Medical Association Objects To EHR RulesMedical Association Objects To EHR Rules

The Medical Group Management Association has raised concerns that new Health Insurance Portability and Accountability Act disclosure requirements for electronic health records are burdensome, costly, unnecessary, and will impede the adoption of EHRs.

In a letter dated May 18 to Georgina Verdugo, director of the Department of Health and Human Services' office for civil rights, MGMA president William Jessee outlined his organization's position and urged significant modifications to the new HIPAA disclosure requirements.

Under the 2003 HIPAA privacy rule, patients can request an accounting of disclosures of their protected health information. However, under the Health Information Technology for Economic and Clinical Health Act, a new provision expands HIPAA's disclosure requirements to include information on treatment, payment, and health care operations, or TPO.

Additionally, if a request is made, the physician practice must provide individuals with an accounting of disclosures of PHI that occurred within three years prior to the date of the request. HITECH also mandates that if a physician practice uses an EHR, the practice will be required to account for TPO disclosures.

"This mandate runs counter to the nation's efforts to improve patient care and reduce waste and inefficiency through administrative simplification and adoption of electronic health records," Jessee wrote in the letter.

Jessee also concluded that because HITECH stipulates that the TPO accounting is required only for those physician practices with an EHR, the government seems to believe that TPO disclosures would be collected and stored only on EHRs, which is not the case.

"The majority of physician practices store their clinical data in an EHR and their administrative data (including payment information and data that would qualify as 'health care operations') in their practice management system. Satisfying an accounting of disclosures for TPO request in most practices is not a simple keystroke strike," Jessee wrote. To further demonstrate the difficulties that the expansion of disclosures will bring, MGMA conducted an online survey among its members, who include more than 360 practice administrators representing more than 7,000 physicians.

The results showed that 81% of respondents said that if their practice was asked to produce a PHI disclosure accounting report for TPO, the cost, staff training, and computer upgrades would be burdensome.

Additionally, 74% of those surveyed said that providing an accounting report for three years of patient data would be extremely or very burdensome. Further, over the past 12 months, 91% said that they had received 10 or fewer requests from patients for an accounting of disclosures, with 69% stating that they had not received any requests.

According to Jessee, MGMA's research suggests that if physician practices are required to provide TPO disclosures, "it would most likely require costly new software, additional staff, and also force the practice to manually track much of this information."

The letter highlighted the following five key issues and concerns:

The MGMA's letter was in response to the "HIPAA Privacy Rule Accounting of Disclosures Under the Health Information Technology for Economic and Clinical Health Act; Request for Information," which was published in the May 3 Federal Register.