Facilities, Residential Mental Health and Substance Abuse Facilities, Community Care Facilities for the Elderly, Continuing Care Retirement Communities)
6211-6213
Outpatient Care Centers (Family Planning Centers, Outpatient Mental Health and Drug Abuse Centers, Other Outpatient Health Centers, HMO Medical Centers, Kidney Dialysis Centers, Freestanding Ambulatory Surgical and Emergency Centers, All Other Outpatient Care Centers)
Durable Medical Equipment Suppliers2
Heath Insurance Carriers
The Regulatory Flexibility Act requires agencies that issue a proposed rule to analyze and consider options for reducing regulatory burden if the regulation will impose a significant burden on a substantial number of small entities. The Act requires the head of the agency to either certify that the rule would not impose such a burden or perform a regulatory flexibility analysis and consider alternatives to lessen the burden.
The proposed rule would have an impact on covered health care providers, health insurance issuers, and third party administrators acting on behalf of health plans, which we estimate to be 673,324. Of the approximately $20.2 million in costs we are able to identify, the private sector will incur approximately 100 percent of the costs, or $20.2 million. The average cost per covered entity is therefore approximately $30. We do not view this as a significant burden. We note that the 3,500 third party administrators included in this calculation serve as business associates to the approximately 446,000 ERISA plans, most of which are small entities. We have no information on how many of these plans self-administer, and we request any data the public may provide on this question. Based on the relatively small cost per covered entity, the Secretary certifies that the proposed rule would not have a significant impact on a substantial number of small entities. However, because we are not certain of all the costs this rule may impose or the exact number of small health insurers or third party administrators, we welcome comments that may further inform our analysis.
VII. Collection of Information Requirements Back to Top
Under the Paperwork Reduction Act of 1995 (PRA), agencies are required to provide a 60-day notice in the Federal Register and solicit public comment before a collection of information requirement is submitted to the Office of Management and Budget (OMB) for review and approval. In order to fairly evaluate whether an information collection should be approved by OMB, section 3506(c)(2)(A) of the PRA requires that we solicit comment on the following issues:
Under the PRA, the time, effort, and financial resources necessary to meet the information collection requirements referenced in this section are to be considered. We explicitly seek, and will consider, public comment on our assumptions as they relate to the PRA requirements summarized in this section. To comment on this collection of information or to obtain copies of the supporting statement and any related forms for the proposed paperwork collections referenced above, e-mail your comment or request, including your address and phone number, to sherette.funncoleman@hhs.gov, or call the Reports Clearance Office on (202) 690-6162. Written comments and recommendations for the proposed information collections must be directed to the OS Paperwork Clearance Officer at the above e-mail address within 60 days.
Section 13405(c) of the HITECH Act requires the Secretary to promulgate regulations to require covered entities to account for disclosures to carry out treatment, payment, and health care operations through an EHR. In this notice of proposed rulemaking, we propose to implement modifications that are partly required by section 13405(c) of the HITECH Act and partly based on our general authority under HIPAA by requiring covered entities to provide an individual with an access report upon request that includes information about each time that electronic protected health information in a designated record set is accessed. We also propose, based on our general authority under HIPAA, to modify the existing right to an accounting of disclosures to improve the effectiveness and workability of the provision. We seek public comment on our proposals.
We propose to require covered entities and business associates to maintain the information necessary to generate accountings of disclosures and access reports for three years. With respect to accountings of disclosures, this is a shortening of the retention period and therefore should reduce their information collection burden. With respect to access reports, covered entities and business associates should already be collecting and retaining this information in accordance with their obligations under the Security Rule and their business associate agreements, and furthermore should be collecting and maintaining access logs as part of their usual and customary business.
Revision of Notice of Privacy Practices for Protected Health Information
List of Subjects in 45 CFR Part 164 Back to Top
For the reasons set forth in the preamble, the Department proposes to amend 45 CFR Subtitle A, Subchapter C, part 164, as set forth below:
PART 164—SECURITY AND PRIVACY Back to Top
1. The authority citation for part 164 is revised to read as follows:
42 U.S.C. 1302(a); 42 U.S.C. 1320d-1320d-9; sec. 264, Pub. L. 104-191, 110 Stat. 2033-2034 (42 U.S.C. 1320-2(note)); and secs. 13400—13424, Pub. L. 111-5, 123 Stat. 258-279.
§ 164.528 Accounting of disclosures of protected health information and access report.
(D) A brief description of the purpose of the disclosure that reasonably informs the individual of the basis for the disclosure or, in lieu of such description, a copy of a written request for a disclosure under § 164.512, if any. (ii) The covered entity shall provide the individual with the option to limit the accounting of disclosures to a specific time period, type of disclosure, or recipient.
(3) Implementation specification: Provision of the access report.
(i) The covered entity must act on the individual's request for an access report no later than 30 days after receipt of such a request, as follows.
(iii)(A) The covered entity must provide the first access report to an individual in any 12-month period without charge and inform the individual at the time of the request that there may be a fee for each subsequent request for an access report by the individual within the 12-month period. (B) The covered entity may impose a reasonable, cost-based fee for each subsequent request for an access report by the same individual within the 12-month period, provided that the covered entity informs the individual of the fee at the time of the subsequent request and provides the individual with an opportunity to withdraw or modify the request for a subsequent access report in order to avoid or reduce the fee.
[FR Doc. 2011-13297 Filed 5-27-11; 8:45 am]
1. Disclosures of limited data sets for research purposes under § 164.514(e) and disclosures for research purposes pursuant to an individual's authorization under § 164.508 are currently exempt from the accounting requirements and would not be impacted by this proposal.
2. Section 164.512(i) also permits uses and disclosures for research without an individual's authorization where access to protected health information is sought solely to review the information as necessary to prepare a research protocol or for similar purposes and no protected health information is to be removed from the covered entity by the researcher in the course of the review or where access is being sought solely for research on the protected health information of decedents.
3. We note that proposed § 164.528(b)(2)(ii), discussed below, specifically states that a covered entity may provide the individual with the option to limit the access report to a specific organization. We have not included similar language in the accounting provision because we expect it will be less likely that individuals will be interested in limiting their accounting requests in this fashion. The lack of this regulatory language in § 164.528(a)(2)(ii) should not be interpreted as prohibiting covered entities from offering individuals the option to limit their accounting request by organization.
4. We note that to the extent a covered entity nonetheless has a reasonable belief that providing certain information in the access report to a personal representative of an individual could endanger the individual, it may elect not to provide the information pursuant to § 164.502(g)(5) of the Privacy Rule.
5. http://www.bls.gov/oes/2008/may/oes231011.htm for lawyers. The hourly rate + 50% is intended to account for fringes and overhead in addition to the standard hourly wages.
6. We identified 673,324 entities that must prepare and deliver notices of privacy practices that are shown in Table 1 below. This includes 668,757 HIPAA covered entities that are health care providers, including hospitals, nursing facilities, doctor offices, outpatient care centers, medical diagnostic, imaging service, home health service and other ambulatory care service covered entities, medical equipment suppliers, and pharmacies. For the purposes of our calculation, we have rounded this number to 669,000. Table 1 also includes 4,567 health insurance carriers and third party administrators working on behalf of covered health plans. The cost estimates for these entities are addressed later.