The Federation of American Hospitals and the Association of American Medical Colleges have weighed in with criticism of proposed changes to federal privacy rules that would expand a patient's right to request and receive an accounting of disclosures of their medical records.
The concerns expressed by both organizations point at rule changes that would require a so-called "access report" of disclosures of patient information within an organization.
The American Recovery and Reinvestment Act of 2009 included significantly more-stringent patient privacy protections in the use of electronic health-record systems through amendments to the privacy and security provisions of the Health Insurance Portability and Accountability Act of 1996. One of those changes requires organizations identified in HIPAA as covered entities, including hospitals and physician practices, to provide patients on request with a log of who has seen their records for the common uses of treatment, payment and other healthcare operations—disclosures that previously had been exempt from the HIPAA reporting requirements.
In its proposed rule issued in May, HHS' Office for Civil Rights bifurcated its description of the disclosure-reporting procedure to include what it called an access report that would cover in-house views of a patient's health records. Protests of the access-report section of the proposed rule
have been common among organizations that have submitted public comments on the rulemaking. The comment period closed Monday.
The FAH argued (PDF)
the proposed rule "goes well beyond implementing" the statute. "The proposed new right to an access report detailing all uses by covered entities is an undesirable, costly and administratively burdensome expansion of policy in an area where there has been virtually no patient interest or activity," according to the federation.
HHS should implement the requirement to account for disclosures through an electronic health-record system "when there is a broad agreement that certified EHR technology is widely available that is sufficient to handle this task," the federation added.
Furthermore, according to the letter's authors, "HHS should withdraw the proposed right to an access report at this time" to allow for further study of "the equation of whether the benefits to patients from such a right outweigh the substantial cost and burden that such a right would place on covered entities."
The AAMC, in its seven-page comment letter
, asked that the civil rights office "withdraw all provisions related to the access report." It continued: "If OCR determines that this necessitates major revisions related to the accounting for disclosures requirements, then the agency should consider withdrawing the entire rule and developing a new notice of proposed rulemaking."