All medical business associates to fall under HIPAA

Expect this "business associates" language, which reaches to subcontractors, billing companies, and anyone engaged in patient safety, to become a major bone of contention as comments come in over the next two months.

The new rules are described on a health privacy Web site. They were announced jointly by NCHIT David Blumenthal and Georgina Verdugo, director of the Office for Civil Rights at HHS. Both emphasized the increased patient rights to records in the proposal.

Privacy advocates seem overjoyed about the proposal, and partly for that reason groups like HIMSS can be expected to take a long look before signing-on. HIPAA and its process requirements were already being blamed for the refusal of many practices to automate, and now those rules cover everyone who might touch any part of a patient record.

Some of the coming pushback can be seen in this Reuters story on the new rules, which emphasizes the "heavy fines" that might accrue to billing companies, customer service contractors, and others which would now total $1.5 million a year.

AHIMA, which represent the group once known as records librarians, sent out a press release approving the proposal. Its members would presumably become gatekeepers for the new rules, and their influence would increase.

Insurers and drug makers will have to be very careful in addressing the new rules, which greatly limit what patient data they access for marketing purposes. Maybe they'll act like the car dealers in the FinReg bill and win themselves a special carve-out.