§17935 Restrictions on certain disclosures and sales of health information; accounting of certain protected health information disclosures; access to certain information in electronic format

Summary

Requires health care groups to follow new rules about sharing and selling your health information. If you ask a provider not to share your protected health information with your health plan for payment or business reasons (not for treatment), the provider must honor that request when the information is only about a service you paid for yourself in full. Health care groups must also limit any use, request, or sharing of protected health information to the least needed information or a limited data set. The Department of Health and Human Services (HHS) must give guidance on what “minimum necessary” means within 18 months after February 17, 2009. Information that cannot be traced to you (de-identified) is not covered by these limits. If a provider uses an electronic health record (EHR), disclosures from that EHR are not exempt from accounting. You can get an accounting of EHR disclosures from the prior three years. HHS will make rules about what tracking information must be collected soon after it adopts standards on accounting. When you ask for an accounting, a provider must either include disclosures by its business associates or give you a list of those associates and how to contact them. Rules about when these requirements start depend on when the EHR was acquired (dates include January 1, 2009; January 1, 2011; and January 1, 2014), and HHS may delay the start dates but not past 2013 or 2016 as limited in the law. Health care groups and their business associates may not get paid for your protected health information unless you give a valid written permission that says whether the information may be exchanged for money. Exceptions include public health work, some research (if charges only cover costs of preparing and sending data), treatment, certain health operations, payment to business associates for services they do under contract, and giving you your own records. HHS must write final rules about these limits within 18 months after February 17, 2009, and the rule about selling data takes effect six months after those final rules. If you use an EHR, you have the right to get your records in an electronic form and to have them sent directly to someone you name. Business associates may provide or send those electronic copies. Any fee for an electronic copy may only cover the provider’s labor to make the copy. Covered entity — an organization that provides, pays for, or manages health care and keeps health records. Business associate — a person or company that does work for a covered entity and handles protected health information. Protected health information — private health facts that can identify a person. Electronic health record — a digital medical record kept by a provider.