Pabrai Blog On Patient Access / Disclosure Restrictions (HITECH NPRM)

The HITECH NPRM published as a Federal Register on July 14, 2010 (45 CFR Parts 160 and 164) includes information about changes in the area of Patient Access to Electronic Health Record (EHR) and Patient Right to Restrict Disclosures. In the area of Patient Right to Restrict Disclosures – it requires the covered entity to agree to a restriction on disclosure to a health plan if:

1. The disclosure is for the purposes of carrying out payment or healthcare operations and is not otherwise required by law; and
2. The Protected Health Information (PHI) pertains solely to a health care item or service for which the individual, or person on behalf of the individual other than the health plan, has paid the covered entity in full.

This NPRM also clarifies that if a restriction is placed on a disclosure to a health plan, the covered entity is also prohibited from making such a disclosure to a business associate of the health plan.

The HITECH Act gives individuals the right to receive an electronic copy of their PHI, if it is maintained in an EHR, for which the provider may charge a fee.

Covered entities should review their policy and processes related to Patient Access and Disclosure Restrictions and consider the requirements in the HITECH Act and forthcoming changes as a result of the NPRM.