The House of Representatives voted in favor of the 21st Century Cures Act earlier this month, with 392 representatives voting “yes” and 26 voting “no.” However, this bill lacks the necessary wording to allow changes to the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule.
When the bill was originally drafted, it included a provision that would allow the Department of Health and Human Services (HHS) to revise or clarify the HIPAA Privacy Rule in regards to the use of Protected Health Information (PHI) for research purposes. This provision was since removed from the final bill, with lawmakers opting for a “working group” instead.
As explained in the bill, the working group can conduct reviews and provide recommendations to the Secretary on whether the use of PHI for research purposes should be modified.
“The working group shall conduct a review and submit a report to the Secretary containing recommendations on whether the uses and disclosures of protected health information for research purposes should be modified to allow protected health information to be available, as appropriate, for research purposes, including studies to obtain generalizable knowledge, while protecting individuals’ privacy rights,”wrote the bill.
The bill further explains that the working group must consider the expectations and preferences of the patient in regards to how his or her PHI is being used. If a patient doesn't want his or her PHI shared, the working group should abide by these wishes.
The HIPAA Privacy Rule currently allows covered entities to share a patient's PHI without their consent in a few specific situations, such as the facilitating medical treatment, assisting law enforcement with investigations, etc.
So, what does this mean exactly? Well, it means that the Privacy Rule will remain the way it currently is. The previously drafted bill would have allowed for changes to be made regarding the use of PHI for research purposes. Instead of waiting for a patient's authorization, covered entities could have shared PHI to third parties if it was being used for research purposes.
The final bill doesn't contain this wording. Rather, it includes a provision that allows a “working group” to provide recommendations to the Secretary regarding the use of PHI for research purposes. This isn't necessarily bad, as it could still prove useful for thousands of patients suffering from rate and otherwise complex medical conditions.