Helen Oscislawski | Legal Health Information Exchange

How the Preventing Harm Exception Changes HIPAA

How the Preventing Harm Exception Changes HIPAA

by Helen Oscislawski | Feb 9, 2021 | HIPAA, HIPAA Privacy, Information Blocking

the “Preventing Harm Exception” under the Information Blocking Rule is not only the most challenging exception to apply, but also the most difficult to interpret – particularly where some of the standards do not exactly track HIPAA, and still other imprecise language ONC used has made its interpretation uncertain. In this post, I will attempt to distill the Preventing Harm Exception down to its basic elements, as well as point out issues in its interpretation to be aware of.

A Look Ahead to 2021

A Look Ahead to 2021

by Helen Oscislawski | Jan 18, 2021 | 42 CFR Part 2, HIE & HIN, HIPAA, Information Blocking

The new year has much in store for electronic health information exchange compliance! Today’s post provides an overview of anticipated changes to the health information regulatory landscape in 2021, including increased interoperability efforts and telehealth expansion due to the coronavirus pandemic. It is not surprising that many of the topics discussed below are a direct result of the interoperability requirements created by the 21st Century Cures Act (“Cures Act”) enacted in December 2016.

Our Stockings are Stuffed with Compliance Tools

Our Stockings are Stuffed with Compliance Tools

by Helen Oscislawski | Dec 23, 2020 | 42 CFR Part 2, GDPR, HIE & HIN, HIPAA, Legislation & Rulemaking

Seasons Greetings to all of our readers! First, we want to wish you and yours a holiday season filled with health, happiness and hope! We also want to thank you all for continuing to make Legal HIE such a popular and highly visited blog! It puts a smile on our face seeing so many of you enjoying our posts and returning to our site often!

As stockings are being hung by chimneys with care, we want to make sure you know that Legal HIE’s stockings are absolutely stuffed to the brim with tremendous tools, sample forms, polices and turn-key solutions that can help your organization stay on top of the most pressing compliance challenges, and ever-changing healthcare regulatory landscape. 2021 promises to be a year with many new and final regulations going into effect, and being released. The Legal HIE compliance library was created specifically for this purpose – to help busy and overwhelmed compliance officers and attorneys keep up with these changes by offering turn-key samples and solutions as a solid starting point.

OCR Publishes New Guidance on Sharing PHI through HIEs for Public Health Purposes

OCR Publishes New Guidance on Sharing PHI through HIEs for Public Health Purposes

by Helen Oscislawski | Dec 21, 2020 | COVID-19, HIE & HIN, HIPAA

Last Friday, the Office for Civil Rights (OCR) issued new Guidance on how HIPAA permits covered entities and their business associates to use health information exchanges (HIEs) to disclose PHI for the public health activities of a Public Health Authority (PHA). Specifically, it provides examples relevant to the COVID-19 public health emergency. OCR Director, Roger Severino, specifically notes that the Guidance was issued:

“to highlight how HIPAA supports the use of health information exchanges in sharing health data to improve the public’s health, particularly during the COVID-19 public health emergency.”.

Although much of the Guidance document simply reiterates the controlling HIPAA Privacy Rule provisions and definitions which have always afforded a mechanism through which covered entities (CE) and their contracted business associates (BA) can share ePHI with a public health authority for public health purposes, there are a few notable new take-away nuggets.

A “Double-Double” Set of Proposed Rules from CMS & OCR Affecting Data Sharing & HIPAA

A “Double-Double” Set of Proposed Rules from CMS & OCR Affecting Data Sharing & HIPAA

by Helen Oscislawski | Dec 14, 2020 | CMS Proposed Rule, HIPAA, HIPAA Privacy, Information Blocking, Legislation & Rulemaking

Late last week, two new proposed rules were released which will affect the exchange of health information and HIPAA, among other things. The CMS and OCR proposed rules come in at over 347 and 357 pages respectively – so that’s a lot of meat to digest! At a high level, the CMS Proposed Rule aims to “improve the electronic exchange of health care data among payers, providers, and patients,” and “streamline processes related to prior authorization to reduce burden on providers and patients.” The OCR proposed changes to HIPAA take a bite out of patient access, minimum necessary, the HIPAA NPP and more . . .

ONC Releases Answers to Frequently Asked Questions to Information Blocking

ONC Releases Answers to Frequently Asked Questions to Information Blocking

by Helen Oscislawski | Nov 4, 2020 | Information Blocking, Tools & Resources

On Monday, ONC posted a new Information Blocking Frequently Asked Questions resource! Here are a few of the highlights from all of the FAQs responded to by ONC:

Q: Are health plans or other payers subject to the information blocking regulation?

Q: For the period of time when Information Blocking is limited to USCDI data, how is an Actor expected to fulfill a request for USCDI data if they do not yet have certified health IT in place that includes an API with the USCDI standard?

Q: Is an Actor required to fulfill a request for access, exchange or use of EHI with all the EHI they have for a patient or should the amount of EHI be based on the details of the request?

Halloween Treat! HHS Delays Information Blocking Compliance Deadline to April 5, 2021!

Halloween Treat! HHS Delays Information Blocking Compliance Deadline to April 5, 2021!

by Helen Oscislawski | Oct 28, 2020 | Other

Interim Final Rule with Comment Period Responds to COVID-19 Pandemic. Responding to public health threats posed by the coronavirus pandemic, today the U.S. Department of Health and Human Services’ (HHS) Office of the National Coordinator for Health IT (ONC) released an interim final rule with comment period that extends the compliance dates and timeframes necessary to meet certain requirements related to information blocking and Conditions and Maintenance of Certification (CoC/MoC) requirements.

Who is on the “Hook” for Information Blocking?

Who is on the “Hook” for Information Blocking?

by Helen Oscislawski | Oct 21, 2020 | Information Blocking, Tools & Resources

ONC’s final rule on Information Blocking implements the 21st Century Cures Act and fleshes out what is and is not a prohibited information blocking practice. However, not all health care organizations and their vendors are on the hook for complying with this new regulation. In my post today, I want to drill down on the scope of health care providers that must comply with the Information Blocking Rule.

Per ONC, Lab Results Generally Cannot be Delayed to “Prevent Harm” (unless threat to life & physical safety)

Per ONC, Lab Results Generally Cannot be Delayed to “Prevent Harm” (unless threat to life & physical safety)

by Helen Oscislawski | Oct 8, 2020 | HIPAA Privacy, Information Blocking

As the November 2nd deadline for compliance with ONC’s Information Blocking Rule nears, many health care providers – which are “Actors” subject to the Rule – are scrambling to reexamine their default settings for sharing various types of data, including lab results. In ONC’s Final Rule preamble, several commenters indicated that providers’ current organizational policies call for practices that delay the release of laboratory results so that the patient’s clinician has an opportunity to review the results before potentially needing to respond to patient questions, or has an opportunity to communicate the results to the patient in a way that builds the clinician-patient relationship.

Info Blocking Rules have you STRESSED?!! Join Helen O. for Two Not-to-Miss Workshops for Help!

Info Blocking Rules have you STRESSED?!! Join Helen O. for Two Not-to-Miss Workshops for Help!

by Helen Oscislawski | Sep 23, 2020 | HIPAA Privacy, HIPAA Security, Information Blocking, Privacy & Consent, Webinars & Education

Join me for a pair of 1.5hr Information Blocking Workshops designed to work thorough the nitty-gritty details of the Information Blocking Rule. The first Workshop will take place WEDNESDAY (9/30) so don’t delay! Workshops will include use cases and scenarios aimed at real challenges faced by health care providers looking to comply with these new regulatory standards for access and sharing of electronic health information. Registrants will receive 2 sample P&Ps, and much more!

OCR Delivers a Quintuplet of HIPAA Resolutions – Sets the Tone for Providers Blocking Patients’ Access to PHI

OCR Delivers a Quintuplet of HIPAA Resolutions – Sets the Tone for Providers Blocking Patients’ Access to PHI

by Helen Oscislawski | Sep 16, 2020 | Government Enforcement, HIPAA, Information Blocking

Yesterday, all at once, OCR announced that it has entered into five new Resolution Agreements — each of them stemming from one or more violations of HIPAA’s right of access afforded to individuals. There are several interesting observations about these new cases that are worth taking note of.

OCR Puts the Summer HIPAA Heat on Two Organizations with New Resolution Agreements

OCR Puts the Summer HIPAA Heat on Two Organizations with New Resolution Agreements

by Helen Oscislawski | Sep 4, 2020 | Government Enforcement, HIPAA

After over almost four months of no new HIPAA Resolution Agreements or Civil Money Penalties, OCR quietly posted two new HIPAA settlement agreements at the end of July. At first glance, both appear to be “run-of-the-mill” cases with nothing much new to learn with the first one resulting in OCR finding that the covered entity failed to even complete a basic Security Risk Analysis and training of workforce, and the other involving – yes, yet again – a stolen unencrypted laptop. However, the second case in particular deserves closer examination where it has embedded in it more complex corporate structure and liability issues where it actually involved two legally separate covered entities that elected to designated themselves as a single covered entity for purposes of HIPAA. Let’s look at each case separately.

Big Changes to Big Breaches of Data and Notification Requirements Coming Soon!

Big Changes to Big Breaches of Data and Notification Requirements Coming Soon!

by Helen Oscislawski | Aug 21, 2020 | 42 CFR Part 2, Data Breach Laws, Legislation & Rulemaking

Yesterday, the period for public comment on the FTC’s Health Breach Notification Rule closed. The FTC’s Health Breach Notification Rule requires vendors of PHRs and PHR-related entities to notify the FTC if they experience a breach of security involving unsecured health information. Another area of change to Breach Notification is arising out of the CARES Act which was was enacted into law on March 27, 2020 and is making significant changes 42 C.F.R. Part 2. Among other changes that the CARES Act is introducing, it creates an entirely new obligation on Part 2 providers to notify SAMHSA of uses and disclosures of Part 2 data in any manner not authorized under Part 2! To date, 42 CFR Part 2 did NOT include an independent obligation to report or notify any agency (i.e., SAMHSA or HHS) of any use or disclosure of Part 2 information which was in violation of 42 CFR Part 2.

ONC Just Announced a New HIE Funding Opportunity for HIE Services Benefiting Public Health & COVID-19

ONC Just Announced a New HIE Funding Opportunity for HIE Services Benefiting Public Health & COVID-19

by Helen Oscislawski | Aug 12, 2020 | COVID-19, HIE & HIN

The award will allocate $2.5M to fund up to 5 awards (in the amount of up to $500K EACH) with a period of performance of up to 2 years in the form of cooperative agreements with funding contingent upon availability of funds, satisfactory completion of milestones, and a determination that continued funding is in the best interest of the federal government and the public. SHORT TURN AROUND! Deadline is September 1, 2020 to get Applications in.

« Older Entries

Next Entries »

Archives

Categories

42 CFR Part 2 (8)
Anti-Kickback Statute (1)
Care Coordination (1)
CMS Proposed Rule (2)
COVID-19 (14)
Data Breach Laws (24)
FTC (Federal Trade Commission) (3)
GDPR (2)
Government Enforcement (48)
Health IT (29)
HIE & HIN (49)
HIPAA (69)
- Business Associates (2)
- Covered Entity Provider (1)
- HIPAA Breach Notification (2)
- HIPAA Privacy (11)
- HIPAA Security (7)
Information Blocking (31)
Lawsuits (29)
Legislation & Rulemaking (31)
Meaningful Use & Quality Payment Program (39)
OIG Proposed Rule (1)
Other (19)
Privacy & Consent (43)
Research (2)
Security & Cybersecurity (6)
Stark Law (1)
TEFCA (1)
Telehealth/Telemedicine (2)
Tools & Resources (6)
Webinars & Education (10)