The Department of Health and Human Services (HHS) is currently receiving public commentary on a proposed rule to expand the right of individuals to demand and receive "access reports" identifying who accessed their protected health information and why.
Under the Health Insurance Accountability and Portability Act (HIPAA) of 1996, individuals currently have a right to obtain such information from covered entities that retain their personal health information (PHI), but not if the access pertains to treatment, payment and health care operations—broad loopholes that virtually shut the door to access.
Using language in the Health Information Technology for Economic and Clinical Health Act (HITECH) of 2009, HHS now seeks to open individual access even for treatment, payment and health care operations—but only if the information accessed is stored in an electronic format.
Personnel Concepts will continue to monitor changes regarding HIPAA security and privacy rules and keep you alerted. Meanwhile, to help businesses better comply with relevant rules and regulations, we offer a variety of programs, posters and kits on our Web section HIPAA and COBRA Compliance.