September 20, 2013

Days Before Enforcement Date OCR Issues New Guidance

Holland & Knight Privacy Blog
Shannon Britton Hartsfield

Just days before the September 23, 2013 enforcement date for the new HITECH Act Omnibus rules, the Department of Health and Human Services' Office for Civil Rights has published several new guidance tools and documents.  On September 13, HHS published a number of model Notices of Privacy Practices (NPPs), in various formats, for health plans and providers.  The notices are in plain language, and can be tailored to a particular entity.  HHS recommends that the NPPs be published in color and booklet form, but the models come in a variety of formats.  HHS also published summary documents that can be used for layered notices.
On September 19, the health industry received new guidance regarding decedents, student immunizations and refill reminders, as well as an announcement that there would be an enforcement delay for CLIA labs relating to the required changes to a lab's NPP.  The guidance on refill reminders indicates that a business associate can receive payments to assist a covered entity in carrying out a refill reminder or medication adherence program, as long as the business associate is paid no more than fair market value of the business associate's services. The payments may be made directly to the business associate by the third party whose product is being described.  Communications for which a covered entity receives remuneration that do not fall within the exception require a patient's written authorization.

Here are links to the new guidance materials

Related Insights