Problems with Interoperability and Coordinated Care

May 25, 2019

Interoperability: connecting technology across health care. The idea is that if your information is in one system, clinicians can access your information wherever you go – like med lists, diagnoses, allergies, and more.

Do you know how it can backfire? Has it backfired on you? Probably not.

Read the rest of this entry »

HIPAA Request for Information Submitted Comments

February 11, 2019

Not knowing whether I’d be out of the hospital in time to submit my comments, I posted an early draft this weekend. I had the opportunity to update and amend that draft and submitted my final comments just now at The link below will take you to a .pdf of the comments submitted.

Link: Erin Gilmer Response to HIPAA RFI, February 2019

For those who still wish to comment, the commenting period is open until February 12 2019, at 11:59 PM ET. Submissions are accepted here.

Your comments do NOT have to be as detailed as mine. You can write general feedback on any of the areas of the RFI or answer any of the questions within to the extent you wish. I highly recommend you do submit comments, particularly on Section 2. As a reminder, I’ve written a recap of all the sections and what they’re all about here. And if you need a few tips on how to submit a comment, I’ve written a post to help you which can be found here.

I will be sure to update you when hear from HHS about the submissions received and any rules the promulgate as a result.

Thank you for all who have engaged in this process – whether you took the time simply to learn about HIPAA or were able to submit comments yourself. Your voices matter and will make a big difference in the lives of patients everywhere.

HIPAA Request for Information – My submission

February 8, 2019

Below you’ll find my draft comments to the OCR’s Request for Information. I don’t know if I’ll be able to revise my comments before Tuesday as I’m still in the hospital but wanted to share in case anyone wanted to read them before submitting their own comments. This draft has not been edited and likely contains many grammatical errors and areas needing clarification. There are issues I’d love to add or flesh out more, but this may be all I’m able to submit. (Note: people submitting comments do NOT need to be this detailed or answer all portions of the RFI. If you want to comment generally or only answer select questions, your input is valuable.)

Erin Gilmer DRAFT response to the Federal Request for Information on Modifying HIPAA Rules To Improve Coordinated Care

Comments are due on Tuesday, February 12, 2019.

If you aren’t sure how to comment, this post can walk you through it.

For background on the HIPAA RFI, see my post summarizing the issues here.

If you’d like to comment, you can do so here. And the original questions can be found here.

How to Comment on the HIPAA Request for Information – A Guide

January 27, 2019

The agency that oversees HIPAA (the Health Information Portability and Accountability Act) is asking for feedback on possible changes to the law through a Request for Information (RFI). The agency (OCR – Office for Civil Rights) believes that many of the provisions in the law are “regulatory burdens.” They also want to open up the ability to share your private protected health information (PHI). They say they want to do this to help coordinate care better, but it means giving up many patient rights.

To ensure that patient rights to their records and privacy of their information, it is incredibly important for patients to submit their comments to the RFI. Without patient input, other entities will likely convince the OCR to change HIPAA laws in ways that might hurt patients.

HIPAA may seem intense and hard to understand, but you don’t have to understand every aspect of the law to make a comment.

This guide will take you through the process of writing and submitting your feedback. If you have any questions, you can leave them as a comment on this post, email me at or ping me on twitter @GilmerHealthLaw. And if you send me the text of your comment, I will be glad to read it over before you submit it.

The deadline for comments is only a few weeks away – February 12, 2019.

Read the rest of this entry »

Possible Changes to HIPAA – What’s this RFI All About (A Summary)

January 14, 2019

Over the past month, I’ve been tweeting and blogging about possible HIPAA changes that may be in store after the OCR (Office for Civil Rights – HIPAA enforcers) published a Request for Information (RFI). With the deadline for comments about a month away (February 12, 2019), I thought I’d distill the information into a bit of a summary – a sort of tl;dr version of my last 5 posts.

I’d encourage anyone interested in your healthcare privacy rights to read over the information here. I’ve suggested questions at the end of each section for you to consider and will follow up in my next post with how you can submit comments on the RFI.

What is this RFI?

This is NOT a chance to comment on everything we don’t like about HIPAA. While we all know there are many places where HIPAA can be improved, this RFI is about 5 specific areas of HIPAA. The OCR has proposed very specific questions in each area for people to answer and those are what they want feedback on (those questions can be found here).

The 5 areas include:

  • Sharing information between doctors
  • Sharing substance use and mental health information with friends and family
  • Accounting of Disclosures
  • Notice of Privacy Practices
  • HIPAA “burdens” that prevent policy goals around Value-Based Care

There’s a lot here and you certainly don’t have to address every part of the RFI. You can pick and choose what is most important to you.

The rules they are interested in are primarily part of the HIPAA Privacy Rule found at 45 CFR 164, Subpart E (for the nerds who would like to catch up on the current language). In each of my previous posts I’ve taken these areas one by one and answered the questions in detail. I’ve given background on why they matter, examples of how they work now, and concerns as to why and how potential changes will harm patients.

To be clear: Changes suggested in each part will hurt patients.

Read the rest of this entry »

Possible HIPAA Changes Are Coming – HIPAA Wrongly Seen as a “Regulatory Burden” (RFI Part 5)

January 10, 2019

This post will address Part 5 the Office for Civil Rights’ (OCR) request for information (RFI) on possible changes to the Health Information Portability and Accountability Act (HIPAA). Part 5 addresses questions the OCR has about HIPAA’s “regulatory burdens.” 

For background:

  • The RFI can be found here.
  • My introduction to the RFI as well as an analysis of the 1st part (on sharing information between providers) can be found here.
  • My analysis of the 2nd part (on loosening privacy standards for substance use and mental health information) can be found here.
  • Discussion on the 3rd part (changes to accounting of disclosures) can be found here.
  • The analysis on the 4th part (on how patients get Notice of Privacy Practices) can be found here.

The 5th section of the RFI is short but sums up the OCR’s viewpoints on HIPAA, and truly it’s aims here in soliciting feedback – essentially that HIPAA regulations are a “burden.”

The title of the press release for the RFI underscores this:

HHS seeks public input on improving care coordination and reducing the regulatory burdens of the HIPAA Rules (emphasis added)

To be clear, HIPAA regulations are NOT a burden. They give patients rights and protect patients health information. But clearly the OCR and many special interests believe it is.

Read the rest of this entry »

Possible HIPAA Changes May Change How and If Patients Get Notices About Their Rights (RFI Part 4)

December 21, 2018

%d bloggers like this: