March 21, 2002 - HHS to Propose Changes in Health Privacy Regs

Secretary of Health and Human Services Tommy Thompson announced today that he will propose changes next week in federal privacy regulations that implement the Health Insurance Portability and Accountability Act (HIPAA). The new regs, due to appear in the Federal Register March 27, will modify standards that were published in the Federal Register in December 2000. The regs are scheduled to go into effect for most covered entities by April 14, 2003.

Here are some of the changes HHS is proposing:

• Parental notification. The proposal clarifies that state law governs disclosure of the medical records of minors to their parents. Where state law is silent or unclear, the revised regulations would permit a health care provider to use discretion about whether to allow a parent access to such records.

• "Minimum necessary" and oral communication. The revised regs will maintain a provision that requires covered entities to limit the use and disclosure of protected health information to the minimum necessary to protect individual privacy, but would make clear that a doctor could discuss a patient’s treatment with other doctors and professionals involved in a patient’s care without fear of violating the rule if they are overheard.

• Consent and notice. The proposed regs would remove a requirement that patients must give specific consent for treatment, payment, and health care operations purposes. Patients would be asked to acknowledge the privacy notice, but doctors and other providers could treat them if they did not.

HHS notes that the proposed rules will include a number of technical corrections to the original regulations and "additional clarifications." At the moment, information about the proposed rule is available at www.hhs.gov/ocr/hipaa. This website will provide a link to the revised regulations when they are published in the Federal Register next week.