April 9, 2020
Maverick’s Update
Only What Matters on Health Information Policy
Maverick Health Policy is enjoying writing this newsletter outdoors in the spring sunshine, where we will continue to report on health information policy news that is relevant to the COVID-19 crisis. And let’s call it C19 from now on.
The HHS Office for Civil Rights (OCR) announced, effective immediately, that it will not impose penalties for HIPAA privacy rule violations against providers or their business associates for public health-related reasons during the pandemic. Indeed, OCR has a new webpage with its C19 related materials.
Steve Posnack of the HHS Office of the National Coordinator for Health Information (ONC) is dusting off a community bulletin board for health IT professionals (Maverick’s description, not Steve’s) he started 4 years ago because it may help develop tools to combat C19. At least 84 projects have been posted to the “Interoperability Proving Ground (IPG)” platform, including PatientLink’s C19 symptom tracker and b.well’s C-19 Connected Health platform that aims to help triage patients, connect them to virtual care and make sure their caregivers are connected to what’s happening.
On April 15th at 2 pm ET, you can find out more about ONC’s Leading Edge Acceleration Projects (LEAP) funding opportunity at an informational session. Boston Children’s Hospital and MedStar won the nearly $2M LEAP award in 2018.
A new study explores how 10 health systems approached the implementation and use of patient-facing APIs to improve patient access to their electronic health information.
One Thoughtful Paragraph
We are waiting for ONC and CMS to say whether they are going to “pause enforcement” of the final interoperability rules due to C19 (as Politico Morning eHealth reported on April 8th). It is unclear what “pausing enforcement” means if it is not an actual compliance deadline delay, but we remember when the HIPAA privacy rule struggled to get off the ground. In 2013, AHIMA published a timeline of what happened back then (this is an abridged version):
HIPAA Timeline - Tracking Important Dates
August 21, 1996
HIPAA Passed by Congress
2000-HIPAA Privacy Rule Finalized by HHS
Becomes first federal healthcare information privacy law
2001-HIPAA Stalls
Bush Administration reopens HIPAA Privacy Rule Comment Period
2002- Bush Administration Announces Support of Modified HIPAA
Exceptions for “treatment, payment, and healthcare operations: added
April 14, 2003
HIPAA Privacy Rule Compliance Deadline
2008 - Lack of HIPAA Enforcement
More than 33,000 HIPAA complaints filed with OCR to date, only 8,000 investigated with no fines issued
February 17, 2009
ARRA’s HITECH Act Signed into Law
HIPAA revised to strengthen enforcement penalties, require breach notifications, and expand patient rights
2009-OCR Ratchets up HIPAA Enforcement
Some entities fined millions of dollars for privacy breaches
January 25, 2013
HITECH’s HIPAA Modification Final Rule Released
In no way is Maverick Health Policy implying that CMS or ONC will similarly struggle to implement the interoperability rules. In fact, both agencies can be expected to follow-through with all due speed on the long-term efforts to create and incentivize a simplified and modern flow of health information. Maverick is simply noticing that despite a prolonged and difficult beginning to embed the HIPAA privacy rule in our collective everyday health care activities, it happened. If, during this unprecedented crisis, ONC and CMS are considering how best to relieve already-stretched hospitals, health plans and other impacted entities from doing another big regulatory lift right now, maybe that makes sense -- even if interoperable health care records would be helpful during this crisis. As messy as the HIPAA Privacy Rule journey was, it reflected an important public debate to determine who can and who can’t use and disclose private health information. Now we have a global pandemic slowing down or changing everything, and it is not what anyone wants, but everyone is doing what they can. Turns out, health care is hard, and rulemaking about health care may be even harder. But we will figure this out. Sometimes big changes take time.