Publications

ANALYSIS OF PROPOSED MODIFICATIONS AND POTENTIAL IMPACT ON IMPLEMENTATION TASKS

On March 27, 2002, the Department of Health and Human Services (HHS) issued proposed regulations that would modify certain standards in the Privacy Rule. These proposed modifications are contained in a Notice of Proposed Rulemaking (“NPRM”). Most significantly, the NPRM would permit health care providers to use protected health information (“PHI”) for treatment, payment, and health care operations activities (both their own and certain activities of other entities) without patient Consent. The NPRM expands the Privacy Notice requirements by requiring covered entities that provide direct treatment to make good faith efforts to obtain patients’ written acknowledgement of the receipt of the Notice. In addition, the NPRM provides a limited one-year extension for amending certain existing agreements to comply with the business associate standards, explains that “incidental disclosures” of PHI in the course of an otherwise permitted use or disclosure would not violate the Privacy Rule, and makes other changes to various provisions of the Privacy Rule. The analysis that follows breaks down the NPRM’s changes by implementation task, and assesses the impact the proposed changes would have on the implementation process.

Please keep in mind that the proposed modifications remain subject to further consideration and change by HHS. Final language for the Privacy Rule may not be known until October, 2002. In addition, HHS has suggested that it may be issuing further guidance and proposed regulations. Also note that in some places the NPRM contains technical corrections to the Privacy Rule that may affect policy language.