HHS proposes changes to HIPAA records-sharing rules

The Department of Health and Human Services' Office for Civil Rights has posted proposed changes to rules regarding the disclosure of patients' health information that could give patients more insight into how their information is shared.

The 95-page proposed rule, to be published in the May 31 issue of the Federal Register, proposes changes to the privacy regulations under the 1996 Health Insurance Portability and Accountability Act. The Civil Rights Office has enforcement authority for the HIPAA privacy rule and said the proposed rule reflects changes mandated by the Health Information Technology for Economic and Clinical Health Act, or HITECH, which are part of the American Recovery and Reinvestment Act of 2009. However, the Civil Rights Office noted that it also is looking to exercise the "more general authority" granted to it through HHS under HIPAA itself. The rule comes less than two weeks after audit reports by HHS' inspector general's office took the Civil Rights Office, the CMS and the Office of the National Coordinator for Health Information Technology to task on what they found to be lagging efforts to enforce HIPAA security provisions and promote health information security.