HHS seeks ideas on HIPAA tweaks to boost care coordination

Dive Brief:

• The HHS Office for Civil Rights is seeking input on how the HIPAA privacy rule could be tweaked to better support the move to value-based, coordinated care, while still protecting personal health information.
• The request for information asks for ideas on removal of regulatory barriers to ease care coordination and case management, as well as covered entities and business associates’ technical capabilities to achieve these goals under HIPAA rules.
• The RFI comes as the opioid crisis and other public health challenges are increasing the need for care coordination and PHI exchange among HIPAA-covered entities such as hospitals and clinics and noncovered entities like homeless shelters and local support systems.

Dive Insight:

Patients and providers want to protect PHI, but HIPAA can sometimes impede care coordination between different care teams, particularly those that are covered entities. HHS is trying to strike a balance by looking at possible changes to the privacy rule that would ease concerns about HIPAA violations.

“In addressing the opioid crisis, we’ve heard stories about how the Privacy Rule can get in the way of patients and families getting the help they need,” HHS Deputy Secretary Eric Hargan said in a statement. “We’ve also heard how the Rule may impede other forms of care coordination that can drive value.” 

For example, covered entities may be reluctant to share PHI with noncovered entities that support homeless people or those suffering from chronic conditions, such as mental illness. The RFI asks whether there needs to be an “express regulatory permission” for covered entities to disclose PHI to social service agencies and community-based support groups, and the criteria for such a permission.

In addition to general feedback on HIPAA, OCR seeks input on modifications to four facets of the privacy rule:

• Encouraging information sharing for treatment and care coordination by incentivizing covered entities to disclose PHI to other covered entities
• Facilitating parental involvement in care through shared treatment information, with a focus on the opioid crisis and serious mental illness
• Implementing the requirement of the Health Information Technology for Economic and Clinical Health Act to include, in an accounting of disclosure, disclosures for treatment, payment and healthcare operations from an EHR in a way that that minimizes regulatory burdens.
• Changing the requirement for certain providers to make a good faith effort to obtain an acknowledgement of receipt of the Notice of Privacy Practices.

The RFI is part of HHS’ Regulatory Sprint to Coordinated Care initiative, which Hargan leads. Comments are due Feb. 11.