New rules would expand HIPAA regulations to outside professionals

27 May New rules would expand HIPAA regulations to outside professionals

Posted at 10:54h in Careers, Economy, Health Technology, IT, Legal by

Editor’s Note: The panel discussion took place at WTN Media’s Digital Healthcare Conference on the topic of “Legal and Financial Implications of Federal Stimulus Package: Health IT Panel”. Click here to view this presentation.
MADISON – Certain health information privacy provisions in the federal stimulus package amount to a “massive” expansion of http://www.hhs.gov/ocr/privacy/index.html HIPAA, or the Health Insurance Portability and Accountability Act Privacy Rule, according to Milwaukee lawyer and health privacy expert Mark Garsombke.
Speaking as part of a panel discussion at the recent Digital Healthcare Conference 2009, Garsombke outlined the legal and financial implications of these provisions, saying new health privacy provisions apply HIPAA regulations beyond health care providers to the outside accountants, lawyers and others professional they engage.
The legislation also includes a requirement that would require health care professionals and their business associates to notify a patient if his or her health record becomes “unsecured.” Such “shaming provisions” would require providers to notify the media and their state health department if more than 500 health records are breached, said Garsombke, a shareholder in Milwaukee-based Whyte Hirschboeck Dudek and chairman of the firm’s HIPAA practice group.
“In terms of HIPPA, business associates now must act like the health care providers or plans they work for,” Garsombke said. “Health care providers may like these provisions because they will force business associates to be more careful. But it also may create a burden for them because they may have to redo the agreement they have with their outside consultants regarding the personal health information their work exposes them to.”
Garsombke overviewed the American Recovery and Reinvestment Act’s health information technology provisions, which include several key elements to drive the adoption of electronic health records (EHR). They include promotion of EHRs, creation of standards for the use and exchange of health information, and grant, loan and incentive funding.
The stimulus package also includes Medicare incentive funding aimed at aiding adoption and use of EHRs. Beginning in 2011, health care providers may start to receive incentives for the use of EHR. This use, however, must meet the definition of “meaningful use” to qualify for payment. The final definition of “meaningful use” has yet to be worked out.
“Once a provider gets to 2015, its reimbursement will decline if electronic health records are not implemented and being used,” said Dan Miller, a Whyte Hirschboeck Dudek lawyer who participated the panel.
Denise Webb, the state of Wisconsin’s eHealth program manager, said there is significant variation in the adoption of EHRs by physicians across the state.
“Among the state’s roughly 15,000 physicians, 63 percent are in group practices of more than 100 physicians. Ninety-five percent of those physicians have access to electronic health records,” Webb said. “The percent of physicians with access to electronic health records in medium and small group practices is significantly lower, as low as 10 percent in some cases.”
Garsombke said that he believes provisions the HITECH Actmay mean that HIPAA regulations may be enforced more vigorously, noting, “Regulators already are becoming more aggressive.”
Dr. Charles Kennedy, a panelist who is vice president of health information technology at
WellPoint Inc., said Google and Microsoft are using their new personal health record products to get around HIPAA compliance.
“Personal health records would seem to be outside of HIPAA requirements,” Garsombke said, “but they [personal health record vendors] still might face enforcement actions from the Federal Trade Commission for a breach of records violation.”
Additional Digital Healthcare Conference Coverage