HHS Updates, Publishes New Guidance on HIPAA Privacy Rule
The U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR) recently added a new FAQ explaining permitted disclosures of protected health information (PHI) to value-based care arrangements. OCR also updated older guidance regarding the types of personal health information that individuals can request access to.
Sign up for a free preview to unlock the rest of this article
Privacy Daily provides accurate coverage of newsworthy developments in data protection legislation, regulation, litigation, and enforcement for privacy professionals responsible for ensuring effective organizational data privacy compliance.
According to the new guidance, "the Privacy Rule permits a covered entity to disclose [PHI] for the treatment activities of a health care provider, without an individual’s authorization." It more "generally allows PHI to be used or disclosed without restriction for treatment purposes," including "disclosures of PHI to participants in value-based care arrangements, such as accountable care organizations."
Though not required, the Privacy Rule "does permit [covered entities] to obtain the individual’s consent for" using or disclosing PHI for treatment.
The updated guidance notes that individuals have the right to access, upon request, the PHI about them, including "medical records, billing records, payment and claims records, health plan enrollment records, case management records, as well as other records used, in whole or in part, by or for a covered entity to make decisions about individuals."
But "individuals do not have a right to access PHI about them that is not part of a designated record set because this information is not used to make decisions about individuals," the updated FAQ said, which includes "certain quality assessment or improvement records, patient safety activity records, or business planning, development, and management records that are used for business decisions more generally rather than to make decisions about individuals."
Under the update, individuals don't have the right to access psychotherapy notes maintained separately from medical records or information about themselves compiled in regard to legal proceedings, though entities covered by the Health Insurance Portability and Accountability Act have discretion to share that information with individuals.