On February 7, 2013, our partner Keith McMurdy, Esq., posted an excellent entry on the Employee Benefits Blog of Fox Rothschild LLP that merits republishing for our readers as well. The post outlines some direct effects of the new HIPAA Omnibus Rule on employers and their health plans.
Keith McMurdy writes as follows:
On January 25, the new (final?) rules about HIPAA Privacy under the HITECH Act were issued in the Federal Register. While the effect of the new rules may not be to substantially change the way HIPAA privacy is viewed, there are a number of action items for employers as plan sponsors that have to be accomplished when these rules go into effect.
There are two pieces of good news. The first is that the general purpose of compliance remains the same. Plan sponsors have to ensure PHI is properly protected, refrain from impermissible disclosures and provide notices of security breaches. The second is that the earliest possible deadline for compliance with the new rules is September 23, 2013, so there is some time to prepare. But it is not a bad idea to start preparing now. So let’s consider the key changes.
1. Tougher Security Breach Notification Standard
Under the old rule, the standard for notification to participants of a security breach was only necessary if the release of information "posed a significant risk of financial, reputational or other harm" to a covered person. Now, that standard is tightened to apply to ANY security breach unless the plan sponsor can prove "a low probability that the [PHI] has been compromised based on a risk assessment." This should encourage plan sponsors to tighten their security breach protections because any release, even things like accidental e-mails, can potentially become reportable events. So the first step in compliance would be to review security standards and document steps taken to avoid security breaches.
2. Tougher Standards for Business Associates Agreements
Because the new rule provides for penalties to a covered entity for breaches by business associates, the default position is that plan sponsors should be much more concerned about how compliant their business associates really are. Where in the past, plan sponsors may have felt comfortable simply handing off certain protection functions to service providers, the new rule makes it pretty clear that plan sponsors have to actually know that their business associates are HIPAA compliant and diligently seek to confirm that compliance.
3. New Privacy Notices for 2013 Open Enrollment
The new rule also requires that plan sponsors add or amend their privacy notices:
- The notice must specifically state that the covered health plans are required to obtain plan participants’ authorization to use or disclose psychotherapy notes, to use PHI for marketing purposes, to sell PHI, or to use or disclose PHI for any purpose not described in the notice as well as a statement explaining how plan participants may revoke an authorization.
- The notices must state that the plans (other than a long-term care plan) are prohibited from using PHI that is genetic information for underwriting purposes
- The notice must inform plan participants of their right to receive a notice when there is a breach of their unsecured PHI.
The new rules makes it clear that since this new language is a "material change," plan sponsors are required to distribute this revised notice, even if they had just recently sent the old notice.
4. Genetic Information and the GINA Notice
The Genetic Information Non-Discrimination Act of 2008 (GINA) prohibits discrimination based on genetic information. The HIPAA Privacy Rule now similarly prohibits HIPAA-covered plans from taking genetic information into consideration when offering incentives or discounts through a health risk assessment. Because this modification of the Privacy Rule materially affects how a plan may use PHI, the HIPAA Privacy Rule requires that plan participants be informed in the plan’s privacy notice of the prohibition on the use of PHI for underwriting purposes. See the second item under Part 3, above.
So in the midst of our struggles to comply with PPACA, plan sponsors should not forget about HIPAA medical privacy concerns. Start pulling together privacy notices, business associates agreements and plan documents for review and amendment. Review your security practices to avoid even accidental breaches. And be prepared to issue new notices as necessary for your next open enrollment. For more detailed information about HIPAA and HITECH Compliance, please make sure to check out our HIPAA Blog as well. More information means better compliance, which is always a good thing.