HHS updates HIPAA rules for electronic health records

NEW YORK — The Department of Health and Human Services issued a new rule that it said was necessary to protect the security of health information stored online.

As required by the Health Information Technology for Economic and Clinical Health Act, which was part of the 2009 economic stimulus bill, HHS said it would change patient privacy rules in the Health Insurance Portability and Accountability Act in order to provide for privacy and security protection for information stored in electronic health records.

Among other things, the new rules will place stronger restrictions on use of protected health information for marketing and fundraising while prohibiting its sale without a patient's permission; expand patients' rights to receive electronic copies of their health information and restrict disclosures to health plans regarding treatments that patients have paid off out of pocket; change individual authorization requirements to make research and disclosure of child immunization proof to schools; and allow access by family members and others to information about somebody who has died.