November 25, 2002
The Honorable Tommy G. Thompson
Secretary
U.S. Department of Health and Human Services
200 Independence Avenue, SW
Washington, DC 20201
Dear Secretary Thompson:
As part of its responsibilities under the Health Insurance Portability and Accountability Act of 1996 (HIPAA), the National Committee on Vital and Health Statistics (NCVHS) monitors the implementation of the Administrative Simplification provisions of HIPAA, including the Standards for Privacy of Individually Identifiable Health Information (Privacy Rule).
On September 27, 2002, we wrote to you with preliminary findings from the hearing in Boston on September 10 and 11, 2002, held by the Subcommittee on Privacy and Confidentiality of the NCVHS. This was the first of three hearings scheduled to learn about the implementation activities of covered entities. The Subcommittee has completed its other two hearings, in Baltimore on October 29 and 30, 2002, and in Salt Lake City on November 6 and 7, 2002. In all, the Subcommittee heard testimony from over 70 invited witnesses and other individuals during public testimony. The witnesses represented a broad array of health care providers, health plans, professional and trade associations, state agencies, public health authorities, health information associations, health privacy advocates, and experts on health education and communication.
In general, the witnesses at the Baltimore and Salt Lake City hearings reinforced the views of the Boston witnesses we noted in our prior letter. The NCVHS found widespread support for the goals of HIPAA and the Privacy Rule. The August 2002 amendments were viewed positively as reducing some of the unnecessary burdens associated with the Privacy Rule. Witnesses praised the clarity and utility of the Guidance and Frequently Asked Questions (FAQs) issued by the Office for Civil Rights (OCR). Publication of an integrated text of the Privacy Rule was mentioned by some witnesses as being extremely valuable. Other witnesses lauded the OCR website.
Despite these positive comments, the tenor of the testimony at the two later hearings was virtually identical to that which we described in our letter after the Boston hearing. There is an extremely high level of confusion, misunderstanding, frustration, anxiety, fear, and anger as the April 14, 2003 compliance date nears. The OCR is widely viewed as not providing adequate guidance and technical assistance. In particular, numerous witnesses lamented the lack of model notices of privacy practices, acknowledgments, authorizations, and other forms. Many witnesses also complained that general guidance was of limited value because of their special industry or professional circumstances. Witnesses conveyed a great sense of frustration that they could not obtain any clarifications from OCR or answers to the questions they submitted via OCR's website.
A large number of witnesses said that issues of preemption made compliance much more difficult, costly, and complicated. To determine whether state privacy laws or the HIPAA Privacy Rule applies to the multitude of health privacy issues, covered entities must obtain a comprehensive Apreemption analysis, detailing whether state or federal law applies. These analyses are often lengthy documents, expensive to research, highly technical, and not binding on any enforcement agency or the courts. Large, multi-state covered entities need to have such an analysis for every jurisdiction in which they do business. There is no national coordination on the issue of preemption, and state and local efforts vary widely in their degree of completion and, for those already completed, in the cost to obtain copies. A related issue involves conflicts and overlaps between HIPAA and other federal laws dealing with privacy, including Gramm-Leach-Bliley, the Family Educational Rights and Privacy Act (FERPA), the Privacy Act, and other statutes and regulations.
The lack of clarity on compliance responsibilities, the unavailability of free and authoritative model forms, and the absence of widely available training materials have left many covered entities lacking the wherewithal to come into compliance. Several witnesses described the aggressive efforts of numerous vendors and consultants to fill this vacuum by offering implementation assistance. Covered entities testified that they have no way of judging the accuracy of the information they are being given or the necessity of the expensive measures some vendors and consultants have urged them to adopt to become AHIPAA compliant, such as redesigning their facilities or replacing their computer systems. Some witnesses said they would like a system of certifying vendors and consultants or some other way of assisting covered entities in determining when such services are needed.
Several witnesses estimated that well below half of all small providers had made any effort to comply with the Privacy Rule, and some have no intent to do so. One witness reported that some rural providers have given up on compliance and adopted the position that AI can=t do this; let them catch me. Even more troubling are the potential adverse effects on the health care system. Some witnesses said that some Medicaid and other Asafety net providers may drop out of the system of providing care to indigent patients because they cannot afford to absorb the costs of complying with the Privacy Rule, and there is no way to pass along the costs. One witness, an administrator of a large oncology group, said that the difficulty and expense of HIPAA compliance had caused her practice to abandon the use of electronic billing and to go back to paper claims to avoid being a covered entity.
Fears surrounding HIPAA also featured prominently in the testimony. Witnesses were very concerned about the possibility of overzealous enforcement by OCR as well as private lawsuits, both of which were viewed as costly to defend. Other witnesses reported that the fear of violating HIPAA already has resulted in negative health outcomes, including providers=refusing to share patient medical information that would be helpful in treating another patient and a decline in mandatory or permissive reporting of essential health data to public health agencies, tumor registries, and other entities.
Another important part of the compliance picture is the need for education and training. Millions of health care workers will need to be trained in the next few months, but there is a dire shortage of expertise, materials, and funding. Overwhelmingly, witnesses said that generic training will not work; to be successful it must be customized by industry, entity, and job description. In addition, consumers have received virtually no information about HIPAA, and it will be difficult for them to understand the basis or context for the myriad notifications, acknowledgments, authorizations, and other forms with which they will soon be presented. Public education is complicated by consumers' varying levels of education, cognition, and language proficiency.
Some of the most promising testimony received by the Subcommittee came from state and regional coalitions of covered entities and professional associations, which have often succeeded in advancing implementation for their members. Unfortunately, there is no federal interface or coordination with these groups, and the number of covered entities reached by them remains relatively low.
Complete versions of the testimony from the hearings have been posted on the NCVHS website. This letter contains some key findings drawn from the testimony. Our recommendations for implementing the Privacy Rule are detailed in the accompanying attachment. The NCVHS is aware that the Department, and OCR in particular, have limited resources to accomplish the extensive recommendations set forth in the attachment. Given these constraints, we encourage the Department to marshal all available resources to provide OCR the funds and staffing necessary to accomplish the massive technical assistance, outreach and education efforts needed in the upcoming months to ensure successful Privacy Rule compliance efforts.
The additional information derived from our last two hearings reinforces the view we expressed in our letter of September 27, 2002, that unless prompt, vigorous action is taken to ensure that implementation goes smoothly, the public acceptance and viability of the entire Privacy Rule will be threatened.
We appreciate the opportunity to offer these comments and recommendations.
Sincerely,
/s/
John R. Lumpkin, M.D., M.P.H.
Chair, National Committee on Vital and Health Statistics
cc: HHS Data Council Co-Chairs
Enclosure
1. Department-wide Efforts. Problems in coordinating agency efforts, already beginning to surface, are likely to intensify as all of the elements of Administrative Simplification come on-line. It is difficult for the public to understand the lines of responsibility at HHS, and a source of confusion and frustration is the inability to get integrated answers to HIPAA questions.
Technical Assistance
2. Covered Entity Teams. OCR should establish covered entity teams to assist the various industries and professions with their unique compliance issues.
3. "Defensive Practices" . There is considerable misunderstanding about the requirements of the Privacy Rule, and concern about possible HIPAA liability is causing some covered entities to restrict the uses and disclosures of essential protected health information when doing so is permitted under HIPAA. Such "defensive practices" may result in adverse outcomes with respect to treatment and data collection activities for research and public health.
4. Website. OCR should enhance its website.
5. FAQs. OCR should improve its FAQ response process.
6. Guidance on Privacy Rule's relationship to other laws. The issue of preemption is a great source of uncertainty and confusion among covered entities. Even without undertaking its own state law preemption analysis, there are steps that OCR can take to alleviate the burden with complying with this complex piece of the Privacy Rule.
7. Training. With millions of health care providers and other individuals to train, OCR needs to leverage its training efforts.
8. Compliance Assistance. A variety of measures should be adopted to assist covered entities in complying with the Privacy Rule.
Outreach
9. Statewide Coalition Building. Statewide coalitions of health information associations and other professional and trade organizations are among the most effective mechanisms for reaching covered entities. Support for existing programs will be much less expensive than creating new measures.
10. Communication Methods. Numerous media and formats should be utilized in outreach activities.
Consumers
11. Develop materials for distribution to consumers. Simplicity and widespread distribution should be the hallmarks of educating the public about the Privacy Rule.
12. Consumer Education Approach. While a massive public education program is needed, tailoring the message is necessary for successful communication.
13. Evaluation. Ongoing and systematic efforts are needed to evaluate the effectiveness of the Privacy Rule.
14. Communicate enforcement plans. There is great anxiety about overzealous enforcement of the Privacy Rule, and dissemination of information about enforcement could allay these fears. OCR needs to reassure providers that reasonable efforts to comply will not lead to enforcement actions.
15. No certification statement. The use of the phrase "HIPAA compliant" and similar ones has caused covered entities to rely on the unsubstantiated claims of vendors and consultants.
16. Accounting for Mandatory Disclosures. Extensive disclosure activities occur for mandatory reporting, which makes the accounting for mandatory disclosures burdensome for covered entities.
17. OCR should draft and make widely available model forms and templates, including state-specific, industry-specific, and profession-specific forms. Such forms should include model notices, model authorizations, and model acknowledgments of notices received. In addition, OCR should consider publishing standardized gap assessment guides, simple checklists, a HIPAA practice management handbook, and time-lines to assist covered entities.
18. OCR should provide guidance on the following topics.
A. Covered provider questions. Guidance is needed with regard to who is a health care provider (e.g., ambulance companies, fire rescue units) as well as what constitutes an electronic transmission. Common questions include whether faxing, telephoning, or e-mailing PHI for standard transactions makes a provider a covered entity. Similarly, are physicians who do all billing on paper, but who need to fax PHI to other providers for treatment purposes, covered entities? Are professional practices with fewer than 10 full-time employees exempt from HIPAA? In addition, OCR should provide guidance on the advantages of using electronic records rather than paper to inform providers who are considering not using electronic records in an effort to avoid being a covered entity.
B. State agency, "quasi" health plans/providers. Guidance is needed to help state "quasi" health care service and public health programs ascertain their covered entity status (e.g., agency responsible for care/custody of minors that also secures or pays for health care services; federally funded breast and cervical cancer early detection and screening programs; state laboratories that do not furnish testing directly to patients, do not bill and are not paid for testing). With regard to health plans, more guidance is needed about "high risk pools" established under state law as well as what programs would be considered excepted benefits under the Public Health Service Act. Guidance is also needed on whether a state agency is a "health care provider" if it funds health care providers to furnish medical or health services.
C. Health plan. Guidance is needed on the practice of health plans sending explanation of benefit (EOB) forms, which contain PHI, to subscribers rather than to individual patients. Guidance is also needed to explain what types of entities fall under the current "catch-all" provision of the health plan definition. For example, are "continuing care contracts" utilized by multi-level retirement communities health plans?
D. Group health plan sponsors, self-funded and fully-funded benefit providers. Guidance is needed to clarify how group health plans, including self-funded plans that utilize third party administrators (TPAs) to process claims, must comply with the Privacy Rule, as well as the specific HIPAA privacy responsibilities of health plan sponsors. Guidance is needed on when a benefits department is acting as an employer/plan sponsor (e.g., enrollment function) versus when it is acting on behalf of the group health plan (e.g., claims appeals function). Guidance would also be helpful regarding the HIPAA compliance obligations of an insurance issuer in its relationship with a small health plan during the additional transition year available to small health plans for compliance.
E. Employers. Guidance is needed on the applicability of the HIPAA Privacy Rule to a range of employer activities related to health matters, including on-site and off-site employer-sponsored health clinics, administration of flu shots, occupational health surveillance activities, fitness centers, wellness programs, and employee assistance programs.
F. Medicaid. Guidance is needed on whether Medicaid managed care organizations and Medicaid state agencies are acting separately as covered entities or are Medicaid managed care organizations business associates of Medicaid. If separate covered entities, is the beneficiary supposed to receive two notices of privacy practices, and must the individual contact each entity separately for access, amendment, and accounting?
G. Hybrids. Guidance is needed on what is a firewall. OCR should provide examples of effective firewalls.
H. Organized Health Care Arrangements (OHCAs). Clarification is needed to explain that OHCAs arise by operation of law and not through designation by covered entities. Guidance is needed regarding the HIPAA liability of hospitals and other institutional providers vis-à-vis physicians and other health care professionals who are part of an OHCA.
I. Business Associates. Clarification is needed on the definition of "business associate" and when contractors should enter into business associate agreements.
J. Training. OCR should provide guidance about what needs to be included in a covered entity training program, taking into account the need for training in different languages and varying levels of comprehension. Different versions of training will need to be developed to address all audiences. Guidance is also needed on whether the academic medical institution or the hospital where they are working is responsible for providing HIPAA training to residents and other trainees. Other questions needing clarification include whether health care workers who rotate at multiple sites of a covered entity need multiple training courses at multiple locations and when an institutional provider must train temporary employees and other non-standard employees (e.g., contractors, students, volunteers, temps).
K. Reasonable safeguards. Guidance is needed on what is "reasonable" for physical privacy around the customer service desk and computer in the offices of health care providers. What are reasonable and/or scalable physical safeguards for "home health" medical records? What security is appropriate for use of laptops and PDAs? OCR should consider drafting guidelines for communications between caregivers and patients over the Internet (e.g., expectations for tracking/archiving) and via fax (e.g., what are the expectations for testing/verifying fax numbers).
L. Notice. Clarification is needed on what constitutes a "good faith effort" to obtain acknowledgment that an individual has received notice of privacy practices? How many times must a provider make a good faith effort? Do providers need to track their efforts to obtain an acknowledgment? How does a practitioner provide notice when the first contact is not in the provider's office (e.g., hospital or nursing home) and the institution is not drafting notices for an OHCA? What if the individual refuses to sign the acknowledgment? What criteria should be used to ascertain whether a phone contact is a first point of entry triggering the notice requirement or whether it is merely clerical or administrative?
M. Right to deny request for restriction and confidential communications. Guidance is needed regarding what criteria may be used to deny requests for restrictions or confidential communications. Many covered entities indicated an intention not to accept any requests for restrictions. Is there any way that OCR can interpret this requirement to make it easier to comply with requests and thereby encourage providers to do so?
N. Accounting for disclosures. Guidance is needed on interpreting of trackable disclosures, and models should be provided for managing this information. Do covered entities need to account for public health disclosures that are required under state law (e.g., infectious disease reporting, births, deaths, gunshot wounds) or are such disclosures "health care operations" and consequently outside the accounting requirement? Other questions involve application of the "50 or more" rule in the research context as well as disclosures to researchers who are dual employees of a university (non-CE) and a hospital (CE).
19. Adjustments to Medicaid Reimbursement. The Secretary should pursue with Congress and the state Medicaid agencies making adjustments to Medicaid reimbursement rates to recognize the costs of complying with HIPAA.
20. Fund the ASCA $42.5 million. The Secretary should recommend to Congress that it fund the $42.5 million for technical assistance authorized under the Administrative Simplification Compliance Act (ASCA), and that some of that funding should be allocated to Privacy Rule implementation and the recommendations contained herein.
21. HIPAA Compliance Grants. The Secretary should recommend that Congress fund HIPAA compliance grants for the states.
22. Relieve financial burden for providers. The Secretary should recommend that Congress provide tax incentives or other mechanisms for HIPAA compliance for providers lacking the resources to comply.