THE HIPAA PRIVACY RULE PROPOSED CHANGES Dianne K

THE HIPAA PRIVACY RULE: PROPOSED CHANGES Dianne K. Pledgie, Esq. February 23, 2021

PRESENTER: DIANNE K. PLEDGIE Contact information: dpledgie@ftlf. com 202. 466. 8960 • Partner and Compliance Counsel at Feldesman Tucker Leifer Fidell LLP, specializing in, among other things, assisting health centers with the implementation of effective Compliance Programs. • Manages the FTLF Premium Plan, Toolkit resources, monthly compliance webinars, and health center compliance news. • Well-versed in the compliance issues facing health centers because of her experience as Chief Compliance Officer and Manager of Government Grants for Boston Health Care for the Homeless Program, one of the largest health center programs in the country. © 2021 Feldesman Tucker Leifer Fidell LLP. All rights reserved. | www. ftlf. com 2

WHERE ARE WE NOW? June 2018 Regulatory Spring to Coordinated Care – Department of Health and Human Services (HHS) Dec 2018 Office for Civil Rights (OCR) issues Request for Information on HIPAA Privacy Rule Aug 2019 Substance Abuse and Mental Health Services Administration (SAMHSA) issues two Proposed Rules on 42 CFR Part 2 Jan 2020 Ciox Health, LLC v. Azar, et. al. Mar 2020 Coronavirus Aid, Relief, and Economic Security (CARES) Act May 2020 Office of the National Coordinator for Health Information Technology (ONC) issues Final Rules on Interoperability and Information Blocking per the 21 st Century Cures Act July 2020 SAMHSA issues Final Rule on 42 CFR Part 2 (does not include CARES Act changes) 3 Jan 2021 OCR issues Notice of Proposed Rulemaking (NPRM) on © 2021 Feldesman Tucker Leifer Fidell LLP. All rights reserved. | www. ftlf. com

HIPAA PRIVACY RULE: PROPOSED CHANGES Four Key Areas • Patients’ Right to Access their Protected Health Information • Permitted Disclosures for Care Coordination and Case Management • Permitted Disclosures Believed to be in the Best Interests of the Patient • Patient Notice Requirements © 2021 Feldesman Tucker Leifer Fidell LLP. All rights reserved. | www. ftlf. com 4

PROPOSED CHANGES: RIGHT OF ACCESS • Requests to inspect or to access PHI: – Decreases response times from 30 to 15 calendar days – Requires policy on prioritizing urgent or high priority access requests – Prohibits measures that create barriers to access • Right to inspect PHI: – Requires covered entities to permit patients to take notes, pictures or videos, except when prohibited by state law – Requires covered entities to provide right to inspect PHI at point of care in conjunction with a health care appointment, when patient’s PHI is readily available © 2021 Feldesman Tucker Leifer Fidell LLP. All rights reserved. | www. ftlf. com 5

PROPOSED CHANGES: RIGHT OF ACCESS • Right to direct copies of PHI to a third party: – Requires covered entities to provide electronic copy of PHI in an EHR to third party designated by patient – Permits patients to request such disclosures orally or in writing – Requires covered entities to submit and respond within 15 calendar days • Fees for access to PHI and electronic copies of PHI: – Prohibits fees when patient inspects PHI in person or uses an internet -based method to view/obtain a copy of electronic PHI – Permits certain reasonable, cost-based fees when patient requests either a non-electronic copy of PHI or an electronic copy of PHI through method other than internet-based method, or patient requests copies of PHI in an EHR be sent to a third party – Requires covered entity’s fee schedule to be posted on-line and available at the point of service – Requires covered entities to provide patients with fee estimate, upon request © 2021 Feldesman Tucker Leifer Fidell LLP. All rights reserved. | www. ftlf. com 6

PROPOSED CHANGES: CARE COORDINATION AND CASE MANAGEMENT • Includes care coordination and case management in definition of health care operations • Disclosures of PHI to a covered entity or health plan for individual-level care coordination and case management would not be limited to the minimum necessary • Permits covered entities to disclose PHI to third parties (social services agencies, community-based organization, home and community-based services providers, and other third parties providing healthrelated services) for individual-level care coordination and case management © 2021 Feldesman Tucker Leifer Fidell LLP. All rights reserved. | www. ftlf. com 7

PROPOSED CHANGES: DISCLOSURES IN BEST INTEREST OF PATIENT • Permits use or disclosure of PHI in certain situations based on good faith belief (current standard is “as determined by the covered health care provider in the exercise of professional judgement”) disclosure is in the best interest of the patient – Example: Permits disclosure to patient’s family members and other caregivers in emergencies, including when the patient is incapacitated • Permits use or disclosure of PHI when necessary to prevent or lessen a serious and reasonably foreseeable threat (current standard is “serious and imminent threat”) © 2021 Feldesman Tucker Leifer Fidell LLP. All rights reserved. | www. ftlf. com 8

PROPOSED CHANGES: PATIENT NOTICE REQUIREMENTS • Eliminates requirement to obtain written acknowledgement of receipt from patients • Creates patient right to discuss the Notice of Privacy Practices with designated person at the covered entity • Requires content updates to the Notice of Privacy Practices, including: – Header to include information on how to access PHI, how to file a HIPAA complaint, right to receive Notice of Privacy Practices and right to discuss Notice of Privacy Practices – Right of access, including fees and right to direct transmission of electronic copy of PHI in an EHR © 2021 Feldesman Tucker Leifer Fidell LLP. All rights reserved. | www. ftlf. com 9

NEXT STEPS • NPRM is available at 86 Fed. Reg. 6446 – https: //www. govinfo. gov/content/pkg/FR 2021 -01 -21/pdf/2020 -27157. pdf • Comments due to OCR on or before March 22, 2021. Methods for submitting comments are outlined at 86 Fed. Reg. 6446. © 2021 Feldesman Tucker Leifer Fidell LLP. All rights reserved. | www. ftlf. com 10

QUESTIONS? ? Dianne Pledgie dpledgie@ftlf. com 1129 20 th Street N. W. – Suite 400 Washington, D. C. 20036 (202) 466 -8960 www. ftlf. com learning. ftlf. com © 2021 Feldesman Tucker Leifer Fidell LLP. All rights reserved. | www. ftlf. com 11