Update on Federal HIT Legislation

1. Update on Federal HIT Legislation Kirsten Beronio Mental Health America

2. Hopes for HIT • Improved care coordination • Ability to assess interventions in real-world settings • Increased dissemination of best practices • Increased consumer engagement and empowerment

3. Primary Concerns • Existing and increased risks to privacy with increased use of HIT • Inadequate consumer access to own medical records • Lack of enforcement of rights and responsibilities

4. Protecting Privacy • New entities (PHR vendors, HIEs, RHIOs) not covered by federal privacy and security rules • Requiring consent not adequate and maybe harmful • Marketing loopholes • Risks of inappropriate disclosure due to health care operations being very broadly defined

5. Consumer Access • Right to access not well implemented • Systems should enable consumer interface • Concerns about proposals to segregate sensitive information

6. Inadequate Enforcement • Many complaints and numerous violations • HHS opted to encourage voluntary compliance • Not a single civil penalty imposed

7. HITECH Act • Establishes infrastructure to set federal standards for nationwide, interoperable HIT system • Provides incentives for implementation by providers • Sets up new privacy protections, consumer access provisions, enhanced enforcement mechanisms

8. Establishing Federal Standards HITECH Act: • Codifies Office of Nat Coordinator for HIT • Establishes HIT Policy Committee • To set priorities for areas where standards are needed • To consider technologies to protect privacy among other issues • Establishes HIT Standards Committee • To develop standards, implementation specifications, certification criteria • Federal agencies required to comply with standards, but voluntary for private sector

9. Incentives for Implementation • HHS to allocate $2 billion for following uses: • Establish an HIT extension program to help providers with implementation • Create HIT research center to provide technical assistance and develop best practices and support regional centers to provide tech assist • Provide grants to states (or qualified state-designated entities) to promote HIT, including in medically underserved communities • Competitive grants to states and Indian tribes for loan programs for providers to purchase HIT, train personnel • Demos to integrate HIT into clinical education

10. Incentives for Implementation • Medicare incentive payments for physicians and hospitals for adoption and “meaningful use” of certified HIT • Medicaid incentive payments for certain providers: • Physicians, dentists, nurse midwives, nurse practitioners, hospitals, rural health clinics, FQHCs

11. Privacy Protections • Applies HIPAA privacy and security requirements to personal health record vendors and health info exchange org.s • Requires notification of breach w/in 60 days • Calls for privacy officer in each regional office and nat pub ed campaign on privacy rights • Directs narrowing health care operations defn • Prohibits sale of personal health info and further limits use for marketing

12. Privacy Protections • Clarifies right to restrict disclosures of personal health info for payment or health care operations if pay out-of-pocket • Preservation of the therapist-patient privilege

13. Consumer Access • Establishes a right to an accounting of disclosures over previous 3 yrs • Establishes a right to an electronic copy if maintained as electronic record

14. Enhanced Enforcement • Increased penalties for HIPAA violations • HHS required to investigate complaints (no longer discretionary) • Fines collected go to Office of Civil Rights • GAO to develop methodology for allocating percentage to consumers harmed • State AGs authorized to prosecute HIPAA privacy and security violations

15. Psychotherapy Note Definition • Secretary directed to study whether to expand defn to include testing data • Psychotherapy notes have special status: consumer authorization required for disclosure except for treatment • Consumers do not have access