By Matt Fisher, General Counsel, Carium
Twitter: @matt_r_fisher
Twitter: @cariumcares
Host of Healthcare de Jure – #HCdeJure
Gifting for the holiday season was kicked off early by the Department of Health and Human Services with some developments that should be welcome. The releases are part of an ongoing effort to improve understanding and alignment in healthcare. Further, the gifts are a bit of a two way street because there can be some back and forth interaction.
Gift 1: Proposed Part 2 Rule
On November 28th, HHS through the Office for Civil Rights and the Substance Abuse and Mental Health Services Administration released a notice of proposed rulemaking to modify the Part 2 rule. As a quick reminder, Part 2 sets out privacy requirements for substance abuse treatment records that can differ quite significantly from privacy requirements under HIPAA. The divergence of the regulatory requirements is arguably easier for facilities dedicated to substance treatment but creates a lot of mismatched processes in multi-specialty facilities.
Regardless of the setting, Part 2 requirements are very stringent and probably less understood even than HIPAA. That sets a somewhat low bar, but paints a pretty accurate picture of where things stand. In light of the differing standards, there have been a number of calls from the healthcare industry over the year for HHS to better align the two privacy standards. Absent legislation from Congress though, HHS could not do too much. That is where Section 3221 of the CARES Act entered the picture. The CARES Act required HHS to change the Part 2 rules to more closely interweave with HIPAA.
As summarized by HHS, the proposed rule would do the following along with other changes:
- Allows facilities to collect a single ongoing consent from patients for uses and disclosures made for treatment, payment, and healthcare operations purposes;
- All disclosure of Part 2 records to the same extent as allowed under the HIPAA Privacy Rule;
- Expand limitations on the use of records covered by Part 2 in legal proceedings without patient consent or a court order;
- Apply the HIPAA enforcement penalties to a Part 2 violation (editorial comment: maybe this will result in an actual enforcement action, as I cannot think of any enforcement action under Part 2);
- Require a complaint process to be set up for processing Part 2 complaints and prevent organizations from retaliating against patients that submit a complaint; and
- Extend the HIPAA Breach Notification Rule to Part 2 records.
With so many changes being proposed, it is essential to review the proposed rule and consider the ramifications of the potential changes. As those ramifications are digested, the opportunity to submit comments should be taken (the gift back). Comments must be submitted on or before January 31, 2023. Note that date now, so it isn’t forgotten after the holiday season ends.
Gift 2: Updated Mobile Health App Decision Tool
Already over 6 years old, a collaborative tool to help mobile health app developers get a gut check on what regulations apply has been updated. The online assessment tool is the result of joint efforts by the Office for Civil Rights, the Office for the National Coordinator of Health IT, the Food and Drug Administration, and the Federal Trade Commission. Each of those agencies could potentially independently or, more likely, overlappingly regulate the functionality of a mobile health app. The array of potentially applicable regulations can be difficult to parse.
The tool got a recent update to ensure that developers can stay informed of all potentially applicable regulations. As before, the tool covers HIPAA, FDA oversight, and FTC unfair and deceptive practices or acts. The tool now includes the new information blocking regulations that came out of ONC, which impose requirements similar to but arguably broader than HIPAA.
Given the importance of complying with the new information blocking rules, including them in the assessment tool is very helpful. Developers may unintentionally believe that they can skirt around having to comply with the rules, which will only result in a lot of problems later on. Going into development fully informed is always a best practice.
Happy Holidays
With the new holiday gifts in hand, hopefully everyone has a happy, safe, and productive end of the year.
This article was originally published on The Pulse blog and is republished here with permission.