HHS proposes rules to enhance health information privacy

The Health and Human Services Department proposed rules on Thursday to enhance the privacy of health information under the Health Insurance Portability and Accountability Act.

The proposed regulations, issued in a notice of proposed rulemaking, would expand the right of individuals to access their information while restricting disclosure of covered health information, extend the privacy and security requirements included in HIPPA to business associates of companies and organizations covered by the law, and ban the sale of a patient's health data without their consent.

"This rulemaking will strengthen the privacy and security of health information, and is an integral piece of the [Obama] administration's efforts to broaden the use of health information technology in health care today," David Blumenthal, the national health information technology coordinator, and Georgina Verdugo, director of the HHS Office of Civil Rights, said in a statement.

The privacy changes were part of the Health Information Technology for Economic and Clinical Health legislation that was included in the economic stimulus package enacted in February 2009.

Deven McGraw, director of the Center for Democracy and Technology's Health Privacy Project, noted the importance of strong privacy and security protections to the success of health IT.

"The public supports electronic health networks but they also have legitimate concerns about the privacy risks," McGraw said in a statement on the proposed rules. "The promise of health information technology to help reform our health care system will fail if policymakers don't take the public's privacy concerns seriously."

Those wishing to submit comments on the proposed regulations will have 60 days to do so beginning July 14.