HHS Proposes Weakening HIPAA Protections for Patients' Records

Strategic Insights -

The US Department of Health and Human Services (HHS) has proposed a rule that would weaken protections for patients' records under the Health Insurance Portability and Accountability Act (HIPAA). The proposed rule, which is part of the HHS Office for Civil Rights' (OCR) notice of proposed rulemaking (NPRM), would make it easier for healthcare providers to share patients' protected health information (PHI) without their consent. This move has been criticized by patients and advocates who argue that it would erode the confidentiality of patients' records and make it harder for them to seek treatment.

The proposed rule would affect not only HIPAA-protected records but also those protected under 42 CFR Part 2, a regulation that protects substance use disorder (SUD) treatment information. According to the NPRM, many commenters who were family members of people with serious mental illness (SMI) or SUD suggested that individuals' SMI or SUD should be disclosed to family caregivers, citing the devastating consequences of lack of information disclosure. However, patients and health care providers expressed concern about the chilling effect that increased disclosures would have on individuals seeking treatment for opioid use disorders.

The NPRM also introduces the concept of a "good faith" standard, which would allow covered entities to exercise discretion when deciding to use or disclose PHI. However, this standard has been criticized for being too vague and potentially subjective.

Key Takeaways:

  • The proposed rule would weaken protections for patients' records under HIPAA and 42 CFR Part 2.
  • Many commenters who were family members of people with SMI or SUD suggested that individuals' SMI or SUD should be disclosed to family caregivers.
  • Patients and health care providers expressed concern about the chilling effect that increased disclosures would have on individuals seeking treatment for opioid use disorders.
  • The NPRM introduces a "good faith" standard, which would allow covered entities to exercise discretion when deciding to use or disclose PHI.
  • The proposed rule would affect not only HIPAA-protected records but also those protected under 42 CFR Part 2.
  • Patients and advocates argue that the proposed rule would erode the confidentiality of patients' records and make it harder for them to seek treatment.

Statistics:

  • According to the NPRM, many commenters who were family members of people with SMI or SUD suggested that individuals' SMI or SUD should be disclosed to family caregivers.
  • The NPRM states that patients "almost universally opposed modifying the Privacy Rule to expand permitted disclosures of information related to SMI and opioid use disorder or other SUDs."
  • The proposed rule would affect not only HIPAA-protected records but also those protected under 42 CFR Part 2.
  • According to the Legal Action Center, weakening HIPAA would result in patients losing valuable privacy rights.
  • The CARES Act's changes in 2020 weakened privacy protections by creating the possibility for covered entities to share and re-share SUD treatment records.

Sources:

  • "In case you haven't heard," ADAW, Jan. 11, https://onlinelibrary.wiley.com/doi/10.1002/adaw.32940
  • "HHS considers weakening HIPAA," ADAW, Jan. 21, 2019, https://onlinelibrary.wiley.com/doi/10.1002/adaw.32231
  • "As HIPAA changes loom, patients demand continued confidentiality for SUD records," ADAW, Jan. 25, 2019, https://onlinelibrary.wiley.com/doi/10.1002/adaw.32236
  • "CARES Act eliminates most of 42 CFR Part 2," ADAW, April 6, 2020, https://onlinelibrary.wiley.com/doi/10.1002/adaw.32678
  • https://www.govinfo.gov/content/pkg/FR-202101-21/pdf/2020-27157.pdf
  • https://filtermag.org/hhs-overdose-privacy/