Search
  • Julie Barnes

April 9, 2020

Maverick’s Update

Only What Matters on Health Information Policy

Maverick Health Policy is enjoying writing this newsletter outdoors in the spring sunshine, where we will continue to report on health information policy news that is relevant to the COVID-19 crisis. And let’s call it C19 from now on.


  1. The HHS Office for Civil Rights (OCR) announced, effective immediately, that it will not impose penalties for HIPAA privacy rule violations against providers or their business associates for public health-related reasons during the pandemic. Indeed, OCR has a new webpage with its C19 related materials.

  2. Steve Posnack of the HHS Office of the National Coordinator for Health Information (ONC) is dusting off a community bulletin board for health IT professionals (Maverick’s description, not Steve’s) he started 4 years ago because it may help develop tools to combat C19. At least 84 projects have been posted to the “Interoperability Proving Ground (IPG)” platform, including PatientLink’s C19 symptom tracker and b.well’s C-19 Connected Health platform that aims to help triage patients, connect them to virtual care and make sure their caregivers are connected to what’s happening.

  3. On April 15th at 2 pm ET, you can find out more about ONC’s Leading Edge Acceleration Projects (LEAP) funding opportunity at an informational session. Boston Children’s Hospital and MedStar won the nearly $2M LEAP award in 2018.

  4. A new study explores how 10 health systems approached the implementation and use of patient-facing APIs to improve patient access to their electronic health information.

One Thoughtful Paragraph


We are waiting for ONC and CMS to say whether they are going to “pause enforcement” of the final interoperability rules due to C19 (as Politico Morning eHealth reported on April 8th). It is unclear what “pausing enforcement” means if it is not an actual compliance deadline delay, but we remember when the HIPAA privacy rule struggled to get off the ground. In 2013, AHIMA published a timeline of what happened back then (this is an abridged version):


HIPAA Timeline - Tracking Important Dates

August 21, 1996

HIPAA Passed by Congress

2000-HIPAA Privacy Rule Finalized by HHS

Becomes first federal healthcare information privacy law

2001-HIPAA Stalls

Bush Administration reopens HIPAA Privacy Rule Comment Period

2002- Bush Administration Announces Support of Modified HIPAA

Exceptions for “treatment, payment, and healthcare operations: added

April 14, 2003

HIPAA Privacy Rule Compliance Deadline


2008 - Lack of HIPAA Enforcement

More than 33,000 HIPAA complaints filed with OCR to date, only 8,000 investigated with no fines issued

February 17, 2009

ARRA’s HITECH Act Signed into Law

HIPAA revised to strengthen enforcement penalties, require breach notifications, and expand patient rights

2009-OCR Ratchets up HIPAA Enforcement

Some entities fined millions of dollars for privacy breaches


January 25, 2013

HITECH’s HIPAA Modification Final Rule Released

In no way is Maverick Health Policy implying that CMS or ONC will similarly struggle to implement the interoperability rules. In fact, both agencies can be expected to follow-through with all due speed on the long-term efforts to create and incentivize a simplified and modern flow of health information. Maverick is simply noticing that despite a prolonged and difficult beginning to embed the HIPAA privacy rule in our collective everyday health care activities, it happened. If, during this unprecedented crisis, ONC and CMS are considering how best to relieve already-stretched hospitals, health plans and other impacted entities from doing another big regulatory lift right now, maybe that makes sense -- even if interoperable health care records would be helpful during this crisis. As messy as the HIPAA Privacy Rule journey was, it reflected an important public debate to determine who can and who can’t use and disclose private health information. Now we have a global pandemic slowing down or changing everything, and it is not what anyone wants, but everyone is doing what they can. Turns out, health care is hard, and rulemaking about health care may be even harder. But we will figure this out. Sometimes big changes take time.

17 views

Julie Barnes, J.D. 

Phone: (703) 304-1756 

Email: julie.barnes@maverickhealthpolicy.com

P.O. Box 7117 2200 N. George Mason Drive, Arlington, VA 22207

Internship Opportunities

In-White-66px-TM.png