The trusted source for
healthcare information and
The health care industry is hoping that the 30-day extension to the public comment period for the final privacy regulations, just announced by the Department of Health and Human Services, results not only in a relaxation of some of the most onerous measures but also a delay in the regs’ effective date, now two years away. However, senior agency officials responsible for crafting the mammoth final rule released Dec. 20, refuse to speculate on how the final rule may change, and seasoned observers say that’s because nobody knows right now.
HHS Secretary Tommy Thompson told hospital executives at the Health Care Compliance Association’s privacy conference (HCCA) in Washington, DC, on Feb. 27 that while the agency wants a thorough review to examine the potential for unintended consequences, it remains committed to implementing the rule mandated by the Health Insurance Portability and Accountability Act of 1996.
According to Kristin Welsh, senior associate director for policy development at the American Hospital Association in Washington, DC, the association has three primary concerns — the patient consent process, requirements surrounding relationships with business associates, and current minimum necessary requirements. Those concerns track closely with the priorities outlined by Allysa Fox, executive director at the Blue Cross/Blue Shield Association in Washington, DC.
Here is a rundown of key areas in which health care representatives are seeking changes:
- The consent process. Welsh says AHA is concerned about the consent process required by the final regulation. "The whole process of providing notice and getting consent from patients is dramatically different from the proposed rule to the final rule," she explains. As it stands, hospitals and other providers are likely to waste a lot of energy figuring out how to implement this process. "We need to do more research through our own membership and then educate the administration about how it would actually work in practical terms," she says.
- Business associates. Fox says even covered entities will have to comply with a whole tangle of rules surrounding business associates. While improved from the proposed rule, Welsh agrees they still have troubling implications for hospitals that work with state data collection agencies and state associations that collect information through research activities. "We are not exactly sure at this point what we can continue doing with or without a business associate agreement," she asserts.
- Minimum necessary requirements. Fox says the minimum necessary requirements included in the final rule will add significant cost and have the potential to impede providing care. "If you constantly have to look for the least amount of information you can use or disclose when caring for a patient, you are just not going to get the best care for the patient," she says.
Meanwhile, Congress last week rescinded the Occupational Safety and Health Administration’s (OSHA) ergonomics standards, which were designed to reduce the incidence of repetitive motion injuries. Critics argued the regulations would have been extremely costly for providers to implement. According to OSHA, home health providers would have been the hardest hit with an estimated annual cost of $43 million to comply with the regulation. But hospitals, physicians, and all other providers that move patients also would have been significantly affected.
Congress used the Congressional Review Act, which permits Congress to reject regulations within 60 days of the effective date with a majority vote. President Bush now has the option to veto the resolution, but has already announced he will not do so.