Experts are reacting to the Health and Humans Services' Office for Civil Rights proposal to allow healthcare consumers to request reports detailing who has accessed their health records. GovInfoSecurity reports that healthcare privacy expert Kirk Nahra, CIPP, says the rule is "fundamentally inconsistent with the normally very reasonable approach regulators have taken with most of these rules." He and others are recommending that providers write to regulators explaining the difficulty of complying, especially since many providers don't have the ability to aggregate data from their multiple information systems. But one security specialist says, if they don't, they should, adding, "The notice of proposed rulemaking assumes that...covered entities and certain business associates already have access or audit logs showing record-level access."
Full Story