HIPAA Privacy Rule: Proposed changes could impact practitioners

On May 6, 2021, APA filed comments addressing the potential strain on psychology practices (PDF, 337KB) created by proposed changes to the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule.

At the end of 2020, the Department of Health and Human Services (HHS) announced proposed Privacy Rule changes intended to improve patient access to their records. Other proposals concerned changes around the Notice of Privacy Practices and facilitating care coordination and case management (CC/CM) activities between various entities.

APA’s comments focused on patient privacy concerns, as well as the unique burdens that the changes would pose for psychology practices, particularly smaller ones.

After considering the comments received from APA and other stakeholders, HHS will develop final regulations to implement the proposed changes. Based on the timeline of prior HIPAA changes, it is expected that the final rule would likely take effect some time in 2021 or 2022.

In comments, APA noted that psychologists recently navigated the sudden pivot to telehealth spurred by the pandemic, followed by a return to in-person services, and the implementation of the Information Blocking Rule. Accordingly, APA urged an exception to certain burdensome changes for psychology practices, particularly small practices (APA proposed using the small employer definition of 50 or fewer employees used in the federal parity law MHPAEA).

In terms of patient access, APA’s main concern was the proposed requirement that patients be allowed immediate access to inspect their records (that are readily available at the point of care) while they are in the office for an appointment. On this proposal, the comments noted the many burdens—some unique to psychology—that this would impose on psychology practices. For example, practices would need to have a staff person sit with the patient while they reviewed their records, and providers would need to redact or separate records due to copyrighted test questions, as well as multiple patient and minor proxy issues.

APA also requested that HHS exempt small psychology practices from the agency’s proposal to shorten the time that providers have to respond to patient access requests from 30 to 15 calendar days.

The most significant privacy concern was a proposal to allow an exception to the minimum necessary standard (a requirement that HIPAA covered entities limit disclosures to the minimum information necessary to accomplish the purpose of the disclosure) for health plans conducting CC/CM activities. APA argued that there was no clear justification given for the exception in the proposed rule. It further explained the major invasion of patient privacy by health plans that this could create. For example, the proposed exception could allow an insurance plan to ask for years of patient records to coordinate care for a new mental health issue unrelated to the prior course of care.

Other proposed changes covered in APA’s comments included: changes to the content and manner of disseminating the HIPAA notice of privacy practices, and easier sharing of patient information for CC/CM activities with social services and community-based organizations, and home and community-based service providers.