Info Security reports on the Office of Management and Budget's review of a Health and Human Services (HHS) proposal to extend the HIPAA privacy rule's requirements to "include disclosures during the previous three years for treatment, payment and healthcare operations (TPO) if a healthcare provider uses an electronic health records (EHR) system." The Medical Group Management Association is raising concerns about the plan, writing to HHS that the stipulation "that the TPO accounting is only required for those physician practices that have adopted an EHR suggests that the government believes TPO disclosures would be collected and stored on this one clinical system. This is simply not the case."
Full Story