Final HIPAA Rule Enhances Patient Privacy Protection

The US Department of Health and Human Services has issued a final omnibus HIPAA rule based on statutory changes under the HITECH Act and the Genetic Information Nondiscrimination Act of 2008 (GINA). The rule greatly enhances a patient’s privacy protections, provides individuals new rights to their health information, and strengthens the government’s ability to enforce the law.

Patients can ask for a copy of their electronic medical record in an electronic form. When individuals pay by cash they can instruct their provider not to share information about their treatment with their health plan.

The final omnibus rule sets new limits on how information is used and disclosed for marketing and fundraising purposes and prohibits the sale of an individuals’ health information without their permission. The final rule also reduces burden by streamlining individuals’ ability to authorize the use of their health information for research purposes.

The rule makes it easier for parents and others to give permission to share proof of a child’s immunization with a school and gives covered entities and business associates up to one year after the 180-day compliance date to modify contracts to comply with the rule.