New fundraising regulations proposed. HHS seeking comments.
AHP's Comments to HHS Now Online
On July 8, 2010, the Department of Health and Human Services, Office for Civil Rights, announced proposed modifications to the HIPAA Rules as directed under the Health Information Technology for Economic and Clinical Health Act (HITECH) to strengthen the privacy and security protection of health information, and to improve the workability and effectiveness of HIPAA Rules.
The Notice of Proposed Rulemaking includes proposed changes to the HIPAA fundraising language (pages 115-120), and HHS additionally is seeking comments regarding the expansion of allowable information available to fundraisers. Comments will be received for 60 days, beginning July 14, 2010.
Proposed changes/additions to the HIPAA fundraising language include:
1.) Opt-out Language.
- Opt-out language must be on each fundraising communication sent;
- It must be easy for individuals to opt-out (toll-free #, e-mail);
- Opting out can’t impact future treatment or payment for care;
- Fundraisers must abide by opt-out requests and remove individuals from future communication (vs. making “reasonable effort”);
- Opting-out will constitute a revocation of authorization.
* HHS is seeking comments on what communications the opt-out should apply to. All future fundraising? That specific fundraising campaign? What is the process for an individual to get their name back on the fundraising list? What is considered a revocation of an opt-out?
2.) Department/Outcome information.
HHS proposes that fundraisers be provided access to information beyond demographic data—specifically department and outcomes data.
* HHS is seeking comments on what additional information should be allowed (or shouldn’t); will the minimum necessary standard appropriately limit use or disclosure of this information if allowed; if department/outcome data is allowed, should covered entities be required to offer an opt-out before the first fundraising solicitation is made (pre-solicitation opt-out) and if yes, how would that work.
3.) Notice of Privacy Practices.
HHS proposes that covered entities/hospitals include in their notice of privacy practices notice that individuals have the right to opt-out of receiving fundraising communication.
Comments are due on or before September 13, 2010 and must reference RIN 0991-AB57. They can be submitted online at http://www.regulations.gov, or by mail (original and one copy) to U.S. Department of Health and Human Services, Office for Civil Rights, Attention: HITECH Privacy and Security Rule Modifications, Hubert H. Humphrey Building, Room 509F, 200 Independence Avenue, SW., Washington, DC 20201. All comments will be posted and can be viewed publically at the http://www.regulations.gov website
Shortcuts: To submit comments online. To view comments (click on Open Docket Folder and check Public Submissions in Document Type).