|
|
 Editor's
Corner
Update
on HIPAA
by
Michael E. Speer, MD
Professor of Pediatrics-Neonatology
Baylor College of Medicine, Houston
The
Department of Health and Human Services, has released
its final rule regarding the Health Insurance Portability and
Accountability Act of 1996 (HIPAA). The new regulation promotes
protection of medical records and other personal health information
maintained by health care providers, hospitals, health plans and
health insurers, and health care clearinghouses. Moreover, the
new standard:
- limits the non-consensual use and release of private health
information,
- gives patients new rights to access their medical records
and to know who else has accessed them,
- restricts most disclosure of health information to the minimum
needed for the intended purpose, and
- establishes new requirements for access to records by researchers
and others.
New
criminal and civil sanctions for improper use or disclosure have
also been promulgated.
The
final regulation provides protection for paper, oral, and electronic
information, creating a privacy system for all personal health
information created or held by covered entities. The final rule
also requires that physicians obtain their patients’ consent for
routine use and disclosure of health records in addition to requiring
their authorization for non-routine disclosures. An earlier version
of the regulation had proposed allowing routine disclosures without
advance consent—disclosures for purposes of treatment, payment,
and health care operations (such as internal data gathering by
a provider or health care plan). This is no longer the case.
Protecting
against unauthorized use of medical records for employment purposes
is also covered by the rule. Companies that sponsor health plans
will not be able to access personal health information from the
sponsored plan for employment-related purposes without authorization
from the patient.
|
