Providers in every state must meet HIPAA standards, but alas, that may not be all in some states, which are permitted to institute stiffer requirements than the feds. Such is the case in Texas, where a new state privacy law has gone into effect which asks a lot more of physicians and some other providers.
Texas has toughened up requirements in several areas, including the following:
* Covered entities: HIPAA offers a fairly specific definition of covered entities, but the Texas law takes things much further, extending the rule to cover a wide range of people who handle PHI. This may include business associates, healthcare payers, government units, schools, facilities, providers, researchers and physicians, reports John Wisniewski, CEO of the Bexar County Medical Society.
* EMR data requests: Requests for electronic medical records by Texans must be fulfilled within 15 days of a written query. This new rule, which brings EMR requests up to the existing level for paper records, is tougher than HIPAA’s 30 day requirement.
* Stricter training: The new law imposes tougher training requirements regarding privacy issues — including customized training regarding maintenance and protection of electronic PHI — and penalties for violations are ramped up under the new law. Covered entities must set deadlines for the completion of such training, and maintain records of completing such training, which is required every two years.
* Any PHI breach must be reported: Any entity which experiences a breach in PHI must report it to individuals, including any business handling such information, not just covered entities as defined by the new statute.
I understand that providers must find it frustrating to have addition requirements slapped on them. However, none of these strike me as insane, though the broadening of covered entities to include such a large group could lead to trouble, perhaps. What do you think?
