The recent stimulus bill (the American Recovery and Reinvestment Act of 2009 or “ARRA”) contained a section which are referred to as the HITECH (Health Information Technology for Economic and Clinical Health) provisions which provide for certain changes in EMR adoption and in the HIPAA privacy and security standards. I have attached a summary decently offered by the California Health and Human Services Agency of the HITECH provisions of ARRA.

Although I would not call any government program uninteresting, the portions of greatest interest are on page 4 of the attached summary. After these amendments, HIPAA now applies directly to business associates, requires notification of security breaches to state medical agencies and to the Federal Health and Human Services Agency and extends civil and criminal penalties to business associates that violate privacy provisions.

One new provision requires that covered entities (health care providers) must comply with individual requests for restrictions of disclosure of information when an individual is paid out-of-pocket in full for services. This means that patients who choose to pay for their services themselves, may require you not to report the service or medication to their insurers. This is true even if your contracts with your third-party payors or insurance companies require you to disclose such information. This new federal law preempts such contractual provisions or requirements of insurance companies and should be immediately implemented.

One other interesting section requires that covered entities (healthcare providers) provide an accounting of all disclosures to third parties, permitted or unpermitted, to an individual making a request. This means that you will now need to maintain records of all disclosures on the individual patient level. Put another way, in order to respond to such a individual demand for an accounting of disclosures, how will you know what disclosures you’ve made?

Also, it is now clear that wrongful or intentional violations of HIPAA, including disclosures, may result incriminal penalties. This was not clear under the prior HIPAA statute but is abundantly clear now.

Finally, there is a provision for providing incentives to eligible professionals of certain costs to encourage electronic health record (EHR) technology. The payments to encourage or assist in EHR adoption may not exceed 85% of the “net average allowable costs”. Obviously there will be regulations passed, and it will be probably at least 2010 before any health information technology grants are available.

If you have any questions about the HITECH provisions ARRA, we would be glad to provide answers. This is an excellent time to remind you staff and business associates of their obligations to you and to your patients regarding privacy.

Paul J. Wallace