HHS pulls final breach rule to get it right

The Health and Human Services Department appears to have had second thoughts on publishing a final rule for breach notification that it had crafted as one of the last steps before releasing the key health privacy regulation.

HHS has withdrawn the final rule it had submitted to the Office of Management and Budget to review, "to allow for further consideration, given the department's experience to date in administering the regulations," HHS said in an announcement.

An Interim Final Rule for Breach Notification for Unsecured Protected Health Information, which the HITECH Act called for, took effect in September 2009. HHS said it reviewed the 120 public comments it received on the interim rule and developed a final rule, which it later withdrew, saying "this is a complex issue," in a statement July 28.

The breach notification interim final rule requires health providers and plans and their business partners to provide notification of a breach of unsecured sensitive data to individuals within 60 days and in cases involving more than 500 individuals to HHS and the media.

"The administration is committed to ensuring that individuals' health information is secured to the extent possible to avoid unauthorized uses and disclosures, and that individuals are appropriately notified when incidents do occur," HHS said in its announcement.

Lisa Gallagher, senior director for privacy and security at the Healthcare Information and Management Systems Society, said that it appears HHS wants to further consider its experience during the recent period of enforcement, frequent press attention bringing to light breaches of health data, and feedback from privacy advocacy groups, members of Congress, consumers and healthcare organizations.

"This hold gives HHS more time to "˜get it right' and, in the meantime, the Interim Final Rule remains in full force and effect," Gallagher said today.

Dr. Deborah Peel, founder and chairman of Patient Privacy Rights, a privacy advocacy group, said she and others opposed the "harm standard" as it was written in the interim final rule because it dramatically weakens the breach notification requirement.

The harm standard granted the businesses that experienced a breach of data security the discretion to decide whether patients are likely to be harmed by the disclosure. "Talk about letting the fox guard the hen house," she said in a statement July 30.

In addition to Peel's organization writing letters to HHS about the harm standard, six members of Congress last fall wrote HHS to "revise or revoke" the provision. HHS' withdrawal of the final rule "is a huge step in the right direction," Peel said.

The department said it plans to publish a final rule in the Federal Register "in the coming months," but did not provide any details of the timeframe.