Posted by: Pabrai
Authorization, HIPAA; HITECH; Business Associates; Patient Safety Organizations (PSO);
The HITECH NPRM published as a Federal Register on July 14, 2010 (45 CFR Parts 160 and 164) includes proposed changes in the area of authorization and other requirements for disclosures related to marketing and sale of PHI.
Health care Operations & Marketing
The proposed rule modifies the definition of ‘‘marketing,” such that some communications to individuals about health-related products or services that are made under health care operations would now be considered marketing communications if the covered entity receives financial remuneration by a third party to make the communication. For marketing communications, individual authorization is required.
The proposal would require that a health care provider that receives financial remuneration by a third party in exchange for sending a treatment communication to an individual about the third party’s product or service must disclose the fact of remuneration in the communication and provide the individual with a clear and conspicuous opportunity to opt out of receiving future subsidized communications.
In addition, the proposed rule would require an individual authorization before a covered entity could disclose PHI in exchange for remuneration (i.e., ‘‘sell” PHI).
The proposed rule would permit compound authorizations for research purposes as long as it is clear to individuals that they do not have to agree to both the conditioned and unconditioned components of an authorization in order to receive research-related treatment. It is believed that the proposed provision would reduce burden on the research community by eliminating the need for multiple forms for research studies involving both a clinical trial and a related research repository or study.