Exercising Patient Rights under theHITECH Act

摘要

The Health Information Technology for Economic andClinical Health (HITECH) Act was enacted as part of theAmerican Recovery and Reinvestment Act of 2009 andsigned into law on Feb 17, 2009.1 Section 13405(a) of theHITECH Act codified in §45 C.F.R 164.522(a)(1) sets forthcertain circumstances in which a covered entity must complywith an individual’s request for restriction of disclosure of hisor her protected health information.2 HITECH modified theHealth Insurance Portability and Accountability Act of 1996(HIPAA), Public Law 104-191, by providing patients with anopportunity to limit sharing of protected health informationthat would normally occur automatically between coveredentities (a physician’s office and insurance company)pursuant to the “payment” and “operations” permissible useand disclosure categories.3Specifically, section 13405(a) of the HITECH Act requiresthat when an individual requests a restriction on disclosurepursuant to § 164.522, the covered entity must agree to therequested restriction “unless the disclosure is otherwiserequired by law,” if: (1) the request for restriction is ondisclosures of protected health information (2) to a healthplan (3) for the purpose of carrying out payment or healthcare operations and (4) if the restriction applies to protectedhealth information that pertains solely to a health care itemor service for which the health care provider has been paidout of pocket in full.4Patients may now invoke their right to pay for a service outof pocket. By paying for the service without using their healthplan, the health plan can no longer rely on the “payment” or“operations” HIPAA information sharing exceptions to obtainaccess to the patient’s medical record. When a patient makesthis demand, it must be for privacy purposes, and it needs tobe of the patient’s own volition. If the check does not clear,or the credit card is declined, then the privacy request neednot be honored since the service was no longer paid out ofpocket in full. The demand forces the covered entity to offerthe patient a cash price. If the patient is a Medicare patient,then this cash price must be the exact same price that wouldhave been charged to Medicare, but for any other patientthe cash price that is offered need not reflect the fair marketvalue of the service provided.