HIPAA changes that are expected to take place in 2024 include:

• Permitting disclosures of PHI when needed to help individuals with substance use disorder, serious mental illness, and in emergency circumstances. This change should be welcomed by healthcare providers in that improvement in patient care and outcomes should be a direct result of this change.
• Permitting disclosures of PHI for individual-level care coordination and case management (to avoid confusion whether consent is required.) Healthcare providers should be glad about this change because improved patient care and outcomes could be a direct result of this update.
• Strengthening individuals’ access rights to inspect and obtain copies of PHI and reducing the time allowed to respond to access requests to 15 days. The current Right of Access Rule requires a healthcare provider to respond to requests within 30 days. It is important to note that some states already have a requirement to respond within 15 days.
• Addressing the form of PHI access to include individuals’ personal health applications and transfers of PHI to third parties via a Patient Access API. This has a greater impact on EHR developers in that they will need to enable third party applications to request information from the EHR systems. It could also automate the response to requests under the right of access rule. The implications of this rule change are far reaching.
• Reducing the requirements for verifying the identity of an individual exercising their access rights so the individual does not experience an “unreasonable burden”. This change will help to prevent healthcare providers from making it difficult for patients to access their health information and will make documentation of access requests more difficult.

HIPAA is about ensuring that only individuals and organizations that have a right and/or need to access patient information are able to access that information. The rule changes are expected to help reduce barriers to sharing patient information with others who need the information, which can enhance healthcare outcomes and empower patients to access their own health information. The rules also include clarifications to make it easier for healthcare providers to understand when they can and should release information, which will hopefully reduce some of the burden when processing requests for information.

As these new rules come out, practices will need to train their staff on the changes in HIPAA and implement updated HIPAA privacy and security policies to be compliant with these changes. 

If you are not currently insured with PICA, fill out our online form to get a no-obligation quote!

The information contained on the PICA Blog does not establish a standard of care, nor does it constitute legal advice. The information is for general informational purposes only. We encourage all blog visitors to consult with their personal attorneys for legal advice, as specific legal requirements may vary from state to state. Links or references to organizations, websites, or other information is for reference use only and do not constitute the rendering of legal, financial, or other professional advice or recommendations. All information contained on the blog is subject to change.