Individual.
Reasonable cost-based fee, limited to labor for making copies, supplies for copying, actual postage and shipping, and costs of preparing a summary or explanation as agreed to by the individual.
Receiving an electronic copy of PHI through a non-internet-based method in response to an access request (e.g., by sending PHI copied onto electronic media through the US Mail or via certified export functionality).
Individual.
Reasonable cost-based fee, limited to labor for making copies and costs of preparing a summary or explanation as agreed to by the individual.
Electronic copies of PHI in an EHR received in response to an access request to direct such copies to a third party.
Tuesday, December 22, 2020
As part of its Regulatory Sprint to Coordinated Care, the US Department of Health and Human Services (HHS) recently proposed important changes to the Health Insurance Portability and Accountability Act (HIPAA) privacy rule. The changes are designed to enhance individuals’ involvement in their care, remove barriers to coordinated care and ease administrative burdens under the HIPAA privacy rule. If finalized, the changes would require significant modifications to regulated entities’ policies and procedures, training and notice of privacy practices (NPP). Interested stakeholders have until 60 days after the publication of the Notice of Proposed Rulemaking (NPRM) in the federal register to provide comments.
OVERVIEW
On December 10, 2020, the US Department of Health and Human Services (HHS) Office for Civil Rights (OCR) issued a Notice of Proposed Rulemaking (NPRM) with proposed modifications to the Standards for the Privacy of Individually Identifiable Health Information (Privacy Rule) adopted under the Health Insurance Portability and Accountability Act of 1996 and the Health Information Technology for Economic and Clinical Health Act (collectively, HIPAA). The proposed modifications support individuals’ engagement in their care, remove barriers to coordinated care and reduce regulatory burdens in the health care industry under HHS’s Regulatory Sprint to Coordinated Care.
IN DEPTH
On December 10, 2020, the US Department of Health and Human Services (HHS) Office for Civil Rights (OCR) issued a Notice of Proposed Rulemaking (NPRM) with proposed modifications to the Standards for the Privacy of Individually Identifiable Health Information (Privacy Rule) adopted under the Health Ins
Individual Right of Access
The NPRM would make several changes to individuals’ Privacy Rule right to inspect and obtain copies of their protected health information (PHI) maintained in a designated record set. The proposed changes would:
Expand the methods that individuals may use when inspecting their health information to include the ability to take notes, videos and photographs.
Require covered entity health care providers to allow patients to review PHI upon request that is readily available at the point of care in conjunction with a health care appointment.
Reduce the time limit for covered entities to provide access from 30 to 15 calendar days.