New Privacy Safeguards for Health Records Announced
The new HHS rules expand consumer protections when third parties handle individually identifiable health information.
HHS announced new rules and a new website to strengthen the privacy of health records. Efforts by the Office of the National Coordinator for Health Information Technology and the HHS Office for Civil Rights, working with public and private partners, will ensure Americans' health information is protected, said HHS Secretary Kathleen Sebelius.
“To improve the health of individuals and communities, health information must be available to those making critical decisions, including individuals and their caregivers,” she said. “While health information technology will help America move its health care system forward, the privacy and security of personal health data is at the core of all our work.”
Added to current rules are provisions about individual rights and protections when third parties handle individually identifiable health information. This expands enforcement of the Health Insurance Portability and Accountability Act of 1996 (HIPAA) by:
- expanding individuals' rights to access their information and to restrict certain types of disclosures of protected health information to health plans
- requiring business associates of HIPAA-covered entities to be under most of the same rules as the covered entities
- setting new limitations on the use and disclosure of protected health information for marketing and fundraising
- prohibiting the sale of protected health information without patient authorization.
"The benefits of health IT can only be fully realized if patients and providers are confident that electronic health information is kept private and secure at all times," said Georgina Verdugo, director of the Office for Civil Rights. "This proposed rule strengthens the privacy and security of health informationand is an integral piece of the administration's efforts to broaden the use of health information technology in health care today."
The new privacy website, http://www.hhs.gov/healthprivacy/index.html, has information about existing HHS privacy efforts and policies.