HIPAA Regulatory Alert

Hospitals having problems with privacy reg, AHA says

Three aspects of rule creating unnecessary burdens

American Hospital Association (AHA) attorney Lawrence Hughes said there are aspects of the privacy rule that still are not working well and are creating unnecessary burdens for hospitals, with little benefit to patients. One of the biggest concerns that hospitals have, Hughes told a subcommittee of the Department of Health and Human Services (HHS) National Committee on Vital and Health Statistics, is the burden associated with the accounting of disclosures requirement. "This burden requires that hospitals, even if they haven’t received any requests for accounting, create an enormously burdensome paperwork system to be prepared to respond to any accounting," Hughes said.

He reported that the AHA has put together a proposal for a less burdensome approach to the need to get information to patients and has discussed it with HHS staff.

Another area of concern for hospitals, according to Hughes, is the "burden of trying to negotiate and deal with folks who are requesting that they become business associates." He said it seems that many organizations want to become business associates under a mistaken impression that being a business associate would give them the opportunity to get information and use it in multiple ways that are prohibited under the Privacy Rule.

According to Hughes, hospitals have to deal with such requests daily, and there is a need for education and guidance directly from the HHS Office of Civil Rights because organizations that want to become business associates often don’t seem to believe what hospitals tell them. "So," he said, "they need some sort of backup educational materials coming directly from OCR that would help them in addressing those kinds of mistaken impressions about business associate agreements."