HIPAA privacy rule called incomplete

Additional requirements are needed under the Health Insurance Portability and Accountability Act (HIPAA) of 1996 privacy rule’s minimum-necessary standard, according to Dan Rode, MBA, FHFMA, vice president of policy and government relations for the Chicago-based American Health Information Management Association (AHIMA).

In testimony before the Privacy and Confidentiality Subcommittee of the National Committee of Vital and Health Statistics, Rode recommended the following requirements be added to the standard:

• The covered entity should be permitted to use its professional judgment and request additional justification for the amount of protected health information requested by another covered entity.

• Responsibility for disclosure of health information should be centralized under the direction of the provider’s health information management professional to ensure compliance with legal requirements and adherence to policies for disclosure.

• The requester of personal health information should present or sign a statement stipulating that the requested information is limited to the minimum necessary for the stated purpose.

• A statement prohibiting use of the information for other than the stated purpose and requiring destruction of the information after the need has been fulfilled should accompany any disclosure of health information to external requesters.

Rode also expressed concern with the rule’s "right of the individual to request restrictions of uses and disclosure." AHIMA recommends that the "right" to restriction either be deleted from the rule or that it be optional for the covered entity to extend this right.

"From a clinical perspective, suggesting that individuals should restrict how protected health information is used or disclosed to carry out treatment, payment, or health care operations may affect future case decisions in ways not intended by the patient," Rode said. "This is contrary to the medical, ethical, and legal obligations that require providers to maintain accurate and complete medical records." For a copy of Rode’s testimony, visit AHIMA’s web site at www.ahima.org.