[Transcript] Episode 423: New HIPAA Privacy Final Rule to Support Reproductive Health Care Privacy

 

Evan Dumas 

You’re listening to Group Practice Tech, a podcast by Person Centered Tech, where we help mental health group practice owners ethically and effectively leverage tech to improve their practices. I’m your co-host Evan Dumas.

 

Liath Dalton 

And I’m Liath Dalton and we are Person Centered Tech.

 

Liath Dalton 

This episode is brought to you by Therapy Notes. Therapy Notes is a robust online practice management and electronic health record system to support you in growing your thriving practice. Therapy Notes is a complete practice management system with all the functionality you need to manage client records, meet with clients remotely, create rich documentation, schedule appointments, and bill insurance all right at your fingertips. To get two free months of Therapy Notes as a new TherapyNotes user, go to TherapyNotes.com and use promo code PCT.

 

Evan Dumas 

Hello, and welcome to Episode 423: New HIPAA Privacy Final Rule to Support Reproductive Health Care Privacy.

 

Liath Dalton 

Hi, everybody, we are glad to have you with us. And yes, this is an impactful Final Rule, which went into effect as of June 25 2024. And so what it going into effect means is that this is the date that HIPAA covered entities and their business associates may begin implementing the new requirements.

 

Liath Dalton 

Covered entities and business associates are not yet required, like required-required but encouraged, to comply with the requirements until December 23 2024. And then there’s one additional carve out, which is that one component of the new requirements includes changes to the HIPAA Notice of Privacy Practices.

 

Liath Dalton 

And the required compliance date for that is way down the road. That isn’t until February 16 2026, which in part I’m relieved of because the good folks at HHS and the OCR have not yet updated the model Notice of Privacy Practices, which is an excellent template to be basing what you customize your particular practices policy or Notice of Privacy Practices off of, they have not yet updated that.

 

Liath Dalton 

And so it’s great that it’s not yet required to have yours updated, because we want to be referring to what their model Notice of Privacy Practices includes and what the specific guidance is related to that piece of things. So that component of how the final rule impacts things isn’t isn’t yet in effect.

 

Liath Dalton 

But there are other pieces that are, and that should start informing how your practice, how your clinicians are conceptualizing of their role and responsibility related to providing any sort of clinical care that includes discussion around reproductive rights and considerations and very specifically, how they are documenting that as well.

 

Liath Dalton 

So the kind of the the main bullet points around this final rule is that it prohibits the use or disclosure of PHI when it’s sought to investigate or impose liability on individuals, or providers, who are seeking to obtain or provide or facilitate lawful reproductive health care. And it requires the covered entities or business associates obtain a signed an attestation that certain requests, for like health oversight activities, judicial and administrative proceedings, law enforcement purposes and so on, for PHI, potentially related to reproductive health care are not for prohibited purposes.

 

Liath Dalton 

So, obtaining an attestation will be a new part of records release processes in certain conditions. And so that’s something that that should be on your radar as a practice leader, is that if you are getting records requests that are not directly from a client, and the contents of the records that would be released include anything related to reproductive health care, then obtaining this attestation is necessary.

 

Liath Dalton 

I think we will work with with Eric Strom, who’s the HIPAA and teletherapy attorney that you all are likely familiar with, but who we collaborate with a lot, working with him to create a template for that an attestation form that can be utilized, because we want to make sure that it’s something that’s really clear and streamlined.

 

Liath Dalton 

But just want everyone to at this point, be aware that they should, their practice, as a HIPAA covered entity, should not be using or disclosing PHI if it’s being requested for the purposes of investigating or imposing liabilities, either on the patient or client themselves, or other health care providers. And that if you’re doing a records release that includes PHI, that pertains to reproductive care, that you need to be obtaining a attestation related to that, to ensure that, that the the use of the records release is not related to any of the prohibited purposes under this new Final Rule.

 

Liath Dalton 

So that is kind of the three main main bullet points of what the Final Rule entails or what its implications are. You know, one noteworthy thing is that the prohibition is still defined as being limited to health care that is protected, meaning legal, where it is occurring, or being received.

 

Evan Dumas 

Yeah.

 

Liath Dalton 

Right? So and they do specify an example, that if a resident of one state travels to another state to receive reproductive health care, such as an abortion, and I’m reading verbatim, now, from the Final Rule facts sheet, that if it is lawful in the state where where that is provided, that that is what what matters.

 

Liath Dalton 

So even if the resident is or the the patient in question is a resident in a state where the type of reproductive care they receive is not legal, and you as their care provider are aware of that and have have documented that, then you can’t be disclosing it.

 

Liath Dalton 

For example, then to extrapolate further from from this example, if you are a therapist, in a state where abortion is not lawful, but, or, under the conditions under which your client or patient is going to be obtaining it is not lawful, because of you know, timeframe cut offs or something like that. But they travel to another state where it is lawful and obtain that care in that state, and this is something they have disclosed to you. Your disclosure of any clinical documentation related to their having received that service, in a state where it was lawful, needs to be covered by the attestations.

 

Liath Dalton 

Like in other words, you can’t be disclosing it, because the services they received in a place where it was lawful, though not lawful in your state, are if that documentation is being sought in order to prosecute the individual, or their health care provider, or anyone providing assistance to them in receiving that such as you know, travel assistance or anything like that, that cannot, under this new Final Rule, be disclosed.

 

Liath Dalton 

Now, if they were obtaining that care legally, in the location where the service is rendered, and that’s been disclosed to you, that that’s not something that’s protected under this. But I think here, here we have a really good rubric for for helping to navigate a lot of the considerations that the rapidly evolving and very emotionally fraught and understandably so, and contentious landscape that we’re, we’re navigating, what that consists of.

 

Liath Dalton 

So this is useful to to have this Final Rule and additional clarification and guidance. And it also highlights the fact that, because the implications for this sort of documentation and disclosure can be so significant, it is really imperative that you understand the implications, and and are prepared to manage them in a way that is best supportive of client rights and needs and ethical responsibilities as well.

 

Liath Dalton 

And of course, that’s the breadth of and depth of what that entails is not something that’s completely encapsulated in this Final Rule. So that’s why when, one resource I want to draw folks attention to is actually a supportive, topical CE training that PCT has available, a legal ethical training, and that is on the Law and Ethics of Clinical Documentation for a Post-Roe world. And that’s something that is primarily presented by Eric Strom, who is an attorney and a sitting member of the AMHCA Ethics Committee is very well equipped to, to speak to these considerations and how to navigate it.

 

Liath Dalton 

So we’ll be linking to that in the show notes, but just wanted to get this on everyone’s radar, and highlight those pieces around the timeframe.

 

Liath Dalton 

Because, you know, when the OCR sends a bulletin out saying there’s a new Final Rule and its effective date is today, and that’s the day that they are sending the notice out, that can engender a bit of a panic response of oh, no, what do I have to change? And it’s talking about a lot of significant things, and attestations and notice of privacy policies and whatnot, so, ah, how do I manage this?

 

Liath Dalton 

So the good news is that we’ve got those timeframes that you are encouraged to be complying with the requirements, but are not actually required to until December of 2024. So you have time to get your ducks thoroughly in a row, including that attestation component. And then that the Notice of Privacy Practices component of it is not going to be an actual requirement until 2026, which is at this point a long ways down the road.

 

Liath Dalton 

But by that point, we should have an updated model Notice of Privacy Practices from the OCR, and additional guidance on how to specifically customize that. So that’s the lay of the land. And hopefully, this feels hopeful and reassuring and makes you feel like you know how to take the next steps going forward and that you don’t need to panic or worry too much.

 

Evan Dumas 

Oh, no, no.

 

Liath Dalton 

All right. We’ll see you good, folks. Next time. Thanks for joining us.

 

Evan Dumas 

Yeah, talk to you next time, everybody.

 

Liath Dalton 

This has been Group Practice Tech, you can find us at PersonCenteredTech.com. For more podcast episodes, you can go to personcentered tech.com/podcast or click podcast on the menu bar.