APMA News - June 2013 - (Page 16)

The New Wave of HIPAA Changes: The Final Omnibus Rule of 2013 BY J. KEVIN WEST, ESQ. , Parsons Behle & Latimer A fter almost four years, the Department of Health and Human Services (HHS) has released its long-awaited final “Omnibus” rules amending the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and the Health Information Technology for Economic and Clinical Health (HITECH) Act of 2010. The new regulations were published in the Federal Register on January 25 and were “effective” March 26, but health-care providers are not required to comply with the new rules until September 23. Many of the “new” rules are not actually new. In fact, some of the rules merely implement requirements contained in the 2010 HITECH Act. Indeed, APMA previously responded proactively to the changes made to HIPAA in the HITECH Act by publishing articles and issuing revisions to the APMA HIPAA Privacy Manual and the APMA HIPAA Security Manual in 2010. Accordingly, APMA members who have been paying attention are ahead of the game and will need to make relatively few changes to maintain full and continuing compliance. So what is new since 2010? And what must podiatrists do to comply? The following discussion will briefly summarize the new changes. The good news for all APMA members is that the necessary changes discussed below are all included in the 2013 editions of the APMA Privacy and Security Manuals available at www.apma.org/hipaa. Members have ample time to review and meet the September 2013 compliance deadlines. What’s New? The following important changes have been made to the HIPAA privacy and security rules. 1. Notice of Privacy Practices (NPP) Practitioners must revise their NPPs to reflect changes in the law (using the forms in the 2013 APMA Privacy Manual will accomplish this requirement). The new NPP provisions must fulfill the following criteria: Specify certain uses and disclosures of patient health information that require written patient authorization, such as marketing, fundraising, and sale of health information by health-care providers. The NPP must state that uses and disclosures of health information not described in the NPP will be made only with written authorization of the patient. Include a statement that patients have the right to be notified of an unauthorized disclosure of the patient’s health information. • • 16 APMA News June 2013 • Inform patients that practitioners must withhold cer- tain information from Medicare, Medicaid, or private insurance payers if: 1) the patient so requests; and 2) the patient pays out of pocket in cash for the service. 2. Business Associate Agreements (BAA) The new APMA Manuals also reflect changes required for Business Associate Agreements (BAAs). BAAs must be revised to add provisions stating the following requirements for business associates: Use “appropriate safeguards” to protect electronic health information Report breaches of health information to practitioners Enter into written agreements with the business associate’s subcontractors to protect patient health information Comply with the HIPAA Privacy Rule to the extent that the business associate carries out any of the practitioner’s obligations under the privacy rule • • • • 3. Patient Rights The 2013 APMA Privacy Manual has been revised to reflect changes to the patient rights created by HIPAA, as follows: Patient Access to Health Information. Access to and copies of patient health information (whether paper or electronic) must be provided within 30 days of the patient’s request, regardless of whether the records are located on-site or off-site. (If needed, a one-time extension of 30 days is allowed if the patient is notified in writing of the reason for the delay and of the expected date that access/copies will be provided.) In addition, if the patient requests copies of his or her medical records in electronic form, the practice will provide the records in the format requested, if possible. If the patient requests that electronic health information be sent to him or her by e-mail, the practice may do so if it first warns the patient that there is some level of risk that his or her information could be intercepted and compromised by a third party. Further, if the patient requests that the health information be transmitted to a third party in paper or electronic form, the practice must do so, once again giving an appropriate warning to the patient about the risks of doing so. The new regulations clarify that practitioners may charge patients to make paper or electronic copies, including labor costs for making the copies. All of these changes • http://www.apma.org/hipaa

Table of Contents for the Digital Edition of APMA News - June 2013

APMA News - June 2013
President’s Message
Table of Contents
The Boston Marathon Bombings: Podiatrists on the Front Line
Committee Nominations Requested
What’s the Deal with Biomechanics? How One APMA Member Helped Jerry Seinfeld End Years of Pain
The New Wave of HIPAA Changes: The Final Omnibus Rule of 2013
APMA State Advocacy Forum
Resolutions Submission Deadlines
Emotional Intelligence and Residency Education
Practice Survey Data: Practice Owner Type
It’s All Happening at The National!
Annual Scientific Meeting Registration Forms
Annual Scientific Meeting Sponsors
APMAPAC Chair Report
Coverage Corner
IT Consultant
Inside APMA’s Social Media
Bylaws Propositions Due
Website Wisdom
On the Road with APMA
Small Business 101
CPME Update
Young Physicians’ Accomplishments
Worthy of Note
Affiliates Corner
New Members
Death Notices
APMAPAC Update
Development Update
Classified Advertising
Dates to Remember
Advertising Index
10 Questions
Your APMA

APMA News - June 2013