Health Advisory: The HIPAA Privacy Regulation- The Never-Ending Story
4/1/2002
In the final days of the Clinton Administration, the Department of Health and Human Services (HHS) issued a massive and far-reaching final regulation that was intended as a supplement to the Health Insurance and Portability and Accountability Act (HIPAA) of 1996. This new regulation attempted to institute a variety of new and comprehensive requirements related to the privacy of health information. The compliance date of those requirements is April 2003. Although it was widely expected that the incoming Bush Administration would significantly modify the final Privacy Regulation, the new administration left the rule in place, opting instead to request additional comments on the impact of the Privacy Regulation, and promising to propose additional changes to reduce the burdens associated with the rule. On March 27, 2002, HHS did in fact issue a proposed rule, which if made final, would make significant changes in a number of key areas. In this article, we discuss the following five key areas of the Proposed Rule: 1) new requirements for consents; 2) revision of the authorization requirements; 3) changes to the marketing provisions; 4) new proposals related to medical research; and 5) changes to the business associate provisions.
