As a result of recent legislation, Texas physicians will soon face privacy requirements that are more stringent than HIPAA. In 2011, the 82nd Texas Legislature passed House Bill 300 (HB300) which amends several Texas privacy statutes. The most significant changes are to the Texas Health & Safety Code Section 181 (sometimes referred to as the Texas Medical Records Privacy Act) and to the Texas Business & Commerce Code Section 521 (the Texas Identity Theft Enforcement & Protection Act). These amendments increase the protections of electronic protected health information (PHI) beyond those found in HIPAA. The new requirements found in HB300 take effect September 1, 2012. Beginning September 1, 2012, physicians must not only comply with federal privacy laws but also with the newly amended Texas privacy laws.
Below are some case examples that describe how the new Texas privacy laws will affect physicians.
Many breaches of protected health information (PHI) like this can be avoided if employees understand privacy policies and remain highly attentive to PHI. In Texas, HB 300 protects not only PHI as defined by HIPAA, but also "sensitive personal information (SPI)" as defined by the Texas Identity Theft Protection Act. HB 300 requires all new employees who will encounter PHI or SPI to undergo privacy training within 60 days of hiring, and training must be repeated at least once every two years. Training is to be tailored to the employee's specific responsibilities and types of contact with PHI. The practice must maintain a log with employee signatures verifying their attendance. Physicians can prepare for the new requirements by updating their employee training policies and privacy education materials.
This case describes a circumstance where state and federal privacy laws diverge and the more protective law prevails. Texas laws are more protective of a patient's right to access his or her electronic health records (EHRs) than HIPAA. HB 300 mandates physicians who use EHRs to provide patients the requested record in electronic form not later than 15 business days after receiving a written request, unless there is an allowable exception. HIPAA allows 30 days. The EHR may be provided in another format if agreed upon by the patient in advance or if the physician's EHR is incapable of producing an electronic copy. To comply with HB 300, physicians should update their Notice of Privacy Practices and revise policies on patient access to their EHR.
encryption of PHI on BA's mobile devices, when BA exchanges PHI online and other circumstances where PHI is at high risk.
$1.5 million if a "pattern of practice" found.
Physicians may wish to consult with an attorney or the TMLT Risk Management Department to find out how to further align their practices with HB 300. Physicians should also consider purchasing cyber liability insurance (currently available at no additional cost with all TMLT policies at limits of $50,000) and consulting with their Regional Extension Center about assistance with security risk analysis and management.
Matt Murray, MD, CPHIMS, is a pediatric emergency medicine physician and health information technology (IT) advocate. He currently practices medicine at the Texas Christian University Brown Lupton Health Center and is active in local and statewide health IT initiatives. He can be reached at matt.murray59@gmail.com.