HITECH Rule Called 'Unreasonable' by Some, 'Overdue' by Others

June 2, 2011 - Howard Anderson, Executive Editor, HealthcareInfoSecurity.com

A provision in the proposed Accounting of Disclosures Rule mandated under the HITECH Act that calls for providing patients with an "access report" listing everyone who's electronically accessed their records is stirring up debate.

Many predict regulators will receive an overwhelming number of comments in the coming two months before work begins on a final version of the proposal to modify the HIPAA Privacy Rule, which was unveiled May 27. That's because some observers contend that creating access reports as envisioned under the proposal will prove cumbersome and impractical.

But others say the reports offer a valuable way to identify records snoops and provide patients with a method to monitor who has accessed their information.
Access Reports

Under the proposed rule, drafted by the Department of Health and Human Services' Office for Civil Rights, patients could request an access report that lists the names of those who have electronically accessed a "designated record set" for many purposes, including treatment, payment and healthcare operations. These reports would only include the names of those who accessed the information, as well as the date and time of the access, says Adam Greene, a former OCR official who was primary author of the proposal (see Author Describes Disclosures Rule).

The reports would account for electronic access to information by a wide variety of individuals, including those employed by a hospital or clinic, independent physicians with hospital admitting privileges or business associates.


The reports also could include what kind of information was accessed, and whether the user modified the record, but only if the organization has a newer information system that can readily provide that information, says Greene, who's now a partner with the Washington law firm Davis Wright Tremaine LLP.

A designated record set includes medical records, billing records "and other information that may have been used to make decisions about treatment or payment," Greene explains.

The proposed rule contains a second provision on "accounting of disclosures," streamlining what's already required under HIPAA. That provision goes beyond addressing "who" accessed a record to spell out "why" it was disclosed to an outside party for certain limited purposes, such as law enforcement, judicial proceedings and public health.

Greene says it could take OCR six months to a year to complete a final version of the rule after the 60-day comment period ends August 1.

Continue Reading the Rest of the Article