The Department of Health and Human Services (“DHHS”) Office for Civil Rights (“OCR”) on September 19, 2013, announced a delay until further notice in its enforcement of the requirement that certain HIPAA–covered laboratories revise their notice of privacy practices (“NOPP”) to comply with the Omnibus Rule (published in January 2013 at 78 Federal Register 5566). This enforcement delay applies only to HIPAA–covered laboratories that are subject to the Clinical Laboratory Improvement Amendments of 1988 (“CLIA”)—that is, CLIA-certified or CLIA-exempt—that are otherwise not required to provide to individuals access to their test reports pursuant to exceptions provided for in § 164.524 of the Privacy Rule under HIPAA. The enforcement delay does not apply to laboratories that operate as part of a larger legal entity, such as a hospital, and by virtue of that relationship do not have their own laboratory-specific NOPP.
Under the Privacy Rule, covered entities are required to promptly revise their NOPP upon a material change to any of their privacy practices as stated in the NOPP. As many of you know, the Omnibus Rule makes a number of material changes to the privacy obligations of HIPAA covered entities, as discussed in previous posts on this blog. The changes required revisions to your NOPP by September 23, 2013.
According to its announcement, DHHS anticipates publishing an amendment to the HIPAA Privacy Rule and the CLIA regulations regarding the right of individuals to receive their test reports directly from CLIA labs (certified and exempt). Some of you may be aware that this amendment was published for public comment on September 14, 2011 (76 Federal Register 56712). If the amendment is finalized as proposed, it would result in a material change to the privacy practices of the HIPAA-covered laboratories identified above. Consequently, the affected laboratories would need to ensure that their NOPPs informed individuals of this new right and included a brief description of how to exercise the right. This enforcement delay is actually a benefit for those CLIA-certified and CLIA-exempt laboratories and is proper under OCR’s enforcement discretion to relieve the possible burden on and expense to the HIPAA–covered laboratories identified above of having to revise their NOPPs twice within a short period of time, September 23, 2013, to comply with the Omnibus Rule and then again if the proposed amendment to § 164.524 (giving individuals access to their information directly from the subject laboratories) went into effect. One can only wonder, however, given the late date of this announcement, how many laboratories have not already incurred the burden and expense.
Of particular note for all other subscribers to this blog was the information in the announcement that said that OCR would not take enforcement action or seek to impose civil money penalties in cases in which the HIPAA–covered laboratory had not revised its NOPP by September 23, 2013. The savvy reader should read this information to mean that OCR will take enforcement action and seek to impose civil money penalties in cases in which the HIPAA covered entity had not revised its NOPP by September 23, 2013.
Please take a look at the compliance resources available at www.veteranspress.com and in particular the new Gap Analysis Survey packages. These very useful resources have helped hundreds of covered entities improve their compliance status.
