As you may already know, one of the main objects of the Health Insurance Portability and Accountability Act (HIPAA) is to protect the privacy of healthcare patients. Unless a healthcare provider or insurance company has written permission from the patient, they are prohibited from disclosing the patient's Protected Health Information (PHI) for research purposes. But a recently proposed bill seeks to change the current stance on HIPAA in regards to patient privacy.
On April 29, Fred Upton, R-Mich and Rep. Diana DeGette along with several other Republican and Democratic House members proposed a new bill that would clarify the HIPAA Privacy Rule. The bill, which is being called “21st Century Cures,” specifically covers the way in which PHI is used for research purposes. Under HIPAA's current Privacy Rule, covered entities may only use PHI without the patient's consent if it's use for treatment, payment or operations. 21st Century Cures would amend the Privacy Rule so that covered entities are allowed to use PHI without patients' consent for research purposes as well.
“Most significantly, the bill would require HHS to revise the HIPAA regulations so that uses and disclosures for research are treated the same as uses and disclosures for a covered entity's own
healthcare operations, as long as any disclosures go to a HIPAA covered entity or business associate," said Adam Greene, privacy attorney at the law firm Davis Wright Tremaine.
So, why are lawmakers pushing for a bill that allows covered entities to use PHI for research purposes without obtaining the patient's consent? Proponents of the bill say it will eliminate the current barriers that are preventing medical innovation in the diagnosis, treatment and prevention of diseases. Furthermore, it would allow medical facilities to tap into the molecular medicine, genome sequencing, and other advanced healthcare technologies.
Opponents of the bill, however, say it goes too far in stripping away essential privacy rights from healthcare patients. This makes sense considering the fact that HIPAA is supposed to protect the privacy of patients rather than expose it. In any case, the battle over 21st Century Cures will likely continue, as both sides continue to plead their case.
Even if the 21st Century Cures bill passes, we wouldn't see it take effect for quite some time. House members say the Department of Health and Human Services would be given 12 months to implement the changes.