The Office of the Civil Rights (OCR) of the Department of Health and Human Services announced recently that it will delay enforcement of a new requirement that certain HIPAA covered laboratories revise their notice of privacy practices to comply with changes made by the Omnibus Rule until further notice.
The Omnibus Rule, among other things, made material changes to the privacy obligations of HIPAA covered entities. Anytime there is a material change in a covered entity’s notice of privacy practices (NPP), it must promptly revise the NPP to incorporate the applicable changes. The Omnibus Rule required covered entities to update their privacy notices by the September 23, 2013 compliance date.
Shortly before the Omnibus compliance date, OCR announced that in the coming months it anticipates publishing an amendment to the HIPAA Privacy Rule and the Clinical Laboratory Improvement Amendments of 1988 (CLIA) regulations regarding the right of individuals to receive their test reports directly from CLIA and CLIA-exempt laboratories. Under current law HIPAA exempts laboratories from the provision requiring test results to be provided directly to patients in those States that do not provide for individual access to the test results. In those States the individual must receive his or her results through the ordering provider. The amendment would change the current law to allow laboratories to provide direct patient access to completed test reports.
If the amendment is finalized as proposed, it would result in a material change to the privacy practices of the HIPAA-covered laboratories and would require a change in the NPP.
In order to avoid imposing on covered entities a possible burden of having to revise NPS twice (first time to comply with the Omnibus Rule, the second to comply to the CLIA-HIPAA amendments), OCR has stated that it will not take enforcement action where a HIPAA-covered laboratory has not revised its NPP by the Omnibus compliance date (September 23, 2013).
The OCR will issue a notice at least 30 days in advance when this enforcement delay will end.
If you have questions concerning HIPAA, laboratories, or have any other concerns about your practice or business, you may contact us here.