HHS Glitch Leads to Delay in Privacy Rule Implementation
HHS Glitch Leads to Delay in Privacy Rule Implementation
Due to a regulatory oversight, the U.S. Department of Health and Human Services (HHS) did not meet a requirement to submit the federal privacy rule for health records to Congress for a 60-day review period, thus delaying its effective date from February 26 to April 14.
With the clock ticking on implementation, APhA and 37 other organizations had asked new HHS Secretary Tommy G. Thompson for more time based on several significant concerns about regulations issued in the waning days of the Clinton administration.
Thompson is expected to announce a new 30-day comment period to allow affected parties to comment on the regulation. After the comment period, Thompson could change the regulation or allow it to take effect.
Compliance with the "Standards for Privacy of Individually Identifiable Health Information" -- required under the Health Insurance Portability and Accountability Act of 1996 (HIPAA) -- will be mandatory within 2 years of the effective date.
In calling for a new public comment period, the letter signed by APhA, the Healthcare Leadership Council, and other health care associations and business entities lists the problems with a regulation that has been lauded by consumer groups for the protection it provides patients and maligned by providers for the financial and administrative burdens it places on them.
"We are especially concerned about the impact of the new provision that requires that patients sign a specific patient consent before providers may use or disclose identifiable information for treatment, payment, and health care operations," the letter states. "This provision was not part of the proposed regulation. In fact, HHS went to great lengths in the proposed regulation to explain why such a consent requirement was unworkable and therefore rejected in that version of the rule."
Patient Must Give Prior Consent
How the rule applies to pharmacy has been a source of frustration for the profession since its release. What is known is that the new privacy protections cover all individually identifiable or protected health information transmitted or maintained in electronic or paper records. Oral communication is also included, so pharmacists might be unable to counsel a family member picking up a prescription for someone else. In addition, encryption of electronic transmission of prescription information could conceivably be required, since it could otherwise be intercepted and interpreted. Health plans, health care clearinghouses, and most health care providers are affected by the confidentiality requirements.
As written, the rule requires prior patient consent for routine use or disclosure of protected health information for basic activities, such as treatment and payment. It must be in writing and contain the following:
Providers may refuse to provide treatment to patients who refuse to sign a consent form and must obtain a separate patient authorization for any use or disclosure of protected health information that does not involve treatment, such as certain types of marketing or fundraising.
Medication Use Quandary
The adverse impact on patient medication use is also described in the letter. Because pharmacists will not be able to fill a prescription unless they have the prescribed patient's written consent on file at the pharmacy, serious disruptions in service could occur.
"The requirements will create delays for patients, for parents with sick children, and others who will have to come to the pharmacy to sign consents before the pharmacist can fill or refill a prescription," the letter states. "Elderly and disabled individuals, who often cannot pick up their prescriptions because of various infirmities, will be forced to sign a written consent form before anyone can pick up their prescriptions for them."
Acknowledging this dilemma for pharmacists, APhA Executive Vice President John A. Gans, PharmD, said, "Pharmacists maintain and use individually identifiable information every day. While the profession is committed to protecting this information, we must ensure that these new regulatory requirements do not disrupt the quick, efficient, and safe delivery of health care that patients consistently count on pharmacists to provide."
The group also asked for clarification of the requirement that covered entities limit the patient information they share to the "minimum amount necessary" to accomplish a particular purpose, questioned the advisability of the relatively short period from implementation to complete compliance, and noted that the administrative requirements will create burdens to both providers and patients, and are therefore "contrary to HIPAA's goals of simplification."
APhA Shares Intelligence
Since the rule's release, APhA staff has met with HHS and other groups to offer pharmacists' perspectives and interpretations of the rule.
A meeting with the General Accounting Office (GAO) gave APhA the opportunity to air concerns. GAO was gathering information for its testimony before the Senate Committee on Health, Education, Labor, and Pensions last month, and was particularly interested in learning about pharmacists' need for definitions of when consent is needed. GAO representatives listened to concerns about the impact of securing consent and the financial and personnel cost of a broad interpretation of the rule. APhA also has participated in several meetings with national pharmacy organizations.
"The privacy regulation will have a significant impact on pharmacists and their patients," Gans said. "It is important for the profession to work together to voice our concerns with the rule and investigate the unintended consequences that may result from a well-intentioned rule with unexpected results."
A copy of the rule is available at www.hhs.gov/ocr/hipaa.
Due to a regulatory oversight, the U.S. Department of Health and Human Services (HHS) did not meet a requirement to submit the federal privacy rule for health records to Congress for a 60-day review period, thus delaying its effective date from February 26 to April 14.
With the clock ticking on implementation, APhA and 37 other organizations had asked new HHS Secretary Tommy G. Thompson for more time based on several significant concerns about regulations issued in the waning days of the Clinton administration.
Thompson is expected to announce a new 30-day comment period to allow affected parties to comment on the regulation. After the comment period, Thompson could change the regulation or allow it to take effect.
Compliance with the "Standards for Privacy of Individually Identifiable Health Information" -- required under the Health Insurance Portability and Accountability Act of 1996 (HIPAA) -- will be mandatory within 2 years of the effective date.
In calling for a new public comment period, the letter signed by APhA, the Healthcare Leadership Council, and other health care associations and business entities lists the problems with a regulation that has been lauded by consumer groups for the protection it provides patients and maligned by providers for the financial and administrative burdens it places on them.
"We are especially concerned about the impact of the new provision that requires that patients sign a specific patient consent before providers may use or disclose identifiable information for treatment, payment, and health care operations," the letter states. "This provision was not part of the proposed regulation. In fact, HHS went to great lengths in the proposed regulation to explain why such a consent requirement was unworkable and therefore rejected in that version of the rule."
Patient Must Give Prior Consent
How the rule applies to pharmacy has been a source of frustration for the profession since its release. What is known is that the new privacy protections cover all individually identifiable or protected health information transmitted or maintained in electronic or paper records. Oral communication is also included, so pharmacists might be unable to counsel a family member picking up a prescription for someone else. In addition, encryption of electronic transmission of prescription information could conceivably be required, since it could otherwise be intercepted and interpreted. Health plans, health care clearinghouses, and most health care providers are affected by the confidentiality requirements.
As written, the rule requires prior patient consent for routine use or disclosure of protected health information for basic activities, such as treatment and payment. It must be in writing and contain the following:
A statement that the protected health information may be used and disclosed by the provider to carry out treatment, payment, and/or health care operations.
A notification that the health care provider maintains a "Notice of Privacy Practices" that is available for review.
A notification that the patient may request that the provider restrict how protected health information is used and disclosed for treatment, payment, and/or health care operations. The provider is not required to agree to the request, however if the provider does agree, he or she is bound to the restriction.
A statement that the patient may revoke the consent in writing to the extent that the information has not already been disclosed.
The patient's signature and date of signature.
Providers may refuse to provide treatment to patients who refuse to sign a consent form and must obtain a separate patient authorization for any use or disclosure of protected health information that does not involve treatment, such as certain types of marketing or fundraising.
Medication Use Quandary
The adverse impact on patient medication use is also described in the letter. Because pharmacists will not be able to fill a prescription unless they have the prescribed patient's written consent on file at the pharmacy, serious disruptions in service could occur.
"The requirements will create delays for patients, for parents with sick children, and others who will have to come to the pharmacy to sign consents before the pharmacist can fill or refill a prescription," the letter states. "Elderly and disabled individuals, who often cannot pick up their prescriptions because of various infirmities, will be forced to sign a written consent form before anyone can pick up their prescriptions for them."
Acknowledging this dilemma for pharmacists, APhA Executive Vice President John A. Gans, PharmD, said, "Pharmacists maintain and use individually identifiable information every day. While the profession is committed to protecting this information, we must ensure that these new regulatory requirements do not disrupt the quick, efficient, and safe delivery of health care that patients consistently count on pharmacists to provide."
The group also asked for clarification of the requirement that covered entities limit the patient information they share to the "minimum amount necessary" to accomplish a particular purpose, questioned the advisability of the relatively short period from implementation to complete compliance, and noted that the administrative requirements will create burdens to both providers and patients, and are therefore "contrary to HIPAA's goals of simplification."
APhA Shares Intelligence
Since the rule's release, APhA staff has met with HHS and other groups to offer pharmacists' perspectives and interpretations of the rule.
A meeting with the General Accounting Office (GAO) gave APhA the opportunity to air concerns. GAO was gathering information for its testimony before the Senate Committee on Health, Education, Labor, and Pensions last month, and was particularly interested in learning about pharmacists' need for definitions of when consent is needed. GAO representatives listened to concerns about the impact of securing consent and the financial and personnel cost of a broad interpretation of the rule. APhA also has participated in several meetings with national pharmacy organizations.
"The privacy regulation will have a significant impact on pharmacists and their patients," Gans said. "It is important for the profession to work together to voice our concerns with the rule and investigate the unintended consequences that may result from a well-intentioned rule with unexpected results."
A copy of the rule is available at www.hhs.gov/ocr/hipaa.
Source...