In 1996 Congress passed the Health Insurance Portability and Accountability Act (HIPAA). One of the components of the law was to protect the privacy of patient information. This law required covered entities to properly store and then destroy patient information. Doctors and hospitals now had to secure the information in their care.

Since becoming law the use of medical records has changed significantly. We are in the middle of the national conversion to electronic medical records(EMR). The Health Information Technology for Economic and Clinical Health Act (HITECH) was part of the stimulus package and encourages the conversion to EMRs. This is done with a carrot in the form of grants to digitize but also with a stick in the form of reduce medicare payments for practices that don’t have EMRs.

The use of EMRs provides many benefits to the medical profession but also has new risks. Instead of a few files found in the trash it might be a disk drive stolen that has the information for thousands of patients. This is the reason that HITECH mandated the disclosure of data breaches to patient data.

Medicine has also changed. It is now much easier to get and use genetic information. To protect privacy the  Genetic Information Nondiscrimination Act of 2008 (GINA) was passed. This limits the use of genetic information.

To apply the changes from the new laws the Office for Civil Rights (OCR) has issued final rules on how the law would be applied. The OCR is responsible for enforcing the provisions of the law. The full release is on their website but here are some of the major changes:

• Business associates of covered entities are now liable for compliance with HIPAA Privacy requirements.
• Limiting the disclosure or sale of protected health information without consent from the patient.
• Expand individuals’ rights to receive electronic copies of their health information.
• Restrict disclosures to a health plan when the patient has paid for the treatment out of pocket.
• Require modifications and redistribution of the notice of privacy practices.
• Update the individual authorization for research and the disclosure of immunizations.
• Increase access to decedent information by family members or others.
• Adopt HITECH security enhancements to the Enforcement Rule concerning willful noncompliance.

The changes go into effect on  March 26, 2013. Practices will have 180 days to comply with the new enforcement provisions.  If you want a date it is September 23, 2013. HHS Secretary Kathleen Sebelius said, ”The new rule will help protect patient privacy and safeguard patients’ health information in an ever-expanding digital age.”