nannamom
Admin
Number of posts : 2210
Age : 66
Humor : Once you choose hope, anything’s possible. -Christopher Reeve
Registration date : 2008-11-09
 | | Subject: Proposed Rule would give patients the right to a report on who has accessed their health information Tue 31 May 2011, 7:02 pm | |
|  Expanded Access to HIPAA Info Would Expand Doc's Work, Too
WASHINGTON -- The Obama administration has announced a proposed rule that would give patients the right to a report on who has electronically accessed their protected health information.
Under the proposed rule, which would become effective in 2013, individuals could request a report from their healthcare provider detailing individuals and entities who have viewed their health information.
Currently, the Health Insurance Portability and Accountability Act (HIPAA) requires healthcare providers -- or anyone with access to protected health information -- to track who looks at an individual patient's files, but the tracking information doesn't have to be shared.
"This proposed rule represents an important step in our continued efforts to promote accountability across the healthcare system, ensuring that providers properly safeguard private health information," Georgina Verdugo, director of the Office of Civil Rights at the Department of Health and Human Services (HHS), said in a press release. "We need to protect people's rights so that they know how their health information has been used or disclosed."
As the U.S. healthcare system slowly phases out paper medical records on its way toward an electronic system, some fear private health information will more easily fall into the wrong hands when it is digitized.
However, a recent security breach demonstrated the pitfalls of relying on paper records. In February, HHS announced Massachusetts General Hospital paid the government $1 million to settle a HIPAA violation resulting when a hospital employee left the medical records of 192 patients on a subway train in 2009. Some of the documents contained names, billing forms, health insurance policy numbers, diagnosis, and provider information. The records were never found. (see folllowing news article)
The proposed change announced Tuesday would modify the so-called HITECH Act, which is the electronic medical records/electronic prescribing portion of the 2009 economic stimulus bill.
Under the proposed rule, beginning on January 1, 2013, individuals would have the right to receive a report of who accessed their electronic protected health information; the report would cover a three-year period from the date of the request.
The rule is open for public comment through Aug. 1, and HHS is expected to publish the final rule later this year.
Source:
MED PAGE TODAY
Last edited by nannamom on Wed 01 Jun 2011, 5:36 pm; edited 1 time in total | |
|
nannamom
Admin
Number of posts : 2210
Age : 66
Humor : Once you choose hope, anything’s possible. -Christopher Reeve
Registration date : 2008-11-09
| | Subject: Re: Proposed Rule would give patients the right to a report on who has accessed their health information Tue 31 May 2011, 7:11 pm | |
|
Massachusetts General Hospital settles potential HIPAA violations
Large hospital system to improve policies and procedures safeguarding patient information
The General Hospital Corporation and Massachusetts General Physicians Organization Inc. (Mass General) has agreed to pay the U.S. government $1,000,000 to settle potential violations of the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy Rule, the U.S. Department of Health and Human Services (HHS) announced today.
Mass General, one of the nation’s oldest and largest hospitals, signed a Resolution Agreement with HHS that requires it to develop and implement a comprehensive set of policies and procedures to safeguard the privacy of its patients. The settlement follows an extensive investigation by the HHS Office for Civil Rights (OCR), which enforces the HIPAA Privacy and Security Rules. The HIPAA Privacy Rule requires health plans, health care clearinghouses and most health care providers (covered entities) to protect the privacy of patient information through administrative, physical and technical safeguards at all times.
“We hope the health care industry will take a close look at this agreement and recognize that OCR is serious about HIPAA enforcement. It is a covered entity’s responsibility to protect its patients’ health information,” said OCR Director Georgina Verdugo.
The incident giving rise to the agreement involved the loss of protected health information (PHI) of 192 patients of Mass General’s Infectious Disease Associates outpatient practice, including patients with HIV/AIDS. OCR opened its investigation of Mass General after a complaint was filed by a patient whose PHI was lost on March 9, 2009. OCR’s investigation indicated that Mass General failed to implement reasonable, appropriate safeguards to protect the privacy of PHI when removed from Mass General’s premises and impermissibly disclosed PHI potentially violating provisions of the HIPAA Privacy Rule.
The impermissible disclosure of PHI involved the loss of documents consisting of a patient schedule containing names and medical record numbers for a group of 192 patients, and billing encounter forms containing the name, date of birth, medical record number, health insurer and policy number, diagnosis and name of providers for 66 of those patients. These documents were lost on March 9, 2009, when a Mass General employee, while commuting to work, left the documents on the subway train that were never recovered.
Mass General also agreed to enter into a Corrective Action Plan (CAP), which requires the hospital to:
•Develop and implement a comprehensive set of policies and procedures that ensure PHI is protected when removed from Mass General’s premises;
•Train workforce members on these policies and procedures; and
•Designate the Director of Internal Audit Services of Partners HealthCare System Inc. to serve as an internal monitor who will conduct assessments of Mass General’s compliance with the CAP and render semi-annual reports to HHS for a 3-year period.
“To avoid enforcement penalties, covered entities must ensure they are always in compliance with the HIPAA Privacy and Security Rules,” said Verdugo. “A robust compliance program includes employee training, vigilant implementation of policies and procedures, regular internal audits, and a prompt action plan to respond to incidents.”
The HHS Resolution Agreement and CAP can be found on the OCR website at:
http://www.hhs.gov/ocr/privacy/hipaa/news/mghnews.html.
Additional information about OCR’s enforcement activities can be found at:
http://www.hhs.gov/ocr/privacy/hipaa/enforcement/examples/index.html. | |
|
