The federal Department of Health and Human Services issued its final omnibus, revised privacy and security regulations under the Health Insurance Portability and Accountability Act (“HIPAA”) and Health Information Technology for Economic and Clinical Health Act (“HITECH”) and Genetic Information Nondiscrimination Act (“GINA”), which significantly affect the health care industry. The new rule, like its predecessor, does not apply to participants in the life settlement industry (life settlement brokers and providers, life expectancy companies and investors) because they are not “covered entities” (health care providers, health plans or health care clearinghouses) or “business associates” of covered entities. Nevertheless, because participants in the life settlement industry regularly obtain medical records, or what HIPAA terms “protected health information,” about insureds in connection with life settlement transactions and servicing and management of secondary life insurance policy investments, the life settlement industry should generally understand the new rule, adopted January 18, 2013. Some key changes and status quos in the new rule are highlighted below.
Business Associates now have direct liability for their compliance with the HIPAA privacy and security rules.
Penalties for Violations
The enforcement provisions of the new rule create a tiered civil penalty structure, and the maximum penalty is $1.5 million for each violation.
Authorizations for Disclosure of Protected Health Information
While the new rule has revised certain restrictions related to authorizations for the purpose of using protected health information for marketing, there are no changes to the core requirements for a valid HIPAA authorization. Thus, the life settlement industry may continue to use its current form of a HIPAA authorization for obtaining medical records of insureds.
Electronic Form of Protected Health Information
The new rule defines electronic media and allows patients who exercise their right to access their medical records to request delivery of them in electronic format if it is readily producible by the covered entity, or, if not, in a readable electronic form and format as agreed to by the covered entity and the individual. While this is a step in the right direction for users of medical records, it is not clear whether this change may benefit the life settlement industry, which has sought to streamline its use of insureds’ medical information through use of electronic records.
Electronic media means:
“1) Electronic storage material on which data is or may be recorded electronically, including, for example, devices in computers (hard drives) and any removable/transportable digital memory medium, such as magnetic tape or disk, optical disk, or digital memory card;
2) Transmission media used to exchange information already in electronic storage media. Transmission media include, for example, the Internet, extranet or intranet, leased lines, dial-up lines, private networks, and the physical movement of removable/transportable electronic storage media. Certain transmissions, including of paper, via facsimile, and of voice, via telephone, are not considered to be transmissions via electronic media if the information being exchanged did not exist in electronic form immediately before the transmission.”
A covered entity must provide an individual with access to his or her protected health information in the format requested by the individual, if it is readily producible in such format; or, if not, in a hard copy form or such other form as agreed to by the covered entity and the individual. However, if protected health information is maintained in a designated record set electronically and an individual requests an electronic copy of such information, a covered entity must provide the individual with access to the protected health information in the electronic format requested by the individual, if it is readily producible in such form.
Additionally, if an individual’s request for access to his or her protected health information directs a covered entity to transmit a copy of protected health information directly to another person designated by the individual, the covered entity must provide the copy to that designated person.
Note that an individual’s right to access his or her protected health information is not the same as an authorization by an individual to allow third parties, such as ife settlement brokers and providers, life expectancy companies and investors to obtain copies of an individual’s medical records. The new rule does not require that a covered entity provide medical records in electronic format in response to an authorization for disclosure of protected health information. While a personal representative of an individual has the authority to exercise the right of access on behalf of the individual, a personal representative is defined to mean a person who under applicable state law has authority to act on behalf of an individual in making decisions related to health care, such as a health care power of attorney, which would not normally include life settlement brokers and providers, life expectancy companies or and investors. Nevertheless, under the HITECH, an individual has the right to direct a covered entity to transmit a copy of his or her protected health information directly to an entity or person designated by the individual, provided that any such choice is clear, conspicuous and specific. Therefore, there may be an opportunity for the life settlement industry to develop and use forms by which insureds exercise their right to access their PHI maintained by health care providers with an instruction to deliver such information in electronic form to life settlement brokers and providers, life expectancy companies and investors, which would reduce or eliminate the need for reliance on HIPAA authorizations resulting in the delivery of paper-based documents.
So, while the new rule imposes many new requirements on the health care industry, there is no direct and very little indirect impact on the life settlement industry.