Under the ONC’s Final Rule on Information Blocking, Health Care Providers, HIEs and HINs will be legally prohibited from interfering with the access, exchange, or use of EHI unless an exception applies. However, HIEs/HINs that are HIPAA Business Associates are not allowed to use or further disclose PHI other than as permitted or required by their HIPAA BAAs with respective health care providers. So, what happens if a Health Care Provider and its HIPAA Business Associate HIE/HIN disagree on whether an exception allows EHI to be withheld from access, exchange or use under a certain set of specific facts?
HHS Notification of Enforcement Discretion Regarding COVID-19 Community Based Testing sites
On April 9th, HHS announced a new Notification of Enforcement Discretion Regarding COVID-19 Community Based Testing Sites. The Notification of Enforcement Discretion has a retroactive date to March 13, 2020. The HHS Notification informs the public that it is exercising its discretion...
SAMHSA Public Session to Discuss Part 2 Regulations & HIE
SAMHSA Public Session to Discuss Part 2 Regulations & HIE The Part 2 regulations which govern and protect information created by drug and alcohol rehabilitation providers have caused challenges for electronic health information exchange ever since HIE became a household term (….ok, well at...
OCR Releases HIPAA De-identification Q&A Guidance
OCR Releases HIPAA De-identification Q&A Guidance With the weekend coming up, why not take a break from the holiday frenzy and read through OCR’s new HIPAA De-identification guidance. The approximately 30-page guidance document is an easy read, even for those of us who aren’t...
We “Like” Organ Donor Status on Facebook
We “Like” Organ Donor Status on Facebook This post has been prepared by Christina Strong, Esq. The addition of “organ donor status” to Facebook is a tremendous boon for the communication of what is fast becoming a social norm, altruistic donation of one’s body, to take place after death. Unlike...
Grantees of HIE Funds Get “PIN-ned” on Privacy, Security and Patient Consent
Grantees of HIE Funds Get “PIN-ned” on Privacy, Security and Patient Consent On March 22, 2012 HHS/ONC released a new Program Information Notice (PIN) called the “Privacy and Security Framework Requirements and Guidance for State Health Information Exchange Cooperative Agreement Program” (P&S...
ACO Rule Keeps HIE Consent “On the Fence”
When DHHS published its Proposed ACO Rule in April 2011 and then the Final ACO Rule in November 2011 (I’ll refer to them as the “ACO Rules”), discussions focused predominately on issues such as who is “qualified” to participate, what the required governance structure should be, what methodology will be used to assign Medicare beneficiaries, and what the payment models will be. However, as I digested the ACO Rules, my reading deliberately slowed down as I zeroed in on the not unremarkable language and comments CMS included with regard to sharing individually identifiable health information in the ACO context.
California HIE Demonstration Projects to Move Ahead with Opt-In Framework
California HIE Demonstration Projects to Move Ahead with Opt-In Framework This past Wednesday, the California Office of Health Information Integrity (CalOHII) released a comprehensive whitepaper examining patient consent and other HIE framework efforts for entities participating in the...
Supreme Court to Hear Arguments on Suit for Damages under the Privacy Act
Supreme Court to Hear Arguments on Suit for Damages under the Privacy Act The Supreme Court is scheduled to hear oral arguments tomorrow, November 30, in a suit for damages under the Privacy Act stemming from a wrongful disclosure of confidential information. Federal Aviation...
Segmentation of Sensitive Data with Health Information Exchange
This article discusses generally certain legal and other challenges that networked HIE presents, as well as the effort of one HIE initiative that is looking to implement a technical solution to “segment” sensitive data and place it behind additional technological safeguards.
ONC’s Model PHR Notice Now Available to Vendors
ONC’s Model PHR Notice Now Available to Vendors Following the release of its Federal Health IT Strategic Plan, the Office of the National Coordinator (ONC) has made available a Personal Health Record (PHR) Model Privacy Notice for PHR vendors to use in communicating their data practices...
Helen to Speak on Solving Privacy Dilemmas with Health Information Exchange at national Health Care Info Privacy Forum
Helen to Speak on Solving Privacy Dilemmas with Health Information Exchange at national Health Care Info Privacy Forum To Register, click here.
U.S. Supreme Court Strikes Down Vermont’s Prescription Drug Data Mining Ban Law
U.S. Supreme Court Strikes Down Vermont’s Prescription Drug Data Mining Ban Law Last Friday, the United States Supreme Court struck down the Vermont Prescription Confidentiality Law allowing prescriber-identifying information to be sold and disclosed by pharmacies and pharmaceutical...
Maine Reverts Back to Opt-Out Approach for HIE
Maine Reverts Back to Opt-Out Approach for HIE In my previous post (April 26, 2011), I discussed legislation proposed by privacy advocates in Maine which would require, among other things, that patients “opt-in” before any information could be collected, accessed or disclosed through...
Sequestration of Sensitive Data with HIE: A New Jersey Pilot
One NJ HIE pilot is testing “plug in” software that scans data residing in the HIE repository and “tags” it where certain terms are found which correspond to rules developed around state and federal laws restricting access to such information unless certain pre-conditions have been met, such as the patient giving prior written consent. Once identified, the tagged data element, or document if it is not a discrete data segment, is removed from viewing, but leaving a “flag” noting that certain information is incomplete and that additional requirements need to be met before it can be accessed i.e., the patient’s affirmative consent has been obtained.