The Office for Civil Rights (OCR) released a proposed rule that would broaden an individual’s rights to an accounting of disclosures of protected health information. The rule, which modifies the HIPAA privacy rule to implement changes required under the 2009 HITECH Act, can be accessed here.
Under the proposed rule, covered entities must account for disclosures of PHI made for purposes of treatment, payment, and healthcare operations (TPO) if they maintain the information in electronic format. Disclosures for TPO were previously exempt under HIPAA.
In addition to the right to an accounting of disclosures, individuals would also have the right to a report on access, which would apply when any person accesses a designated record set maintained in the covered entity’s electronic system. According to OCR, this proposed change was intended to “ensure that individuals are receiving information that is of most interest.”
Covered entities would be required to comply with the new rule 180 days after the effective date of the final rule. The rule will become effective 60 days following its publication.
The proposed rules for ACOs known as the “Shared Savings Program” were published in today’s Federal Register.
Because the Centers for Medicare and Medicaid Services (CMS) has not yet published final regulations on telemedicine, it has allowed The Joint Commission (TJC) to delay changes to its telemedicine standards until July 1, 2011. The TJC’s current telemedicine standards are in conflict with the Medicare Conditions of Participation, which do not allow for credentialing by proxy. The proposed rule issued by CMS last year would permit credentialing by proxy between CMS-accredited hospitals.
TJC issued the following statement:
The Centers for Medicare & Medicaid Services (CMS) has not yet published its new telehealth regulations, which it had expected to do by March 1, 2011. Therefore, CMS has now notified The Joint Commission that it has an extension to July 1, 2011 before The Joint Commission will need to alter its telehealth standards to comply with CMS telehealth regulations. Our hope is that the new regulation will modify existing CMS standards in this area to be more in keeping with Joint Commission requirements. CMS expects to publish its telehealth regulations shortly and when it does, The Joint Commission will make changes to its standards in accordance with the regulation and will notify its accredited hospitals and critical access hospitals of the timeframe expected for implementation of the new CMS regulations.
As background on this issue, since September 2009, The Joint Commission has engaged CMS and members of Congress regarding the issue of credentialing and privileging by proxy as it relates to telemedicine providers and users. The Joint Commission took the position that there would be an adverse affect on the access to some telehealth services if organizations were not allowed to comply with Joint Commission requirements addressing credentialing and privileging by proxy. The Joint Commission’s position has been that the CMS requirements place an undue burden on many organizations without improving the quality of services, provider accountability and the effectiveness of the credentialing and privileging processes.
Does your hospital currently credential advance practice registered nurses (APN) and physician assistants (PA) through your human resources department?
New Joint Commission standards will change the credentialing and privileging process for certain advance practice registered nurses (APN) and physician assistants (PA).
Previous Joint Commission standards afforded APNs and PAs equivalent credentialing and privileging processing through the HR department. However, The Centers for Medicare & Medicaid Services (CMS) does not recognize the equivalent process, and The Joint Commission must align its standards to be consistent with CMS. Under the new clarification guidelines, certain APNs and PAs must now be processed through the medical staff office, not HR.
According to the new Joint Commission Standards BoosterPak™, released in January.The Joint Commission states the following:
Those who provide “medical level of care” must use the medical staff process for credentialing and privileging, making all [medical staff] standards applicable (including recommendation by the organized medical staff and approval by the governing body, OPPE, and FPPE).
- APNs should request privileges only for those responsibilities involving medical level of care and not those responsibilities already allowed under the RN scope of practice.
- APNs and PAs who provide “medical level of care” must be credentialed and privileged through the medical staff standards process
- APNs and PAs who do not provide “medical level of care” utilize the human resources “equivalent” process detained in HR.01.02.05, EPs 10–15.
The Joint Commission has not yet provided an implementation date for these changes.
The BoosterPak is available to accredited organizations on the Joint Commission Connect extranet.
Health care providers and hospitals planning on participating in Medicare’s EHR incentive programs in 2011 may begin to register online on Monday. The link will appear on at the following address: http://www.cms.gov/EHRIncentivePrograms/20_RegistrationandAttestation.asp.
Participation in the Medicare incentive payments for 2011 means implementing (or upgrading to) a certified EHR system, and using that system for a set of objectives and reporting of clinical quality measures over 90 consecutive days before the end of the 2011 program year (September 30th for providers and December 31st for hospitals).
Registration is just a first step in a pretty involved process. There is still time to aquire and implement the technology in order to qulaify for this year’s incentives. CMS has the details of how to participate set out at the following address: http://www.cms.gov/EHRIncentivePrograms/10_PathtoPayment.asp
Watch for updates as details get finalized and reporting starts to happen.
An Affordable Care Act requirement that employers report the cost of coverage under an employer-sponsored health plan will be optional on W-2 forms for 2011, the Internal Revenue Service has decided. Further, the IRS, in a notice on its website, stressed the amounts reportable are not taxable. The IRS said the new reporting requirement “is intended to be informational only, and to provide employees with greater transparency into overall health care costs.”
Relief from reporting “is necessary to provide employers the time they need to make changes to their payroll systems or procedures in preparation for compliance with the new reporting requirements,” according to the IRS.
Click here to read the IRS announcement.
Click here to view the IRS uLink to IRS Update:
HHS has withdrawn its final breach notification rules for unsecured protected health information from review by the Office of Management and Budget (OMB), citing only a need for further consideration given HHS’s experience with the rules to date. Keep in mind, however, that although HHS has withdrawn the final breach notification rules from OMB review, the interim final breach notification rules are still in effect. Without providing any further detail, HHS indicated in an announcement that it intends to issue a new final rule in the coming months. Click here to read the announcement. Check back for updates.
After a long wait, CMS has published the “meaningful use” rules on electronic health record technology. Click here to review the final rule (276 pages) or view a quick summary in a CMS fact sheet. CMS has relaxed the final rules in some respects from its rules proposed in January.
With a grace period for implementing Business Associate Agreements and lots of proposed revisions, it looks like its going to be a while before we know the “real” impacts of HITECH on HIPAA. Stay tuned. Here’s a link to the new, proposed regulations. Let us know if you have comments!
On July 8, the Department of Health and Human Services (HHS) released a proposed rule to modify the HIPAA privacy, security, and enforcement rules, extending HIPAA compliance requirements to subcontractors of business associates (BA) and strengthening patient rights to health information privacy.
According to the Office for Civil Rights (OCR), which enforces the HIPAA privacy and security rules for HHS, the proposed ‘significant’ modifications include:
- A requirement that BAs of HIPAA-covered entities be under most of the same rules as the covered entities
- New limitations on the use and disclosure of protected health information (PHI) for marketing and fundraising purposes
- Prohibition of the sale of PHI without an authorization
- Expansion of individuals’ rights to access their information and to restrict certain types of disclosures of PHI to health plans
- Provisions that strengthen and expand HIPAA’s enforcement rule
HHS will receive comments for up to 60 days after the proposed rule’s July 14 publication in the Federal Register, after which it will release an interim final rule. According to HHS, it will give covered entities and BAs 180 days after the final rule becomes effective to comply with most of the provisions.
