On January 23, 2020, the United States District Court for the District of Columbia declared sections of the 2013 Omnibus Rule unlawful. The Court found that the Department of Health and Human Services (HHS) impermissibly expanded provisions of the HITECH Act by removing authorization requirements for the transmission of protected health information (PHI) from sources other than an electronic heath record (EHR). Additionally, the Court declared that HHS’s 2016 Guidance was unlawful insofar as it commands that the Patient Rate limitations apply to all third-party directives.<\/p>\n
In Ciox Health, LLC v. Alex Azar, et al.<\/em>, No. 18-cv-0040 (D.D.C. January 23, 2020), a medical records company that contracts with health care suppliers to maintain, retrieve, and produce individuals’ medical records challenged legal restrictions and conditions placed on the production of PHI. Ciox Health argued that HHS lacked authority to expand the HITECH Act’s third-party directive in the 2013 Omnibus Rule and that the 2016 expansion of the Patient Rate violated the procedural and substantive protections of the Administrative Procedure Act.<\/p>\n The Court examined the requirements of the 2013 Omnibus Rule as it pertains to third-party directive requests. Prior to enactment of the HITECH Act, a covered entity could not release PHI stored in any format to a third party without a valid authorization that included: a description of the information sought; the purposes for disclosure, the authorization’s expiration date\/event; and statements adequate to place the individual on notice of his or her rights. In 2009, Congress passed the HITECH Act which changed the law to permit patients to direct a facility to transmit PHI from an EHR to a third party without the burden of completing an authorization. The 2013 Omnibus Rule expanded this relief from the authorization requirement to include PHI contained in any format, not just PHI in EHRs. The Court held that in making this expansion, HHS impermissibly exceeded its general rulemaking authority to expand a congressionally imposed restriction. Thus, based on the Court’s ruling, an authorization will once again be required before a patient may direct a facility to release PHI that is not found in an EHR to a third party.<\/p>\n [\u2026]<\/strong><\/p>\n This is an extract of previously published material.<\/strong><\/em><\/p>\n Click here to view full original article at www.jdsupra.com<\/a><\/p>\n","protected":false},"excerpt":{"rendered":" On January 23, 2020, the United States District Court for the District of Columbia declared sections of the 2013 Omnibus Rule unlawful. The Court found that the Department of Health and Human Services (HHS) impermissibly expanded provisions of the HITECH Act by removing authorization requirements for the transmission of protected health information (PHI) from sources other than an electronic heath record (EHR). Additionally, the Court declared that HHS’s 2016 Guidance was unlawful insofar as it commands that the Patient Rate limitations apply to all third-party directives.… Read More <\/a><\/p>","protected":false},"author":1,"featured_media":419,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[36,3,35,18],"tags":[39,38,17,37,20,19],"_links":{"self":[{"href":"https:\/\/apexcompliance.net\/wp-json\/wp\/v2\/posts\/98"}],"collection":[{"href":"https:\/\/apexcompliance.net\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/apexcompliance.net\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/apexcompliance.net\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/apexcompliance.net\/wp-json\/wp\/v2\/comments?post=98"}],"version-history":[{"count":0,"href":"https:\/\/apexcompliance.net\/wp-json\/wp\/v2\/posts\/98\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/apexcompliance.net\/wp-json\/wp\/v2\/media\/419"}],"wp:attachment":[{"href":"https:\/\/apexcompliance.net\/wp-json\/wp\/v2\/media?parent=98"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/apexcompliance.net\/wp-json\/wp\/v2\/categories?post=98"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/apexcompliance.net\/wp-json\/wp\/v2\/tags?post=98"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}