HIPAA Privacy Changes Soon. Maybe. – Ep 571 

Regulations may move at the speed of a sleepy turtle, but patient expectations certainly don’t. As healthcare organizations wait to see what the final HIPAA Privacy Rule will include, there is a surprising amount of work that can, and should, already be underway. This episode explores the practical steps you can take now, the common misconceptions that continue to create confusion, and why preparing early is far less painful than trying to outrun an approaching compliance deadline. If you start getting your ducks in a row today, it just might save you from chasing them all over the parking lot tomorrow.

In this episode:

HIPAA Privacy Changes Soon. Maybe. – Ep 571

Today’s Episode is brought to you by:

Kardon

and

HIPAA for MSPs with Security First IT

 Subscribe on Apple Podcast. Share us on Social Media. Rate us wherever you find the opportunity. 

Great idea! Share Help Me With HIPAA with one person this week!

Learn more about Kardon Club and HIPAA for MSPs!

Thanks to our donors. We appreciate your support!

If you would like to donate to the cause you can do that at HelpMeWithHIPAA.com

Like us and leave a review on our Facebook page: www.Facebook.com/HelpMeWithHIPAA

Episode Roadmap

HIPAA Privacy Changes Soon. Maybe.

https://www.reginfo.gov/public/do/eAgendaViewRule?pubId=202510&RIN=0945-AA22

We’ve talked about the importance of making sure you have the current sec rule basics in place today. A proper SRA with document RMP and proof of your program.

Privacy may arrive first. Security may take longer. Neither one is a good candidate for the traditional HIPAA implementation strategy of discovering the deadline while someone is already asking whether the training is complete.

https://www.reginfo.gov/public/do/eAgendaViewRule?RIN=0945-AA00&pubId=202510

We did one way back when this was news – it is about to be again. Let’s review one more time now that it has aged. Privacy Rule Proposed Changes – Ep 291 – YES 291

This proposal is old enough that many people have forgotten what is in it.

Some organizations assumed it had quietly disappeared.

The current activity suggests it deserves attention again.

Not every provision affects every covered entity, and many business associates will have limited direct impact. Plus we still have to wait until the final rule comes out to know exactly what the rule will say.

Oh and the time frame…..

The rule would become effective 60 days after publication, but organizations would have another 180 days to comply. Enforcement would begin approximately eight months, or 240 days, after the final rule is published.

This is going to be big in policy, procedure and training

The 2021 proposal anticipated changes to:

1. Right-of-access procedures.
2. Records-request forms and intake processes.
3. Identity-verification practices.
4. Fee schedules and website content.
5. Notices of Privacy Practices.
6. Care-coordination policies.
7. Family and caregiver disclosures.
8. Workforce training.
9. EHR and records-management workflows.
10. Business-associate processes.

The thing to know these changes mean (based on what was in the NPRM):

1. Patients may get faster and more practical access to their records.
2. Providers may get more flexibility to share information for care coordination, family involvement, and safety.
3. Covered entities may need to change workflows, forms, notices, training, and technology rather than simply revise a policy.

Speed in records access requests – this is the biggest one

Proposed changing turn around from 30 / 60 to 15 / 30 CALENDAR days

Start by asking a lot of questions for your records request processes:

• Where do access requests currently get delayed?
• Does the request sit in someone’s inbox before the clock really starts moving in your office?
• Are records spread across several systems?
• Does a vendor handle release-of-information work?
• Can that vendor meet a shorter deadline?
• Are weekends and holidays built into the workflow?
• Does the organization have a way to prioritize urgent requests?

The proposed regulatory text says the access right would include:

“the right to view, take notes, take photographs”

It also says the covered entity:

“may impose requirements to ensure that an individual records only protected health information”

HIPAA can’t be used as an excuse anymore

Really all about care coordination, case management, family involvement, and patient and other’s safety.

• Broader permission for individual-level care coordination.
• Sharing with community and social-service organizations.
• More flexibility for disclosures to family members and caregivers.
• Changing the standard from professional judgment to a good-faith belief in some situations.
• Changing “serious and imminent threat” to “serious and reasonably foreseeable threat.”

This is gonna get real sticky in many situations I see it already. Start thinking about things like:

1. Who is allowed to make the decision?
2. What training do they need?
3. How do they document the reasoning?
4. What happens when state law is more restrictive?
5. How do they consider patient preferences?
6. How do they avoid treating “care coordination” as permission to share everything?

While it seems like a lot of paperwork at least there is one reduction thing…

No More NPP Acknowledgement Signatures

HHS proposed replacing the acknowledgment requirement with an individual’s right to discuss the NPP with a person designated by the covered entity.

The revised NPP would need to tell people:

• How to access their health information.
• How to file a HIPAA complaint.
• That they may receive a copy of the NPP.
• That they may discuss it with a designated person.
• Whether that person is available onsite, along with a telephone number and email address. Those header changes were proposed for all covered entities, not only direct-treatment providers.

There are more changes to the NPP but at least one checkbox is gone. Not that anyone paid attention anyway. But part of your training should include having everyone review the entire new NPP.

So start thinking about where your impacts may be and getting your policy and procedure pencils sharpened!

HIPAA has never been about checking boxes. It has always been about protecting patients and making healthcare work better for everyone involved. The upcoming Privacy Rule changes are another reminder that good compliance starts with good habits, clear procedures, and well-trained people. Take the opportunity to strengthen your program now, and your future self will thank you. Your patients probably will too, even if your ducks never realize how organized they became.

Remember to follow us and share us on your favorite social media site. Rate us on your podcasting apps, we need your help to keep spreading the word. As always, send in your questions and ideas!

Special thanks to our sponsors Security First IT and Kardon.