2016 changes in compliance which will affect your EHR

The regulatory environment for EHRs in 2016 will witness minor changes, these changes are less substantial than those seen in previous years. The shifts in the regulatory landscape for EHRs set to occur in 2016 represent clarifications of previous regulations, but many will also still have implications for how EHR is used in healthcare practices.

1. New HIPAA guidance released by OCR

OCR recently released new guidance that provides clarification concerning individuals’ access to their health information under HIPAA. As most are likely aware, HIPAA requires covered entities to provide patients, upon request and in a format requested by the patient, with access to any medical records about them that the covered entity maintains in a designated record set.

However, OCR’s guidance comes as a response to what the agency perceives as a long-standing misinterpretation of the law in that providers have been using HIPAA as an excuse not to release records.

The guidance states, in part, that HIPAA covered entities:

“Shall provide individuals, upon request, with access to the protected health information (PHI) about them in one or more “designated record sets” maintained by or for the covered entity. This includes the right to inspect or obtain a copy, or both, of the PHI, as well as to direct the covered entity to transmit a copy to a designated person or entity of the individual’s choice."

Recommended Reading: EHR Vendor Guide - Find EHR vendors who are HIPAA compliant

Most practices likely understand the spirit of HIPAA’s patient access provisions. Nonetheless, those who may fall on the side of being too restrictive concerning patient access should understand that this issue now is on the OCR’s radar and could likely lead to liability for noncompliance with HIPAA.

2. Health app guidance

As the EHR environment shifts to mobile health apps, OCR recently issued a guidance document on February 11, 2016, addressing the applicability of HIPAA to mobile apps. The guidance document, entitled “Health App Use Scenarios & HIPAA,” sets forth several factual scenarios involving mobile health apps, providing an explanation of whether, in each scenario, HIPAA would apply to the developer of the app. This guidance offers a much-needed clarification on a growing segment of the EHR space.

3. CMS Final Rule on (EHR) Incentive Programs

In October 2015, CMS released a final rule outlining the criteria that eligible professionals, eligible hospitals, and critical access hospitals must meet to participate in the EHR Incentive Programs.

According to CMS, major provisions include:

• Reducing the number of reporting objective from 18 to 10 including one public health reporting objective.

• Reducing the previous benchmark of 20 total objectives in prior stages to 9 objectives for eligible hospitals and critical access hospitals (CAHs) including one public health reporting objective.

• Clinical Quality Measures (CQM) reporting for both eligible professionals (EPs) and eligible hospitals/CAHs remains unchanged.

4. The winding down of Meaningful Use

According to the Acting Administrator of CMS, Andy Slavitt, major changes to the meaningful use program are imminent. Slavitt added that 2016 would likely see the end of the program altogether. In a blog posted on the CMS website, Slavitt stated, “The Meaningful Use program as it has existed, will now be effectively over and replaced with something better.” He went on to outline these changes as moving towards a patient outcome based system, customizable technology goals; requiring open APIs on EHRs and a further commitment to interoperability and zero tolerance policy of “data blocking.”

In summary, the regulatory landscape EHRs in 2016 will likely provide a foundation for much more comprehensive changes to come in 2017. How much and what direction in which these shifts will occur will depend heavily on the political balance of power after the 2016 elections.