On February 11 legislators in Wisconsin introduced Assembly Bill 793 [PDF – 25.7 KB], which proposes to reduce restrictions on redisclosures of patient health records in particular circumstances to facilitate electronic sharing of information. Wisconsin’s current law (WI ST 51.30) closely follows requirements set forth in HIPAA such as allowing the patient to authorize the disclosure of health records only after the patient is informed of the following: to whom the records will be sent, for what purpose will they be disclosed, and for what length of time the authorization is effective. The current law also requires recording what records are released and to whom they are released, creating a documentation trail.
AB 793 Section 10(b) would modify these restrictions and allow a covered entity to redisclose a patient’s health care record for a purpose for which a release is “otherwise permitted,” such as: if a patient previously has agreed to its release [see Section 9(4)(b)(1)]. Non-covered entities may redisclose [per Section 10(c)] the patient’s record subject to more qualifications, such as redisclosure for a purpose for which the patient health care record was initially received. Read in conjunction with Section 10(c), Section 10(b) would allow a covered entity to redisclose a patient’s health record in more circumstances without that patient’s consent.
As reported by the Wisconsin Technology Network, the Wisconsin Department of Health and Family Services (WDHFS) Secretary, Kevin Hayden, maintains that AB 793 does not apply to disclosures covered under HIPAA. In general, HIPAA requires a patient to consent to the release of protected health information for treatment purposes by the receiving hospital and would extend this release, for example, if the patient is transferred for continuing treatment (45 CFR 164.502). Compiling and transferring patient records for other purposes (such as research or database compilation) not related to the patient’s treatment plan or administrative health care operations generally requires a patient authorization. A valid authorization (45 CFR 164.508) contains, among other elements: to whom the information will be disclosed, the purpose of the disclosure, and the individual’s right to revoke the authorization.
If the purpose of HIPAA is read to limit the release of patient records with exceptions to facilitate present treatment, then in most instances medical records must be explicitly released by the patient for use by other individuals by means of an authorization. If the patient does authorize additional use of his records, HIPAA envisions that the patient can track the release of that record with some accountability. WDHFS seems to modify how they interpret HIPAA’s requirements as AB 793 would eliminate the requirement to obtain consent to disclose the patient’s record as well as eliminating documentation of these disclosures.
It is uncertain how WDHFS and the drafters of AB 793 are interpreting HIPAA coverage, whether their interpretation relies on assuming a patient’s singular consent is sufficient, or they plan to add measures to ensure compliance if the bill is implemented. Do they contemplate “treatment” in terms of all foreseeable future treatment? Is this framework something more state legislatures should adopt to increase the ability to retrieve patient records?
If WDHFS’s further discussion of AB 793 does in fact comply with HIPAA’s requirements, this move toward compiling health records could increase the efficiency of health care for the state’s residents. In order to ensure compliance, WDHFS may need to place additional restrictions to their records system or change the substance of patients’ initial consent. - Katherine Drabiak
No comments:
Post a Comment