Sale of and Use for Research – Protected Health Information (PHI) HIPAA/HITECH Amendments effective March 26, 2013 – ARE YOU PREPARED?

On January 17, 2013 the US Department of Health & Human Services (HHS) issued the long-anticipated final rule describing the privacy and security requirements for covered entities under the Health Insurance Portability and Accountability Act (HIPAA), as required by the Health Information Technology for Economic and Clinic Health (HITECH) Act. The new final HIPAA Privacy and Security Rule has been described as containing the most sweeping changes to HIPAA since the law was implemented. The Amendments become effective on March 26, 2013 and compliance is generally required by September 23, 2013.

The final rule excludes the sale of Protected Health Information (PHI) without the patient’s authorization. Covered entities must obtain authorization from patients for the sale of Protected Health Information (PHI) unless it is for use by a public health agency, for treatment or payment or for other allowed disclosures including normal disclosures to Business Associates. Authorization forms must be worded in a manner that is understandable and allows patients to make an informed decision. The authorization must also state the name of the covered entity and that the entity will receive payment for the disclosure. Covered entities will need to review their existing authorization forms to assure that they include a section addressing this new language.

The new rule also permits covered entities to ask a patient for consent to share Protected Health Information (PHI) for a particular research study and use the consent for related research purposes such as creating a database to store and query information.

As required by the Genetic Information Nondiscrimination Act of 2008, the rule provides enhanced privacy protections for genetic information. It clarifies that genetic information is considered Protected Health Information (PHI) and prohibits health plans from using or disclosing genetic information for underwriting purposes (except for insurers of long-term care policies). – Lisa M. Coleman

Comments Off