On December 12, 2018, the Health and Human Services Administration (HHS) sent out a press release letting the public know that they are considering making changes to the Health Information Portability and Accountability Act (HIPAA) and seeking feedback from the public. The formal Request for Information (RFI) can be found here. Ostensibly, the HHS is saying that they want to make changes to HIPAA to “improve coordinated care” but in reading the questions, I have deep concerns for how any changes might affect patients’ rights.
Over the past week, I’ve tweeted my analyses for each part of the RFI and am going to share those tweets here (with some modifications) for those who are not on twitter or have trouble reading the long threads. This post will address my first thread, an intro to the RFI. The original thread can be found here.
First, the fact that they call provisions in HIPAA “regulatory burdens” in the press release and throughout the RFI says a lot. HIPAA isn’t a burden. It’s a law meant to help patients that’s not understood. That said, the law is not changing yet, this is simply the agency considering if it should make changes. An RFI is an opportunity to give feedback. Generally the folks commenting on RFIs are lobbyists, special interest groups, and organizations that have an interest in the laws at hand.
In this case, we can expect comments from doctor groups (like the American Medical Association), hospital groups (like the American Hospital Association), health tech groups (like AHIMA and HIMSS), health tech “innovators” (those who want to make new healthcare products and apps), and business associates (those who work with doctors and hospitals like billing/claims processing businesses). These groups have very strong lobbies with a lot of money and their interests are not always aligned with patients. In fact, most of the time, their interest is about the burden on their industry to comply with laws and money lost or gained as a result.
It is very unlikely a lot of patients will comment on this RFI because a lot of patients do not know their rights and are intimidated by submitting comments to a government agency. I would like to encourage patients to give their input which is why I’ve written the threads and am posting them here. For those who want to comment, the RFI says that people can give comments up to 60 days past the date of official publication, which was December 14, 2018. And within the RFI, there are directions in the RFI on where to send comments. (Note: My comments on the RFI are from the draft version posted on December 12, 2018. I’ve posted a pdf version of that draft below and if I become aware of significant changes, I will update this post accordingly.)
As I talk about the RFI, it’s important to note that the agency overseeing it is HHS but the specific entity underneath HHS that is looking at this is the OCR (Office for Civil Rights). The OCR oversees and enforces HIPAA. They are who patients report violations to. They are under HHS. The website for info on HIPAA is here.
The overarching areas that the OCR wants feedback on as they consider HIPAA changes can be found below. Essentially they’re looking at changes in: