Changes Needed to HIPAA Privacy Rule, But Removing Key Provisions ‘Not Justified,’ New CHCF Survey Finds
The experience of California health care organizations (HCOs) working to comply with the HIPAA privacy rule suggests that although some changes are needed to implement the rule successfully, eliminating major components of the rule is not warranted, according to a new report from the California HealthCare Foundation. The findings are based on survey data collected in January and February, before HHS released its proposed changes to the privacy rule. But according to CHCF, the results are still relevant because HHS is still finalizing the proposed modifications, which would require providers, insurers and pharmacies to notify patients of their privacy rights instead of obtaining written consent before disclosing their medical records. Sam Karp, chief information officer at CHCF, presented the findings today at a Senate Health, Education, Labor and Pensions Committee hearing on the proposed changes to the privacy rule. CHCF commissioned the National Committee for Quality Assurance and Georgetown University's Health Privacy Project to conduct the survey of 100 HCOs operating in California to assess progress toward compliance with the privacy rule, to identify challenges and burdens HCOs face as they implement the rule and to identify sections of the rule that require revision by HHS. The survey yielded eight key findings:
- Planning for compliance with the rule is progressing, though implementation progress varies among HCOs.
- The consent requirements are "somewhat workable."
- The minimum necessary requirements are "somewhat workable."
- HCOs believe the consent and minimum necessary requirements limit access to information needed for quality assessment.
- HCOs view the business associates provision as "burdensome."
- HCOs need additional resources to analyze preemption of state medical privacy rules by HIPAA.
- HCOs have not allocated resources to fund compliance efforts completely.
- There is a "general need" for clarifications and/or modifications to the rule.
With regard to the requirement that patient consent be obtained prior to record release, 51% of HCOs said the regulations were at least "somewhat workable," while 19% said they were "workable" and 10% said they were "very workable." About 58% of respondents said the minimum necessary requirements were "somewhat workable," while 18% said they were "workable" and 5% said they were "very workable." Regarding compliance, 81% of respondents said they have developed a strategic plan, 67% have conducted a gap assessment, 52% have begun to develop and implement "readiness initiatives," and 12% have completed their readiness initiatives. Only 46% of HCOs said the privacy rule will enhance patients' confidentiality rights and contribute to national standards, while 47% of HCOs reported concern about the paperwork burden associated with the rule. Karp said, "The findings show that to implement the privacy rule [as issued in December 2000] successfully, a number of clarifications and modifications are still needed to address areas of confusion and misinterpretation and to make the rules more workable. However, the survey provides evidence that implementation progress is being made, so to remove key provisions of the rule now does not seem justified" (CHCF release, 4/16). The survey is available online.
This is part of the California Healthline Daily Edition, a summary of health policy coverage from major news organizations. Sign up for an email subscription.