Governance & Risk Management , Privacy , Standards, Regulations & Compliance
House Passes Revamped 21st Century Cures BillLegislation No Longer Includes Proposal to Change HIPAA Privacy Rule
The U.S. House of Representatives has approved a heavily reworked version of the 21st Century Cures bill that was stripped of controversial proposed changes to HIPAA. The measure, which would provide $6.3 billion for various efforts to advance medical innovation and is backed by the White House, will proceed to the Senate next week (see Revised 21st Century Cures Bill Drops HIPAA Privacy Changes).
The dropped provision had called for significant changes to the HIPAA Privacy Rule that would have allowed patients' protected health information to be used and disclosed for research purposes without their authorization under certain circumstances.
See Also: Live Webinar | Education Cybersecurity Best Practices: Devices, Ransomware, Budgets and Resources
The legislation, which passed the House on a 392 to 26 vote on Nov 30, is designed, in part, to speed up approval of new medications and medical devices by the Food and Drug Administration. As revised, the bill also now supports the president's Precision Medicine Initiative and Vice President Joe Biden's Cancer Moonshot cause.
The bill also provides funding and other support for advancing research and treatment for diseases such as Alzheimer's and cancer, as well as promoting mental health reform and help for dealing with opioid drug addiction.
Privacy, Security Provisions
Privacy and security provisions in the legislation include:
- Potential civil monetary penalties for organizations that participate in intentional and inappropriate information blocking - preventing or materially discouraging access, exchange or use of electronic health information as permitted by law;
- Improving the sharing of mental health data, including requiring the Department of Health and Human Services' Office for Civil Rights to issue new guidance related to the disclosure of mental health and substance abuse protected health information under HIPAA;
- Requiring that the General Accountability Office study the issue of matching all patient data obtained from various sources, such as through health information exchange, to the correct individual to help ensure appropriate treatment decisions are made.
The bipartisan legislation has been in the works for more than three years, championed by lead House sponsors, Rep. Fred Upton, R-Mich., chairman of the Energy and House Committee; and Rep. Diana DeGette, D-Colo. "This legislation breaks down regulatory barriers and expedites the approvals for drugs and devices coupled with billions for more research," Upton said during House debate on the bill prior to the vote.
The Senate Health Education Labor and Pensions Committee had previously passed 19 bills as part of its companion Innovation package, and most of those elements are now reflected in the latest version of the 21st Century Cures bill.
The version of the bill passed by the House last year allotted nearly $9 billion in funding to the National Institutes of Health over five years. However, the latest bill reduces NIH funding to about $4.77 billion over 10 years, and that funding would also need to be authorized each year by Congress - one of the changes to the bill not supported by some Democrat legislators.
"I cannot support this bill. ... This is 'maybe' money" for NIH research funding, said Rep. Lloyd Doggett, D-Texas, during a debate prior to the vote.
The bill "delivers hope to millions of Americans suffering from incurable diseases," Rep. Michael Burgess, R-Texas, argued. "But not everyone is getting everything they wanted."
Burgess noted he was pleased that the legislation also includes provisions promoting health IT interoperability - which helps facilitate secure information exchange - to help "taxpayers get a return" on the billions of dollars invested in the HITECH Act financial incentive program for electronic health records.
"Health IT is woven into every piece of the bill," notes Tom Leary, vice president of government relations at the Healthcare Information and Management Systems Society. "Therefore, cybersecurity is going to be even that much more important for the healthcare community. Enhanced innovation within healthcare, as it ties to the 21st Century Cure legislation ... all of that [depends on health IT]."