CHIME and healthcare providers raise concerns over proposed HIPAA Privacy Rule changes affecting patient data authorization verification
A coalition of 17 health systems, hospitals, and clinics led by the College of Healthcare Information Management Executives (CHIME) expressed significant concerns to HHS Secretary Robert F. Kennedy, Jr. about proposed updates to the HIPAA Privacy Rule aimed at supporting coordinated care and individual engagement. The proposed changes, originally part of an NPRM issued in the Trump administration and delayed through subsequent administrations, intend to reduce barriers to accessing patient data but may limit healthcare providers' ability to confirm if third-party applications are properly authorized to receive protected health information (PHI). The coalition argues that prohibiting providers from verifying authorization could increase privacy risks and exposure to regulatory penalties. They emphasize that identity credentialing alone (such as IAL2) does not guarantee correct patient matching or authorization scope. The coalition requests that OCR preserve reasonable provider discretion to verify authorizations and provide clear guidance on verification practices. They also call for additional notice and comment if OCR plans significant deviations from the NPRM and enforcement protections for providers acting in good faith.
Linha do tempo
-
CHIME and healthcare providers raise concerns over proposed HIPAA Privacy Rule changes affecting patient data authorization verification
ler a análise desta fonte ocultar
A coalition of 17 health systems, hospitals, and clinics led by the College of Healthcare Information Management Executives (CHIME) expressed significant concerns to HHS Secretary Robert F. Kennedy, Jr. about proposed updates to the HIPAA Privacy Rule aimed at supporting coordinated care and individual engagement. The proposed changes, originally part of an NPRM issued in the Trump administration and delayed through subsequent administrations, intend to reduce barriers to accessing patient data but may limit healthcare providers' ability to confirm if third-party applications are properly authorized to receive protected health information (PHI). The coalition argues that prohibiting providers from verifying authorization could increase privacy risks and exposure to regulatory penalties. They emphasize that identity credentialing alone (such as IAL2) does not guarantee correct patient matching or authorization scope. The coalition requests that OCR preserve reasonable provider discretion to verify authorizations and provide clear guidance on verification practices. They also call for additional notice and comment if OCR plans significant deviations from the NPRM and enforcement protections for providers acting in good faith.