WASHINGTON – Urged on by hospitals, doctors and patients, U.S. health officials are proposing changes to medical privacy rules that could ease information sharing in crisis situations.
Trump administration officials at the Department of Health and Human Services say their proposal, being released Thursday, adapts lessons learned from the opioid epidemic and the coronavirus pandemic.
Recommended Videos
There's no way the rule can be finalized before President-elect Joe Biden takes office, but the officials are hoping the incoming administration will support the changes and see them through.
“These are needed, uncontroversial, bipartisan reforms to these regulations,” Eric Hargan, deputy HHS secretary, said in an interview. “This was based on our request for information, and we got a lot of feedback."
Some of the proposals also would affect everyday patient interactions. One that many people might notice: Patients would have a clear legal right to take photos of their records on the spot at the doctor's office or in the hospital, if it didn't interfere with care. That includes images from MRIs. Some medical offices now allow it, while others don't.
The overhaul involves regulations under the 1996 Health Insurance Portability and Accountability Act, the statute behind the medical privacy rules people run into at hospitals, pharmacies and in their own doctor’s offices. While protecting sensitive personal information, the law, widely known by its initials HIPPAA, has also generated piles of paperwork and chronic uncertainty about what is and isn't permitted.
Among a series of changes if the proposal is finalized:
— Medical personnel could provide details about a patient's condition to family members or caregivers in an emergency if they have a “good faith" belief it would be in the patient's best interest, and there's no objection from the patient. That would address situations such as parents trying to help an adult child who’s just come out of detox for an opioid overdose. People recovering from overdose are at high risk of relapse, and officials said current rules have had the unintended consequence of chilling potentially life-saving communication.
— A subtle wording change would encourage sharing of critical information sooner in cases where there's a serious threat of harm to the patient or others. Legal permission would be triggered by a “reasonably foreseeable” threat, instead of the current requirement for an “imminent” threat. That could help when a patient is struggling with thoughts of suicide. Or it could facilitate contact tracing, as when a nursing home patient transported to the hospital for a heart problem tests positive for COVID-19 during routine screening.
— In a health care system that's notoriously compartmentalized, the changes would make it easier for a hospital or medical office to provide pertinent details about a patient's condition to another health care service provider. Medical providers would also again greater ability to coordinate with social service and caregiving agencies.
Privacy expert Deven McGraw, a former career government lawyer who once was tasked with enforcing the statute, said the proposal addresses problems regulators have been grappling with for years.
“I don't think these are partisan changes to the rules,” she said. The principal changes seem to reflect “reasonable and measured approaches.”
McGraw is now chief regulatory officer with Ciitizen, a health technology company she cofounded that helps people collect and organize their medical records to help them get the best treatment.
Roger Severino, who currently heads the HHS office that oversees medical privacy protections, said a companion set of changes in the proposal would make it easier for patients to get access to their medical records.
For example, current rules give medical offices 30 days to respond to a patient's request for records. That would be shortened to 15 days.
“With the internet age, 30 days is a relic of past times,” said Severino.
Also, if a patient authorizes a doctor to see medical records from another provider, the proposed rules stipulate that the doctor's office — not the patient — would have the responsibility of getting the files.
Generally, medical offices that offer access to records via electronic portals would not be able to charge extra for patients to download the files. “We want to make sure entities are only charging reasonable costs,” said Severino.
And the proposal would also eliminate a requirement that hospitals and doctors get signed acknowledgment from patients that they have gotten a copy of the provider's privacy policy, and then keep that documentation for six years.
The rollout of the medical privacy proposal triggers a 60-day public comment period, which means the earliest it could realistically become final is spring of next year.
Officials said there's no particular connection with the presidential transition, but that work on the changes has been going on for many months and their proposal was finally ready to be released.