Court vacates certain HIPAA health record access requirements

A federal court last week voided certain provisions in a 2013 rule modifying the HIPAA privacy, security and enforcement rules under the Health Information Technology for Economic and Clinical Health Act and Genetic Information Nondiscrimination Act, the Department of Health and Human Services’ Office for Civil Rights announced today. In a case challenging provisions that cover an individual’s access to protected health information, the court vacated the “third-party directive” within the individual right of access “insofar as it expands the HITECH Act’s third-party directive beyond requests for a copy of an electronic health record with respect to [protected health information] of an individual … in an electronic format,” OCR said. In addition, the fee limitation set forth in those provisions will apply only to an individual’s request for access to their own records, not to an individual’s request to transmit records to a third party, the agency said.