If that's perfectly clear, we'll move on. HIPPAA provides two separate authorization mechanisms for permitted uses of health information: consent and authorization. Under the rules, treatment, billing and operations require consent, under which the provider, plan or clearinghouse must obtain signed and written forms that:
- Tell patients their protected health information can be used or disclosed for treatment, payment or healthcare operations.
- Refer patients to the notice that fully describes all of the organization's policies and procedures regarding how it will use the information.
- Tell patients how they will be notified if the policies and procedures change.
- Tell patients they have the right to limit the information that is disclosed, and revoke their consent at any time.
Unlike consent, the stricter standard of patient authorization is generally required for any information use or disclosure that isn't explicitly "required" or "permitted" by the rules. The sale of PHI, its disclosure to employers, or the provision of PHI to a non-healthcare portion of a company owned by a covered entity are three examples where the authorization standard will apply, Rosati said.
Another difference: While treatment can generally be withheld for failure to provide consent, failure to provide authorization for other uses cannot generally be used as a basis for withholding treatment.
If the final rules are consistent with the proposed regulations, authorization will need to include all of the elements of patient consent, as well as a description of who will receive the information, and a description of how the information will be used.
"Everyone is going to need new forms," she said.
There are also a couple of favorable changes in the final regulations. One is the elimination of the "minimum necessary" standard in the treatment of patients. In the proposed rules, the provider was limited to disclosing only the minimum information needed to provide treatment -- a standard that was considered extremely unwieldy in that it's impossible to know in advance how much patient information will be needed to provide treatment.
The final rules leave the nature of patient information used or disclosed for treatment to the discretion of the provider, while information used in billing and operations is still subject to the "minimum necessary" standard.
To put the two changes together, a stricter standard will apply at the beginning of treatment, since consent will be required to access even routine information, Rosati said. However, once that consent is obtained, the healthcare team can use as much information as it deems necessary to provide proper care.
Another favorable change was in the business associate agreements, which no longer need to include a third-party beneficiary clause, she said.
"For example, if the doctor was sending information to a lab in order to do labwork, the lab would be considered a business associate of the doctor's, and the proposed rules also required the contract to have a third-party beneficiary clause -- which would make the patient whose information was being transmitted (a beneficiary) able to sue under the contract if something went wrong with the disclosure of information," she said.
Thankfully the requirement has been eliminated, but patients can still sue for violation of their privacy rights under common law, she said.
Overall, the rules will have a huge impact on the operations of the providers, who are going to need extensive new policies, procedures, and staff to comply. An entire new "privacy bureaucracy" will need to be created, with as yet unpredictable effects on costs and workflow, Rosati said. The government now estimates net savings with HIPAA of $12.3 billion over the next 10 years, a figure both attorneys consider overoptimistic.
For disclosures made in error, non-criminal penalties are $100 per year, per standard, up to $25,000 per year, per standard, according to DHHS. Criminal violations committed knowingly can result in penalties of $50,000 plus a year in prison. Violations for obtaining or disclosing PHI under false pretenses can raise the bill to $100,000 per year and up to five years in prison. Finally, obtaining PHI with the intent to sell, transfer or use it for commercial gain, personal gain or malicious harm can yield fines of up to $250,000 and 10 years in prison.
The costs of administrative compliance as well as potential penalties make the privacy standards far too detailed and burdensome, according to Rosati. The rules will impose astronomical costs on the healthcare industry, possibly outstripping the cost savings expected to result from the standard format for electronic financial transactions, she said.
According to Goldberg, "getting consent might seem like a good idea to some, but they are not the ones who will have to set up the procedures, create the forms, maintain the files, and otherwise deal with the administrative process that will significantly add to the already great burden hospitals and others face, as medical records and related files grow in size exponentially."
"Maintaining an access log that is accurate and not does not interfere with the timely availability of necessary information will also not be easy to do," he added. "And putting the burden on providers and others to include business associates within the circle of protective parties adds administrative and operational requirements to operational activities already causing stresses and resulting in economic losses."
By Eric BarnesAuntminnie.com staff writer
December 22, 2000
Additional HIPAA resources can be found at:
Related Reading
HIPAA hopefuls get religion from privacy guru, December 11, 2000
Encryption is key to medical data security, September 19, 2000
Biometrics comes of age as security takes center stage, September 19, 2000
New HIPAA rules portend sweeping changes in medical data security, June 27, 2000
Click here to post your comments about this story in our new HIPAA forum. Please include the headline of the article in your message.
Copyright © 2000 AuntMinnie.com
