Main

When last we visited the Health Insurance Portability and Accountability Act of 1996 (HIPAA), in March of 2002, the “final” privacy regulations had been published, discussed, debated, and roundly disapproved. Following several cycles of public comment, newly adopted “final” Privacy Rules emerged on August 14, 2002. The 2002 revisions implemented a number of significant changes in many of the fundamental components of the Privacy Rules, including discretionary rather than mandatory consent requirements, greater focus on notice of privacy practices, uniform patient authorizations, acceptance of incidental uses and disclosures, a reliance exception to allow for continued use of protected health information after a subject’s withdrawal from a research study, more lenient institutional review board (IRB)/Privacy Board waiver criteria, and establishment of “limited data sets” that may be used or disclosed for research without patient authorization or IRB/Privacy Board waiver. Depending upon which side of the privacy debate one favored, the 2002 Privacy Rules were greeted with relief or anxiety. And the discussion, debate, and dissatisfaction continued. Not easily discouraged, the Department of Health and Human Services Office of Civil Rights took another shot at it, this time in the form of “Guidance Explaining Significant Aspects of the Privacy Rule,” which it issued on December 4, 2002. With April 14, 2003, the implementation date for most HIPAA-covered entities just behind us, it would be comforting to know what HIPAA does and does not require… at least for now. In this issue of Genetics in Medicine, Laura Cole and I parse the current “final” HIPAA Privacy Rules, particularly as they impact the practice of medical genetics, including the conundrum of confidentiality versus duty to warn.

Other HIPAA happenings

Q and As

As the HIPAA Privacy Rules get rolling, you may have specific HIPAA questions (who doesn’t!). Please e-mail your questions to me at lfleisher@sidley.com. Laura and I will answer selected questions in the next few issues of Genetics in Medicine.

For members only

For those of you clever enough to be members of the American College of Medical Genetics (ACMG), over the next few weeks we will be providing model HIPAA documents, including a Notice of Privacy Practices and various Authorizations, on the college web site (http://www.acmg.net). Please remember that these are only model documents. Check with your, or your institution’s, attorney to assure that it is appropriate for the needs of your practice.