On June 29, 2022, the U.S. Department of Health & Human Services’ Office for Civil Rights (“OCR”) issued two pieces of guidance clarifying the applicability of the Health Insurance Portability and Accountability Act (“HIPAA”) related to privacy of information connected to an individual’s reproductive health. 

Through this guidance, HIPAA addresses both protected health information (“PHI”), which is subject to HIPAA’s rules, as well as general, personal information that is not directly protected by HIPAA.

Continue Reading New Guidance by OCR addresses HIPAA and Disclosures of Information relating to Reproductive Health

Over the last decade, members of the medical and public health communities around the world have widely studied and acknowledged the impact of social determinants of health (SDOH)—the conditions in the environments where people live, learn, work, play, and age—on a wide range of health, functioning, and quality-of-life-risks and outcomes.[1]  In the past year

This post was also written by Marquan Robertson, a Reed Smith summer associate. 

In 2019, the Department of Health and Human Services Office of Civil Rights (OCR) announced its Right of Access Initiative. The Right of Access Initiative realizes OCR’s commitment to ensuring the aggressive enforcement of patients’ rights to receive copies of their medical

The U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR), the agency that enforces the Health Insurance Portability and Accountability Act of 1996 (HIPAA), is the latest federal agency to jump on the HHS rulemaking bandwagon issuing a Notice of Proposed Rulemaking (NPRM) on December 10, 2020, that proposes pivotal changes

Even amidst the chaos of a global pandemic, this year multiple U.S. Department of Health and Human Services (HHS) agencies have dialed in on promoting and enforcing patients’ rights to access their health information.

In just the past month, HHS’ Office for Civil Rights (OCR), the agency that enforces the Health Insurance Portability and Accountability Act of 1996 (HIPAA), settled five costly investigations with HIPAA-regulated parties for potential violations of the HIPAA right of access provision.  Under HIPAA, individuals have a legal, enforceable right to view and obtain copies, upon request, of the information in their medical and other health records maintained by a HIPAA covered entity, typically a health care provider or health plan, with limited exception.  Individuals generally have a right to access this information for as long as the information is maintained by a covered entity, or by a business associate on behalf of a covered entity, regardless of the date the information was created, whether the information is maintained in paper or electronic systems onsite, remotely, or is archived, or where the information originated (e.g., whether the covered entity, another provider, or the patient).
Continue Reading Patient access to health information at the forefront of government initiatives and scrutiny

After nearly a full year of public comment consideration, last week, the U.S. Department of Health and Human Services (HHS) Substance Abuse and Mental Health Services Administration (SAMHSA) announced and published a Final Rule and Fact Sheet addressing 42 C.F.R. Part 2 (Part 2). Generally speaking, Part 2 affords privacy protections to patient records pertaining

As technology has advanced over the years, there has been a corresponding push for virtual visits with health care providers.  In fact, many state boards of medicine and other regulatory agencies have sought to amend regulations and guidances to make telehealth a reality for patients across the U.S.  However, despite the technical allowance for telehealth,

As discussed in our client alert, recent legal developments have greatly expanded funding for and access to telehealth services during the COVID-19 crisis.

Among the changes instituted by HHS are expanded Medicare coverage and payment for services, reduced or waived cost-sharing obligations for physicians, and loosening of the HIPAA enforcement policies for covered entities

Shortly after President Trump declared a national emergency related to COVID-19, CMS issued blanket waivers under section 1135 of the Social Security Act that are intended to ensure there are sufficient health care items and services available to meet the increased need, as well as reduce related administrative burdens on health care providers.

Our comprehensive

The Department of Health and Human Services (HHS) has modified HIPAA retail pharmacy transaction requirements to differentiate between partial fill and full refills of opioids and other Schedule II drug prescriptions.  Specifically, HHS has finalized the requirements for use of the National Council for Prescription Drug Programs (NCPDP) Telecommunication Standard Implementation Guide, Version D, Release

The Department of Health and Human Services (HHS) has adopted its proposal to rescind the standard unique health plan identifier (HPID) and the “other entity identifier” (OEID), along with related implementation specifications and requirements for their use.  HHS adopted the HPID and OEID in a September 5, 2012 final rule in order to improve

The U.S. Department of Health and Human Services filed a Notice of Enforcement Decision on Friday, April 26, 2019, announcing a new system of annual penalty limits for HIPAA violations based on an entity’s level of culpability. The agency revised its previous interpretation of the Health Information Technology for Economic and Clinical Health Act (HITECH

The Department of Health and Human Services (HHS) has issued a proposed rule that would modify the current HIPAA transaction standard for retail pharmacy transactions (the August 2007 revision of NCPDP telecommunications standard D.0) with respect to claims and similar transactions for Schedule II drugs.  HHS states that the change would enable covered entities to

The Department of Health and Human Services (HHS) is proposing to rescind the standard unique health plan identifier (HPID) and the other entity identifier (OEID), along with related implementation specifications and requirements for their use.

HHS adopted the HPID and OEID in a September 5, 2012 final rule, but HHS announced a

The Office for Civil Rights (OCR) is requesting public input on reforms to Health Insurance Portability and Accountability Act (HIPAA) privacy and security rules to promote care coordination and the health system’s transformation to value-based health care while protecting the privacy and security of individuals’ protected health information (PHI).  Specifically, in a request for information

The Trump Administration has formally withdrawn a number of pending Department of Health and Human Services (HHS) proposals that never reached the final rule stage. This includes:  a controversial Part Medicare B drug payment innovation model; a proposal to protect same sex marriages in certain Medicare and Medicaid facilities (predating a related Supreme Court decision); a proposal to impose more stringent Medicare requirements related to the provision of orthotics and prosthetics; and a proposed rule regarding certification of compliance for health plans.  Each of the rules is withdrawn as of October 4, 2017.  Specifically:
Continue Reading Trump Administration Shelves Additional Obama Medicare/Health Plan Proposals

This month the HHS Office for Civil Rights (OCR) has launched an initiative “to more widely investigate the root causes” of HIPAA breaches affecting fewer than 500 individuals, according to an August 18, 2016 OCR email announcement. While Regional Offices will retain discretion to prioritize investigation of smaller breaches, each office is directed to “increase

Immediately following Sunday’s tragic shooting at a nightclub in Orlando, friends and family frantically gathered at Orlando Regional Medical Center, attempting to get information about their loved ones.  However, hospital officials hesitated to provide specific updates.  Why?  Because the Health Insurance Portability and Accountability Act (HIPAA) and implementing regulations restrict the patient-identifiable health information that “covered entities,” like Orlando Regional Medical Center, are permitted to disclose without proper patient authorization or consent.

Shortly following the massacre, Orlando local news outlets reported that after Orlando Regional’s CEO expressed concern regarding families requesting detailed patient health information at the hospital’s emergency room, Orlando Mayor Buddy Dyer contacted the White House and requested a waiver of the HIPAA regulations.  While the HIPAA Privacy Rule is not automatically suspended during a national or public health emergency, the Secretary of the Department of Health and Human Services (HHS) may waive certain provisions of HIPAA under the Project Bioshield Act of 2004 (PL 108-276) and section 1135(b)(7) of the Social Security Act.  In order to take advantage of the waiver, the President must declare an emergency or disaster and the Secretary of HHS must declare a public health emergency.

Continue Reading Reexamining HIPAA’s Applicability During Emergencies After the Tragedy in Orlando

On January 6, 2016, HHS published a final rule to modify the HIPAA Privacy Rule to expressly permit certain HIPAA covered entities to disclose to the National Instant Criminal Background Check System (NICS) the identities of individuals who are subject to a federal “mental health prohibitor” that disqualifies them from shipping, transporting, possessing, or receiving