The Deadline for Compliance With the HIPAA Omnibus Rule Has Arrived But Ambiguities Remain

The September 23rd deadline has arrived to comply with the Omnibus Rule’s modifications to the Health Insurance Portability and Accountability Act.  Yet, the federal government continues to provide guidance clarifying the changes. 

Despite being published in January, many organizations are still struggling to comply with the Omnibus Rule due to widespread confusion over issues such as business associate agreement requirements, notice of privacy practice provisions and what constitutes marketing communications under the expanded definition.

While many expected that the Omnibus Rule would be strictly enforced as of September 23, 2013, the Department of Health and Human Services (“HHS”) has issued an immense amount of guidance to clarify and assist organizations in implementing the regulations in recent weeks.  This guidance demonstrates that HHS recognizes the complexities of the Omnibus Rule and that HHS’ goal is to provide clarity to ensure that the modifications are understood and implemented in the health care industry.

On September 13, HHS issued three sample privacy notices to assist organizations in drafting notice of privacy practices which inform consumers about how their medical data will be used and made available under the Omnibus Rule.  Additionally, on September 19, HHS provided further guidance on the marketing exception for refill reminders and other communications about drugs or biologics currently prescribed to an individual.  This guidance was in response to Adheris Inc.’s, a pharmaceutical company contractor, filing of a lawsuit in federal court challenging the constitutionality of the marketing restriction.  HHS clarified that business associates who remind individuals about a refill could receive compensation at “fair market value” for its services and still be exempt from having to receive patient authorization for the communication easing uncertainties that this would constitute marketing communications under the Omnibus Rule.

HHS has also acknowledged that the Omnibus Rule provisions conflict with existing regulations, in particular the Clinical Laboratory Improvement Amendments of 1998 (“CLIA”).  In September 2011, amendments were proposed to CLIA and will likely take effect within the coming months.  In light of this, HHS has delayed enforcing the requirement that certain clinical laboratories revise their notices of privacy practices pursuant to the Omnibus Rule in order to avoid having the organizations undertake another revision to these policies to comply with the amended CLIA.

Although provisions of the Omnibus Rule are complex and ambiguities remain, organizations should make every effort to comply with the changes now.  Organizations must demonstrate that they are committed to protecting patient rights and personal health information even as the nuances of the Omnibus Rule continue to develop.