HHS Issues Rule Requiring Individuals Be Notified of Breaches of Their Health Information

New regulations requiring health care providers, health plans, and other entities covered by the Health Insurance Portability and Accountability Act (HIPAA) to notify individuals when their health information is breached were issued today by the U.S. Department of Health and Human
Services (HHS).

These "breach notification" regulations implement provisions of the Health Information Technology for Economic and Clinical Health (HITECH) Act, passed as part of American Recovery and Reinvestment Act of 2009 (ARRA).

The regulations, developed by the HHS Office for Civil Rights (OCR), require health care providers and other HIPAA covered entities to promptly notify affected individuals of a breach, as well as the HHS Secretary and the media in cases where a breach affects more than 500
individuals. Breaches affecting fewer than 500 individuals will be reported to the HHS Secretary on an annual basis. The regulations also require business associates of covered entities to notify the covered entity of breaches at or by the business associate.

"This new federal law ensures that covered entities and business associates are accountable to the Department and to individuals for proper safeguarding of the private information entrusted to their care. These protections will be a cornerstone of maintaining consumer trust as we move forward with meaningful use of electronic health records and electronic exchange of health information," said Robinsue Frohboese, acting director and principal deputy director of OCR.

The regulations were developed after considering public comment received in response to an April 2009 request for information and after close consultation with the Federal Trade Commission (FTC), which has issued companion breach notification regulations that apply to vendors of personal health records and certain others not covered by HIPAA.

To determine when information is "unsecured" and notification is required by the HHS and FTC rules, HHS is also issuing in the same document as the regulations an update to its guidance specifying encryption and destruction as the technologies and methodologies that render protected health information unusable, unreadable, or indecipherable to unauthorized individuals. Entities subject to the HHS and FTC regulations that secure health information as specified by the guidance through encryption or destruction are relieved from having to notify in the event of a breach of such information. This guidance will be updated annually.

The HHS interim final regulations are effective 30 days after publication in the Federal Register and include a 60-day public comment period. For more information, visit the HHS Office for Civil Rights web site at http://www.hhs.gov/ocr/privacy/.

-----
www.fayettefrontpage.com
Fayette Front Page
www.georgiafrontpage.com
Georgia Front Page

Patients Gain Protections in Health Information Technology Law

/PRNewswire-USNewswire/ -- Patients across the United States will benefit from a new health information technology (HIT) law providing comprehensive privacy and security standards for patient records including strong, protective provisions for psychotherapy records. The Health Information Technology for Economic and Clinical Health (HITECH) Act, part of the economic stimulus package, was passed by the House and Senate on February 13 and signed into law by President Obama on February 17.

The HITECH Act builds on the federal government's current efforts to encourage the development of a national interoperable, electronic health records network with the goal of providing improved patient care at lower cost. The core of the HITECH Act contains provisions to ensure records privacy and security as HIT develops. The Act will:

-- Provide for an ongoing process for setting standards to better ensure
that privacy and security are protected in the health care system

-- Incorporate Health Insurance Privacy and Accountability Act (HIPAA)
Privacy and Security Rule standards, where possible, including with
regard to psychotherapy notes and other sensitive patient information

-- Improve upon the HIPAA "minimum necessary" standard, which requires
that only the minimum amount of patient information can be disclosed
depending on the request for the information

-- Implement further restrictions on health care plan use of patient
records for administrative "health care operations" purposes

-- Allow a patient to pay privately for health care and not have his or
her records included in an electronic network

-- Implement a process to explore segmenting particularly sensitive
patient records (such as mental health records)

-- Provide a notice to the patient when privacy is breached

-- Examine technologies to help patients track how their records have
been disclosed

-- Contain new strong patient enforcement measures and strengthen
existing HIPAA enforcement measures

-- Require Health and Human Services to study expanding the HIPAA
psychotherapy notes authorization requirement to include mental health
testing data

-- Make psychologists eligible for funding provisions in the law to
implement health information technology into their practices and to
join into electronic networks in their communities

-- Preserve stronger state privacy laws and allow the continued
application of state consent provisions

-- Require a study for providing for patient consent in electronic
records systems

-- Protect the well-established psychotherapist-patient privilege
currently recognized under federal and state law, and

-- Provide for continued Congressional oversight to ensure the bill's
privacy and security standards are effective.

The HITECH Act is the most comprehensive HIT legislation introduced by Congress and represents a giant leap forward for psychologists and their patients, achieving strong patient records privacy and security protections.

-----
www.fayettefrontpage.com
Fayette Front Page
www.georgiafrontpage.com
Georgia Front Page

FDA Teams With WebMD For New Online Consumer Health Information

The U.S. Food and Drug Administration and WebMD today announced a collaboration that expands consumers' access to the agency's timely and reliable important health information. This joint effort reflects the FDA's emphasis on using innovative, technology-based strategies to carry out its foremost mission, which is to promote and to protect the public health.

WebMD, which attracts nearly 50 million unique visitors each month, provides consumers with credible and timely health news and information.

"We are enthusiastic about this collaboration with WebMD because it will enable us to reach more consumers with accurate, science-based information that can help them improve their health," said Andrew C. von Eschenbach, M.D., commissioner of food and drugs. "This is an important step forward in our effort to form partnerships to help bring timely safety alerts and other public health information to a wider audience in the most effective and convenient way."

The partnership includes:

* A new online consumer health information resource on WebMD.com (www.webmd.com/fda): Consumers can access information on the safety of FDA-regulated products, including food, medicine and cosmetics, as well as learn how to report problems involving the safety of these products directly to the FDA. In addition, WebMD will bring the FDA public health alerts to all WebMD registered users and site visitors that request them. The cross-linked joint resource will also feature FDA's Consumer Updates—timely and easy-to-read articles that are also posted on the FDA's main consumer Web page (www.fda.gov/consumer).
* The FDA contributions to WebMD The Magazine: FDA Consumer Updates will also be featured at least three times a year in WebMD's bimonthly magazine, which reaches nearly nine million consumers. The magazine is distributed to physician office waiting rooms across the country.

"As a leading brand of health information, we are pleased to be partnering with the FDA to provide consumers with public health and safety information, direct from the source," says Wayne Gattinella, WebMD president and chief executive officer. "This important partnership is consistent with WebMD's longstanding mission of providing for Americans access to credible and relevant health information."

Consumers have increasingly consulted all types of sources to find health information, and the Internet is their fastest growing resource, according to a national study released in August 2008 by the Center for Studying Health System Change. Researchers found that 32 percent of American consumers—70 million adults—conducted online health searches in 2007, compared with 16 percent in 2001.

The study also found that most consumers who researched health concerns reported positive outcomes. More than half of those surveyed said the information changed their overall approach to maintaining their health. Four in five said the information helped them better understand how to treat an illness or condition.

The complete terms and components of the partnership are described in a Memorandum of Understanding which is on display today at the Federal Register office and available online at http://www.accessdata.fda.gov/scripts/oc/ohrms/advdisplay.cfm.

An agency policy statement summarizing the criteria and processes for development of such partnerships is available on the FDA's Web site at www.fda.gov/consumer/cobrand_policy.html.

-----
www.fayettefrontpage.com
Fayette Front Page
www.georgiafrontpage.com
Georgia Front Page