A controversial provision of the HITECH Act may very well not be finalized by the January 1, 2014 deadline. Leon Rodriquez, Director of the HHS Office for Civil Rights, stated during the Health Care Compliance Association’s annual conference that the deadline for the HITECH rule was now “fluid”, and he did not give any indication when the rule could be issued as the agency is still reviewing the comments it has received in regards to the rule.
Under HIPAA providers are required to give people certain information about how their healthcare data has been shared. Once this provision of HITECH takes effect it will allow a person to ask for a simple version of the existing HIPAA disclosure and a report that would include a wide range of information. That information would include the names of the individuals who have accessed the health information and what those individuals did with the records. Also under HITECH, the provider will only have 30 days to respond to the person’s request v. the current 60 days under HIPAA.
The American Health Care Association (AHCA) states that the current 60 day timeline should be maintained as it is impractical to believe that a provider can put together such a comprehensive report in that time period. In addition, AHCA states that the aggregate access report requirement should be eliminated for long-term care providers due to the fact that in cases involving a nursing home resident, their health record will be comprised of both paper and electronic information from a variety of places such as the hospital, pharmacy, therapists and so on. AHCA states that if not eliminated then it should be limited to just the system that that provider maintains and controls.
HHS received over 400 comments after the proposed rule was released in May 2011. Some providers believe the rule should be eliminated due to it being excessively burdensome while other providers state that they feared a disgruntled patient could and would retaliate against any employees named in the access report.