HITECH Breach Notification Interim Final Rule

New regulations requiring health care providers, health plans, and other entities covered by the Health Insurance Portability and Accountability Act (HIPAA) to notify individuals when their health information is breached were issued today by the U.S. Department of Health and Human Services (HHS).

These “breach notification” regulations implement provisions of the Health Information Technology for Economic and Clinical Health (HITECH) Act, passed as part of American Recovery and Reinvestment Act of 2009 (ARRA).

The regulations, developed by the HHS Office for Civil Rights (OCR), require health care providers and other HIPAA covered entities to promptly notify affected individuals of a breach, as well as the HHS Secretary and the media in cases where a breach affects more than 500 individuals.  Breaches affecting fewer than 500 individuals will be reported to the HHS Secretary on an annual basis. The regulations also require business associates of covered entities to notify the covered entity of breaches at or by the business associate. 

“This new federal law ensures that covered entities and business associates are accountable to the Department and to individuals for proper safeguarding of the private information entrusted to their care.  These protections will be a cornerstone of maintaining consumer trust as we move forward with meaningful use of electronic health records and electronic exchange of health information,” said Robinsue Frohboese, Acting Director and Principal Deputy Director of OCR.

The regulations were developed after considering public comment received in response to an April 2009 request for information and after close consultation with the Federal Trade Commission (FTC), which has issued companion breach notification regulations that apply to vendors of personal health records and certain others not covered by HIPAA.

To determine when information is “unsecured” and notification is required by the HHS and FTC rules, HHS is also issuing in the same document as the regulations an update to its guidance specifying encryption and destruction as the technologies and methodologies that render protected health information unusable, unreadable, or indecipherable to unauthorized individuals.  Entities subject to the HHS and FTC regulations that secure health information as specified by the guidance through encryption or destruction are relieved from having to notify in the event of a breach of such information.  This guidance will be updated annually.

The HHS interim final regulations are effective 30 days after publication in the Federal Register and include a 60-day public comment period.

View the Breach Notification Interim Final Regulation.

View the Press Release.

View the HITECH Breach Notification Guidance and RFI (74 FR 19006) - April 2009.

Top

Electronic Health Records and the 21st Century Health Care System

A Message from Dr. David Blumenthal, National Coordinator for Health Information Technology

In my role as National Coordinator for Health IT, I have the privilege to be part of a transformative change in health care that will help to extend the benefits of health information technology (HIT) to all Americans.  With the passage earlier this year of the Health Information Technology for Economic and Clinical Health (HITECH) Act, we have the tools to begin a major transformation in American health care made possible through the creation of a secure, interoperable nationwide health information network. 

Of course, this system is not an end in itself.  Rather, it will enable countless other improvements in the quality and efficiency of health care that will make Americans healthier and their economy stronger.

My personal belief in this transformation is not based on theory or conjecture. As a primary care physician for over 30 years, I spent the first twenty shuffling papers in search of missing studies and frequently hoping, during middle-of-the-night emergencies, that I knew enough about patients’ medical histories to make good decisions.  All that changed when I began to have access to patients’ electronic medical records.  It made me a much better doctor.  I would never go back, and neither would the vast majority of American physicians who have made the leap into the electronic age.

In fact, it would be hard for any health professional today to escape the conclusion that the antiquated, paper-dominated system we now have in place isn’t working well for patients, creates added costs and inefficiencies, and isn’t sustainable.  As we look at our nation’s annual health care expenditures of approximately $2.5 trillion, there are many ways our current system fails both patients and providers.  It is clear that change is necessary.  

But how and why is nationwide electronic health information exchange so critical to achieving such change?  Most importantly, because it provides the best opportunity for each patient to receive optimal care.  The technology will make patients’ complete medical information securely and reliably available to health care providers where and when it is needed – when clinician and patient are together facing medical decisions that can make a lasting difference. 

Better, faster, more reliable and efficient care also ultimately reduces system-wide costs by delivering results that help to avoid expensive or prolonged hospitalization from delayed or ineffective treatment, avert costly and sometimes fatal adverse events and unnecessary procedures, and can help to eliminate the onset of disease by better informed management of each patient’s health. 

The goal of assuring an electronic health record for every American is daunting.  We at the Office of the National Coordinator for Health Information Technology (ONC) do not pretend otherwise. We know this will be hard for some clinicians and hospitals, and we stand ready to help with resources provided by the Congress and the Administration. 

We also recognize that we cannot achieve the benefits of a nationwide health information system unless we can assure all Americans that their personal health information will remain private and secure when this system exists.  Putting into place safeguards for the privacy and security of this information, when it is in electronic form, will be an ongoing priority that influences and guides all of our efforts. 
 
In the days, weeks, and months ahead, we will be rolling out a number of pivotal initiatives called for under the HITECH Act.  I urge you to join and support us as we lay the foundation for every American to benefit from an electronic health record, as part of a modernized, interconnected, and vastly improved system of care delivery.  We at ONC will be making every effort to keep you updated and fully engaged in all the steps of this national journey.

Sincerely,

David Blumenthal, M.D., M.P.P.

Top

Attendees at the 2009 AHIMA Hill Day in front of Senator Christopher “Kit” Bond’s Office.

From left: Sue LaBonte, MHIMA Delegate, Michelle Kornfeld, MHIMA Delegate and Advocacy Liaison, Marsha Dolan, MHIMA Member and Past-President 2005-06, Dalton Sweiger, Future Senator and/or HIM Professional, Lucy Sweiger, MHIMA Member

Top

States Launch Stimulus Sites

Adapted from Federal Telemedicine NEWS.  March 4, 2009 edition. 

Several states have set up stimulus web sites to help residents learn about the federal stimulus law, how stimulus dollars will be spent in individual states, and how the sites will track specific recovery projects. A number of states are planning web sites but some of the state sites are already up and running.

A few of the sites:

• Alabama is expected to receive $3 billion. The site provides information on funds for various programs at www.stimulus.alabama.gov. The site will be updated to reflect new information on the stimulus law as federal agencies issue specific regulations on funding uses and requirements. The site will soon include a feature to allow organizations and individuals to submit proposals for use of the funds. At that point, submitted proposals will be reviewed to identify projects that might qualify for funding. Much of the information regarding individual programs and applications is not yet available

• Massachusetts is expected to receive between $6 and $9 billion over the next two-plus years. The governor has plans to invest in infrastructure, information technology, and broadband access. The website www.mass.gov/recovery will enable residents to track state performance in implementing projects and the success of those projects. Last December, the Patrick Administration began mobilizing for recovery aid and established Task Forces to review and develop clean energy, education, information technology, and other projects that may be eligible for federal funding

• Ohio is working to lower healthcare costs. The website http://recovery.ohio.gov is an interactive portal for entities to submit proposals for stimulus dollars and to view general information. As of 3/1/2009, 13,423 proposals have been submitted

• Maryland’s site www.recovery.maryland.gov will enable residents to track projects using the Geographic-Information System. The state is planning a series of workshops for local government officials to share information about applying for grant money and to examine the impact and flow of the dollars coming to the state. StateStat will maintain the site

• Virginia launched www.stimulus.Virginia.gov with interactive features and capabilities to enable users to view submitted projects by location or category. The evaluation of submitted projects will begin Friday March 6th. The data breaks down projects by county, category, cost, and produces a daily tally of projects submitted. Since February 10th, more than 3,300 project ideas for funding have been submitted

• Wisconsin’s site www.recovery.wisconsin.gov will provide information on where the stimulus funds are going to go within the state along with the activities, projects, and programs that will be eligible for the funds. Information is provided on potential projects and eligibility requirements for funds. In the future, the site will go to specific state agencies and programs that will be administering the contracts and grants

• New York is expected to receive at least $24.6 billion from ARRA of 2009. The site www.economicrecovery.ny.gov will track how funds are spent and where to submit proposals for funding. The Governor created the New York State Economic Recovery and Reinvestment Cabinet to manage the development of state and local infrastructure projects.

Top

AHIMA House of Delegates Update

From the AHIMA Advantage Alert:

The House of Delegates meeting on October 12 in Seattle, WA, was informative, interactive, and discussion-filled. There were three action items voted on at the meeting (Proposed Privacy and Security Resolution, Proposed Bylaws Amendments on Certification Governance/Third-party Accreditation, and Proposed Credential in Health Data Analytics) and all passed. Here is some additional information on the items.

Action item one—Proposed Privacy and Security Resolution, was developed for members’ use with four specific resolutions for action by members.

Action item two—The proposed bylaws amendments on Certification Governance was needed to advance AHIMA’s efforts to seek third-party accreditation of the Council on Certification (COC) by the National Commission for Certifying Agencies (NCCA) and the American National Standards Institute (ANSI). To obtain this accreditation, it was necessary to transfer final authority for approval of the certification standards for the profession from the House of Delegates to the COC. The new name is Commission on Certification of Health Informatics and Information Management Professionals.

Action item three—Proposed Credential in Health Data Analytics. The COC’s pursuit of the new credential will expand AHIMA’s certification portfolio with the focus of the credential being in the area of health data analytics. For more information about these action items and discussion from the meeting, visit the “Resources” section of the State Leaders and HOD CoP. Log into the CoP at http://www.ahima.org.