Swift Move on Medicare Data Privacy Highlights Frustrating Health Privacy Delays Elsewhere

Medicare recipients now have more control over the privacy of their medical information, owing to new rules adopted last Thursday by the Centers for Medicare and Medicaid Services (CMS).  Medicare recipients can opt out of sharing their historic claims data with Accountable Care Organizations (ACOs), which were created as a part of the Medicare Shared Savings Program. The new rule also places express limits the use of this claims data.

ACOs agree to manage and coordinate health care for Medicare beneficiaries, including taking on some additional financial responsibility for ensuring this care is delivered effectively and efficiently.  CDT supported the privacy provisions in the proposed ACO rule, and we are pleased to see them adopted as final regulations.

CMS moved quickly, finalizing the ACO rules in just over four months.  But that efficiency only highlights the inexplicable year-long delay to implement final changes to the HIPAA privacy and security regulations that were mandated by the Health Information Technology for Economic and Clinical Health Act (HITECH), enacted as part of the American Recovery and Reinvestment Act of 2009. Equally frustrating: there is no indication of when the rules might be finalized.

Congress enacted the privacy and security provisions of HITECH to close gaps in the HIPAA privacy and security rules and bolster public trust in the adoption of health information technology and the electronic exchange of health information to improve individual and population health.  The failure to finalize those regulations means that privacy takes a back seat just as the Administration is pushing on the accelerator for health IT adoption and health reform.  Public support for these initiatives – already on somewhat shaky ground for health reform – will be undermined by failing to deal with the public’s significant privacy concerns.

We call on the HHS Office of Civil Rights and the Administration to issue the final HITECH privacy rules without further delay.