New HHS record rules may rock insurers, plan administrators

A federal effort to help a big new medical research project collect Americans’ medical records quickly could make it easier for insurance underwriters to get the records.

The effort could also increase the workload of health plan administrators, by encouraging consumers to ask health plans to send health records to other parties.

The U.S. Department of Health and Human Services Office for Civil Rights (HHS OCR) gives guidelines for sending health records to third parties in a new batch of advice based on Health Insurance Portability and Accountability Act (HIPAA) health records access standards. HHS OCR released those standards in January.

See also: New HIPAA health records rules: 4 things agents have to know

HHS OCR officials say an individual has a right to have a health care provider or a health plan send protected health information (PHI) directly to a third party. The third party could be a health care provider; a research team; an insurer that offers life, disability or long-term care insurance; or any other designated individual or entity.

The consumer has that right through the HIPAA right of access provision, HHS OCR officials say.

In the past, a patient could use a HIPAA authorization process to get a provider or plan to send health records to a third party.

The HIPAA authorization process requires the patient to fill out a relatively complicated form, and it imposes no deadlines on the entity sending the information, officials say.

When a patient uses the HIPAA right of access to get an entity to send health records to a third party, the patient simply has to make a request in writing, sign the request, and indicate where the entity should send the information, officials say.

Under the HIPAA right of access standard, the entity sending the health records must send the records within 30 days, officials say.