It has been reported that the final HITECH rules are due out this month. The Office of Civil Rights (OCR) supposedly is “making every effort” to publish the final rules, according to an interview with Susan McAndrew, Deputy Director of Health Information Privacy for the OCR, by the internet journal Healthcare Info Security.
The federal Department of Health and Human Services ("HHS") issued its unified agenda in January, 2012, (at Regulations.gov), which listed March 2012 as the deadline for the HITECH final rules. I actually called the listed agency contact to see if I could get any information about a true release date. The contact graciously called me back and could not give me any specific information, except that 1) the upcoming rules will have suggested language for the Business Associate Agreement and 2) confirmed that the Office of Management and Budget, which needs to review and approve the final rules, has not seen the final HITECH rules yet. And she told me to join the OCR list serve for the latest updates.
Additional federal regulator action in process includes a) the final "Accounting of Disclosures" rule, on the regulatory agenda for June 2012; upcoming changes to the HIPAA authorization rule with regard to clinical research; and a retrospective review of the HIPAA requirements for distribution of Notices of Privacy Practices. The description in the chart attached to the announcement focuses on reducing costs to insurance plans. http://www.reginfo.gov/public/do/eAgendaViewRule?pubId=201110&RIN=0945-AA03
So the final rules may not be out in March, but the final rules are coming, and they will be here soon. Don't wait to start getting your HIPAA and HITECH house in order. The OCR audits of basic HIPAA privacy and security requirements are underway now. Assessing your risks and putting policies and procedures in place will make the next steps easier in the long run.
No comments:
Post a Comment