Earlier this month, the Office for Civil Rights ("OCR") released a number of guidance documents covering various topics addressed in the Omnibus HIPAA final rule ("Final Rule"). While the releases by OCR do in fact help providers navigate complicated HIPAA issues, they also serve as an obvious reminder that the September 23 compliance date for the Final Rule has passed.
On September 13, OCR released a very helpful template Notice of Privacy Practices ("NPP"). The Final Rule requires covered entities to revise their NPPs. For large organizations, the template NPP may be of limited use. For smaller providers and those still needing to comply with the Final Rule, however, the template sets an industry standard that can serve as a starting point for creating an NPP or a useful tool for reviewing NPPs currently in use.
Shortly after OCR released the template NPP, it released a statement delaying enforcement of the NPP requirement for certain CLIA-certified and CLIA-exempt labs.
OCR finished the week by releasing documents addressing:
The Final Rule changed the way protected health information ("PHI") is used and disclosed in all of these situations. The guidance documents listed above provide practical insight into the manner in which OCR expects covered entities to handle PHI in these circumstances. Each guidance document includes responses to frequently asked questions, which are extremely helpful.
OCR's guidance documents will assist in achieving compliance. The template documents, however, will need to be carefully modified to appropriately address an organization's unique circumstances.
Although OCR's push came right before the compliance finish line, covered entities and business associates will be "running the HIPAA race" for a long time to come. OCR'S guidance documents will be quite helpful as strides are taken to ensure compliance not only for today, but for tomorrow as well.