August 1, 2011

Georgina Verdugo, JD, LLM, MPA

Director

HHS, Office for Civil Rights (OCR)

Attention: HIPAA Privacy Rule Accounting of Disclosures

Hubert H. Humphrey Building, Room 509F

200 Independence Ave. S.W.

Washington, D.C.20201

Re: RIN 0991-AB62 – HIPAA Privacy Rule Accounting of Disclosures Under the Health Information Technology for Economic and Clinical Health Act,76 Fed. Reg. 31426

Dear Madam Director:

The American Health Care Association (AHCA), the NationalCenter for Assisted Living (NCAL) and the Long Term Care Consortium (LTCC) appreciate the opportunity to comment on the above-referenced guidance. AHCA/NCAL is a federation of affiliated long-term care provider associations representing some 10,000 nonprofit and for-profit nursing facilities, skilled nursing facilities, assisted living and residential care facilities, sub-acute providers and intermediate care facilities for the mentally retarded and developmentally disabled. The LTCC is a group of AHCA/NCAL members with specific expertise in privacy, security and compliance—organized ten years ago to provide leadership and guidance to the long term care profession and reduce the overall burden of compliance through collaboration on key initiatives.

AHCA/NCAL and its membership are committed to continuous improvement in the delivery of professional and compassionate care provided daily by millions of caring employees to more than 1.5 million of our nation's frail, elderly and disabled citizens who live in nursing facilities, assisted living residences and other facilities. The vast majority of our member long-term care facilities are covered entities under the Health Insurance Portability and Accountability Act (HIPAA).

With this notice of proposed rulemaking the HIPAA Privacy Rule’s current standard for accounting of disclosures of protected health information (PHI) is modified to implement the statutory requirement under the Health Information Technology for Economic and Clinical Health Act (HITECH), to the effect that covered entities must now provide individuals with an accounting of disclosures of their PHI for treatment, payment and healthcare operations through an electronic health record for the prior three years.

The proposed rule divides HIPAA accounting rights of individuals into two separate rights — the right to receive an “access report,” providing details regarding individuals and entities who have accessed an individuals “designated record set” within an existing electronic format and the right to receive a scaled back version of the current HIPAA “accounting of disclosures.” The proposed rule indicates that the access report must include: the date and time of access; the name of the entity accessing the information; a description of the information that was accessed (if available); and a description of the actions taken (e.g., create, modify, access or delete) by the accessing user (if available). The accounting of disclosures continues to apply to both paper and electronic PHI in the proposed rule but: reduces the accounting period from six to three years (for both the access report and the accounting); reduces the time an entity has to respond to an individual’s request for an accounting or an access report from 60 days to 30 days (subject to one 30 day extension); and, imposes a “reasonable, cost-based fee” on individuals requesting more than one accounting or more than one access report by an individual in any twelve month period.

AHCA/NCAL supports a number of the changes in the proposed rule, particularly in those areas where clarity and reduced burdens appear to be the aim. For example, by listing the types of disclosures subject to the accounting requirement, rather than listing exemptions, long term care providers will be better able to comply with the requirements. Further, the proposed rule introduces a timeline to reduce the accounting period from six to three years; appropriately weighing the provider’s administrative burden against the potential value to the patient/resident.

In other instances, however, OCR must more carefully balance the mandates of the applicable Federal law with the realities of today’s accountings. The proposed rule suggests changing the current 60-day timeline for responding to accounting of disclosures requests from individuals to 30-days, which is entirely too short, especially since information needs to be gathered from a variety of sources. We support retention of the 60 day timeframe which, we believe, serves both the needs of the requestor, and the needs of the facility in accurately gathering the requested information in a timely fashion.

Further, the proposed rule goes far beyond the HITECH requirements and mandates that the access report include both disclosures and uses (if available) through an electronic designated record set for almost any purpose, including disclosure and uses by Business Associates. This mandate results in significant challenges and burdens for long term care covered entities, where the health information for most patients/residents is a hybrid records (e.g., health information that is tracked in multiple formats and stored in multiple places and use both manual and electronic processes) and compiling aggregate access reports is impractical. Consider the following common scenario in a long term care setting which illustrates the multiplicity of resident information input tasks. :

  • A resident is admitted into Nursing Facility(NF) from transferring Hospital A. Hospital A requires that NF access Hospital A’s Electronic Medical Record (EMR) system to print off the resident’s history and physical and discharge summary, which is subsequently added to the resident’s paper chart and maintained at NF.
  • During the admission process, the admissions clerk enters the resident’s demographic information and financial information into NF’s vendor hosted EMR application from which the face sheet is printed and placed in the resident’s chart. The admission clerk also makes copies of the resident’s advanced directive, living will and power of attorney documents and places them in the resident’s paper chart.
  • NF’s nursing staff receives orders from Dr. Doe and faxes them to the pharmacy, where staff enter the orders into the electronic pharmacy database to fill the orders and generate an order sheet for the Medication Administrative Record (MAR) and the Treatment Administrative Record (TAR). Subsequently, NF’s nursing staff prints the order sheets and places those in the resident’s paper chart for Dr. Doe to review and sign. Nursing staff also print off the resident’s MAR and TAR and place the MAR in the medication binder and the TAR in the treatment binder.
  • Nursing, social services, activities and dietary all complete their initial assessments of the resident on paper forms and place them in the resident’s paper chart. Subsequently, these same individuals enter information from their initial assessments into NF’s EMR to create care plans. The care plans are then printed and placed in the resident’s paper chart.
  • Physical therapy, speech therapy and occupational therapy staff perform evaluations and document them in the electronic therapy documentation system. The evaluations are printed and placed in the resident’s paper chart. Nursing staff document the resident’s progress in a paper format, which is placed in the resident’s paper chart. Certified Nurse Assistants (CNAs) document the resident’s personal care including elimination, nutrition, activities of daily living, etc., in NF’s Point of Care application, which feeds into the Minimum Data Set Assessment (MDS).
  • Dr. Doe requires that NF access his EMR to obtain resident progress notes which are printed and placed on the resident’s paper chart. The Lab provider requires that NF access its electronic system to print off the lab results, which are added to the resident’s paper chart. The Radiology provider then requires that NF access its electronic system to print off radiology reports which are added to the resident’s paper chart; etc.

This example demonstrates the complex nature of the NF organization’s designated record set. Clearly, the designated record set is made up of documentation from many difference sources (including some paper and some electronic). NFs typically have no control over the operation of the systems belonging to the hospital, physician, pharmacy, radiology provider, rehabilitation provider, etc. Further, the organization does not have the ability to run the Access Reports that may or may not be maintained by these outside systems.

For these reasons, AHCA/NCAL asks OCR to eliminate the aggregate access report requirement for LTC providers or at a minimum include only access reports from the system that the provider maintains and controls. OCR’s proposed rule should reconsider the requirement of compiling an aggregate access report for systems which are not in the control of the covered entity.

AHCA/NCAL appreciates the opportunity to comment on the proposed rule and welcomes any specific questions regarding these comments.

Sincerely,

Dianne De La Mare

Vice President, Legal Affairs