CHIME Sounds Alarm on Restricting Patient Authorization Checks for Third-Party Apps
In a pressing appeal to federal regulators, a coalition of healthcare organizations has voiced significant concerns regarding potential modifications to the HIPAA Privacy Rule. They caution that these changes could hinder healthcare providers from verifying whether patients have granted authorization for third-party applications to access sensitive medical information. This warning comes from the College of Healthcare Information Management Executives (CHIME) and 17 other healthcare entities in a letter addressed to U.S. Department of Health and Human Services Secretary Robert F. Kennedy Jr. on November 10.
The concerns center on the potential for increased privacy and security risks stemming from these proposed changes, which could lead to providers facing civil liabilities and regulatory scrutiny. CHIME articulates that the prospective final HIPAA Privacy Rule may include regulations that prevent healthcare providers from independently verifying patient authorization for third-party apps requesting protected health information (PHI). Such a move could disallow genuine confirmation of whether patients have indeed authorized their medical records to be accessed, exacerbating existing vulnerabilities in confidentiality.
In addition to CHIME, other notable organizations signing the letter include well-regarded institutions such as AdventHealth, Cleveland Clinic, and MedStar Health, among others. Together, these healthcare entities aim to alert officials that limiting providers’ verification capabilities could compromise patient safety and confidentiality.
Historically, this discussion traces back to 2021 during the waning days of the Trump administration when HHS’s Office for Civil Rights (OCR) proposed an update to the HIPAA Privacy Rule. This proposal sought to enhance care coordination, streamline access to health information, and reduce regulatory burdens. However, the initiative stalled under the Biden administration and remains unfinalized as HHS prepares to issue a concluding rule by year’s end.
Reports suggest that current officials from the Trump administration aim to enact changes that diverge significantly from the earlier proposals made in 2021. Among these changes lies the alarming provision that would forbid providers from independently confirming whether patients have permitted third-party applications to acquire their PHI. CHIME emphasizes that such a categorical prohibition would extend beyond previous proposals and could severely expose healthcare providers to legal liabilities and heightened privacy risks.
Attorney Iliana Peters of Polsinelli underscores the severity of these changes, citing personal experiences where requests for PHI from third parties were often fraudulent or unknown to patients. Thus, she reiterates the importance of maintaining strict HIPAA Privacy and Security Rule requirements to protect sensitive patient information.
CHIME’s coalition warns that the HHS might mistakenly accept certain identity verification credentials as adequate for allowing applications to access patient information without permitting providers to check the extent or authenticity of patient authorization. They reference concerns about the implications of utilizing Identity Assurance Level 2 (IAL2) credentials, stating that while they may confirm an individual’s identity, these credentials fail to ensure that the individual is correctly linked to the appropriate medical records or that the authorization allowing third-party access is valid.
Moreover, the organizations express worry that treating IAL2 credentials as sufficient verification while restricting providers’ ability to confirm patient authorization could introduce unforeseen limitations not considered in the original proposed rule. They argue that identity proofing, patient matching, and authorization verification are distinct yet interconnected processes that should not be simplified into a singular credentialing step, as doing so could escalate privacy and security risks for patients.
CHIME advocates for clear federal guidance that differentiates between unreasonable verification practices and legitimate safeguards against unauthorized disclosures, yet insists it should not eliminate critical protective measures.
The potential legal ramifications of the proposed restrictions are particularly concerning. CHIME argues that any prohibitions on reasonable authorization checks could violate the federal Administrative Procedure Act (APA), which mandates that agencies must furnish adequate notice for regulatory changes and allow for meaningful public commentary. Under the APA’s doctrine of "logical outgrowth," final regulations may diverge from proposed rules only if affected parties could have anticipated such changes and had the opportunity to express their views.
Furthermore, CHIME highlights that the original proposal did not convey any intent that HHS might prohibit healthcare providers from independently verifying patient authorization, leading to a lack of proper opportunity for feedback regarding the implications of such restrictions. They call for the OCR to conduct additional notice-and-comment rulemaking if any substantial changes are anticipated from the courses outlined in the earlier proposal.
In their statement, specific representatives from CHIME emphasize that while healthcare providers support initiatives to improve patient access to health information, it is crucial that access and privacy are not positioned as opposing interests. Chelsea Arnone, CHIME’s senior director of federal affairs, articulates that providers must retain reasonable methods to confirm patient authorization for third-party applications seeking sensitive health information. She stresses the need for distinct functions of identity proofing, patient matching, and authority verification to avoid creating significant privacy and security vulnerabilities.
Simultaneously, healthcare organizations worry that limiting providers’ safeguard capabilities while placing regulatory liabilities on them in case of data breaches would be counterproductive. Privacy experts further corroborate these concerns, commending CHIME’s proactive approach and advocating for reevaluation of the proposed changes to better reflect the current landscape of patient data protection.
In response to these multifaceted issues, U.S. Senator Bill Cassidy has introduced the Health Information Privacy Reform Act, designed to create a federal framework governing health data outside HIPAA, highlighting an evolving legislative response to the challenges posed by the current framework surrounding patient data privacy.
In conclusion, as the discussion surrounding potential changes to HIPAA’s Privacy Rule unfolds, healthcare organizations remain vigilant, advocating for policies that balance the essential access to health information with robust protections against unauthorized disclosures to ensure patient privacy and security are not undermined.