OCR updates HIPAA FAQs following health tech initiative launch

PHI disclosures to value-based care arrangements

The newest FAQ asks: "Does the HIPAA Privacy Rule permit a covered health care provider to disclose protected health information to value-based care arrangements, such as accountable care organizations, for treatment purposes without the individual's authorization?"

Value-based care is a form of reimbursement that ties payment amounts to patient outcomes. Examples of value-based care models include accountable care organizations, bundled payments and patient-centered medical homes.

In response, OCR clarified that the HIPAA Privacy Rule does permit a covered entity to disclose PHI without authorization from a patient to participants in value-based care arrangements for treatment purposes.

OCR reasoned that the Privacy Rule defines "treatment" as "the provision, coordination, or management of health care and related services by one or more health care providers, including the coordination or management of health care by a health care provider with a third party; consultation between health care providers relating to a patient; or the referral of a patient for health care from one health care provider to another."

"Thus, the definition incorporates the necessary interaction of more than one entity," OCR stated, meaning that a covered entity could disclose PHI, "regardless of to whom the disclosure is made," as long as that disclosure is made for treatment purposes.

OCR updates guidance on patient access to health records

The second FAQ included in OCR's announcement is a minor update to an existing question, rather than a new inquiry.

"What personal health information do individuals have a right under HIPAA to access from their health care providers and health plans?" the FAQ asks.

Patients have a right to request a copy of their health information from covered entities under HIPAA. The updated FAQ expanded the types of information that patients can request to include consent forms for treatment.

Individuals have a right to request information maintained by a covered entity or business associate, including "medical records, billing and payment records, insurance information, clinical laboratory test reports, X-rays, wellness and disease management program information, consent forms for treatment, and notes," OCR clarified.

As federal initiatives strive to make the health tech ecosystem more interconnected, covered entities must navigate the HIPAA compliance complexities that come with these efforts. Guidance from OCR on how to proceed will play a crucial role in ensuring that covered entities and their growing list of business associates remain compliant during industry-wide health tech shifts.

Jill McKeon has covered healthcare cybersecurity and privacy news since 2021.