Introduction
Simplification of HITECH
Details
Sec. 13405. Restrictions on Certain Disclosures and Sales of Health Information; Accounting of Certain Protected Health Information Disclosures; Access to Certain Information in Electronic Format.
(a) Requested Restrictions on Certain Disclosures of Health Information.— If an individual requests the hospital to not disclose his protected health information, the hospital must comply if:
1: it is not required by law, and the disclosure relates to the payment or operation of health care (and not for the purpose of carrying out treatment), and
2: the information came from the hospital’s item or service for which the individual has paid in full to the hospital
(b) Disclosures Required to be Limited to the Limited Data Set or the Minimum Necessary.—
(1) In General.—
(A) In General.— a covered entity shall be treated as being in compliance with HIPAA’s use, disclosure, or request of protected health information only if the covered entity limits such protected health information to the limited data set (164.514(e)(2)) or is the minimum necessary (note1) to accomplish the intended purpose.
(B) Guidance.—Within 18 months, the Secretary should decide what is ‘‘minimum necessary’’, taking into guidance under section 13424(c) and the information necessary to improve patient outcomes and to detect, prevent, and manage chronic disease.
(C) Sunset.—Listen to (A) until (B) takes effect.
(2) Determination of Minimum Necessary.—For purposes of paragraph (1)(A), covered entity or business associate decides what is minimum necessary.
(3) Application of Exceptions.—The exceptions described in section 164.502(b)(2) of title 45, Code of Federal Regulations, shall apply to paragraph (1) .
(4) Rule of Construction.—This subsection doesn’t cover or affect de-identified protected health information.
(c) Accounting of Certain Protected Health Information Disclosures Required if Covered Entity Uses Electronic Health Record.—
‘‘(1) In General.—In applying section 164.528 of title 45, Code of Federal Regulations, when a covered entity uses or maintains an electronic health record with respect to protected health information –
‘‘(A) the exception under paragraph (a)(1)(i) of such section shall not apply to disclosures through an electronic health record made by such entity of such information; and
‘‘(B) an individual has the right to receive an accounting of disclosures that spans back over 3 years.
‘‘(2) Regulations.—The Secretary shall officially declare regulations on what information shall be collected about each disclosure referred to in paragraph (1). Such regulations shall only require such information to be collected through an electronic health record in a manner that takes into account the interests of the individuals in learning the circumstances under which their protected health information is being disclosed and takes into account the administrative burden of accounting for such disclosures.
‘‘(3) Process.—When an individual requests for an accounting, the covered entity should provide either an –
‘‘(A) accounting, as specified under paragraph (1), for disclosures made by covered entities and business associates on behalf of the covered entities, or
‘‘(B) accounting, as specified under paragraph (1), for disclosures made by the covered entities with a list of all business associates acting on behalf of the covered entity, including contact information for such associates (such as mailing address, phone, and email address). A business associate included on a list under subparagraph (B) shall provide an accounting of disclosures upon a request made by an individual.
‘‘(4) Effective Date.—
‘‘(A) Current Users of Electronic Records.—If a covered entity already has electronic health record as of January 1, 2009, paragraph (1) applies to them on and after January 1, 2014.
‘‘(B) Others.—If a covered entity has an electronic health record after January 1, 2009, paragraph (1) applies to disclosures on or after the following:
‘‘(i) January 1, 2011; or
‘‘(ii) the date that it acquires an electronic health record.
‘‘(C) Later Date.—The Secretary may set an effective date that is later that the date specified under subparagraph (A) or (B) if the Secretary determines that such later date is necessary, but in no case may the date specified under—
‘‘(i) subparagraph (A) be later than 2016; or
‘‘(ii) subparagraph (B) be later than 2013.’’
(d) Prohibition on Sale of Electronic Health Records or Protected Health Information.—
(1) In General.—Covered entity or business associate cannot receive payment in exchange for protected health information of an individual (in accordance with HIPAA 164.508) unless the individual authorizes it.
(2) Exceptions.—Paragraph (1) shall not apply in the following cases:
(A) The purpose of the exchange is for public health activities (as described in section 164.512(b) of title 45, Code of Federal Regulations).
(B) The purpose of the exchange is for research (as described in sections 164.501 and 164.512(i) of title 45, Code of Federal Regulations) and the price charged reflects the costs of preparation and transmittal of the data for such purpose.
(C) The purpose of the exchange is for the treatment of the individual, subject to any regulation that the Secretary may officially declare to prevent protected health information from inappropriate access, use, or disclosure.
(D) The purpose of the exchange is the health care operation specifically described in subparagraph (iv) of paragraph (6) of the definition of healthcare operations in section 164.501 of title 45, Code of Federal Regulations.
(E) The purpose of the exchange is for payment that is provided by a covered entity to a business associate for activities involving the exchange of protected health information that the business associate undertakes on behalf of and at the specific request of the covered entity pursuant to a business associate agreement.
(F) The purpose of the exchange is to provide an individual with a copy of the individual’s protected health information pursuant to section 164.524 of title 45, Code of Federal Regulations.
(G) The purpose of the exchange is otherwise determined by the Secretary in regulations to be similarly necessary and appropriate as the exceptions provided in subparagraphs (A) through (F).
(3) Regulations.—Within 18 months, the Secretary shall officially declare regulations to carry out this subsection. In officially declaring such regulations, the Secretary—
(A) shall evaluate the impact of restricting the exception described in paragraph (2)(A) to require that the price charged for the purposes described in such paragraph reflects the costs of the preparation and transmittal of the data for such purpose, on research or public health activities, including those conducted by or for the use of the Food and Drug Administration; and
(B) may further restrict the exception described in paragraph (2)(A) to require that the price charged for the purposes described in such paragraph reflects the costs of the preparation and transmittal of the data for such purpose, if the Secretary finds that such further restriction will not impede such research or public health activities.
(4) Effective Date.—Paragraph (1) shall apply to exchanges occurring within 6 months of the promulgation of final regulations implementing this subsection.
(e) Access to Certain Information in Electronic Format.— In applying section 164.524 of title 45, Code of Federal Regulations, in the case that a covered entity uses or maintains an electronic health record with respect to protected health information of an individual—
(1) the individual shall have a right to obtain a copy of such information in an electronic format or request to send it to another person or entity.
(2) despite paragraph (c)(4) of such section, any fee that the covered entity may impose for providing such individual with a copy of such information in electronic form should not be greater than the entity’s labor cost in responding to the request for the copy.
note1: (b)(1) Minimum necessary applies. When using or disclosing protected health information or when requesting protected health information from another covered entity, a covered entity or business associate must make reasonable efforts to limit protected health information to the minimum necessary to accomplish the intended purpose of the use, disclosure, or request.
-Dureeti and Kevin
