The Food Marketing Institute (FMI) appreciates the opportunity to respond to the Department of Health and Human Services (HHS) request for comments on the proposed rule modifying the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule’s accounting for disclosure requirement under the Health Information Technology for Economic and Clinical Health Act (HITECH Act).

Full Comments

July 29, 2011 Submitted Electronically The Honorable Kathleen Sebelius Secretary of Health and Human Services United States Department of Health and Human Services 200 Independence Avenue, SW Washington, DC 20201 RE: HIPAA Privacy Rule Accounting of Disclosures Under the Health Information Technology for Economic 1 and Clinical Health Act; Proposed Rule RIN: 0991-AB62 Dear Secretary Sebelius: The Food Marketing Institute (FMI) appreciates the opportunity to respond to the Department of Health and Human Services (HHS) request for comments on the proposed rule modifying the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule’s accounting for disclosure requirement under the Health Information Technology for Economic and Clinical Health Act (HITECH Act). FMI is the national trade association that conducts programs in public affairs, food safety, research, education and industry relations on behalf of its 1,500 member companies – food retailers and wholesalers – in the United States and around the world. FMI’s members in the United States operate approximately 26,000 retail food stores and 14,000 pharmacies. Their combined annual sales volume of $680 billion represents three-quarters of all retail food store sales in the United States. FMI’s retail membership is composed of large multi-store chains, regional firms, and independent supermarkets. Our international membership includes 200 companies from more than 50 countries. FMI’s associate members include the supplier partners of its retail and wholesale members. I. Introduction The proposed rule modifying accounting for disclosures and adding the right of “access reports” for patients will impose very significant burdens on retail pharmacies. Ambiguity exists because the proposed rule does not clarify whether “access reports” are to include accesses only by humans or whether reporting of any electronic accesses is required even if no humans accessed, used or disclosed a patient’s personal 1 76 Fed. Reg. 31426 (May 31, 2011). FMI Comments RIN: 0991-AB62 June 26, 2011 Page 2 of 4 July 29, 2011 health information (PHI.) The intent of Congress was to protect PHI from unlawful access by living people. A broad interpretation of electronic access to include all computerized access would place enormous burdens on the industry and be virtually impossible to comply with. Submitted Electronically II. “Electronic Designated Record Set” Goes Beyond HITECH Act The Honorable Kathleen Sebelius Secretary of Health and Human Services Modifying the HIPAA Privacy Rule’s accounting requirement to include disclosures of PHI made through an United States Department of Health and Human Services “electronic designated record set” needlessly broadens HITECH Act’s requirement that accounting rules 200 Independence Avenue, SW apply only to those entities that use, maintain and disclose from an electronic health record (EHR), not any Washington, DC 20201 electronically stored PHI. HITECH Act requires accounting of disclosures only for EHRs, whereas the RE: HIPAA Privacy Rule Accounting of Disclosures Under the Health Information Technology for Economic proposed rule expands the Privacy Rule accounting requirements to include all uses and disclosures of PHI 1 and Clinical Health Act; Proposed Rule stored electronically. RIN: 0991-AB62 If the goal of HHS’s proposal is to improve the workability and effectiveness of the existing accounting rule, expanding the scope of the rule to include all electronic uses and disclosures pertaining to treatment, Dear Secretary Sebelius: payment and health care operations (TPO) is not the way to achieve it. Congress’ intent was to exclude accounting of disclosures for purposes of TPO because cost-benefit analysis showed accounting of such The Food Marketing Institute (FMI) appreciates the opportunity to respond to the Department of Health disclosures would be far too burdensome on covered entities; section 164.528 of the Privacy Rule explicitly and Human Services (HHS) request for comments on the proposed rule modifying the Health Insurance excludes disclosures for TPO purposes and section 13405(c) of HITECH Act refers to disclosures from EHRs Portability and Accountability Act (HIPAA) Privacy Rule’s accounting for disclosure requirement under the only rather than referring to PHI from designated record sets (DRS). Health Information Technology for Economic and Clinical Health Act (HITECH Act). Furthermore, accounting all electronic access to PHI would be an unreasonable request because much FMI is the national trade association that conducts programs in public affairs, food safety, research, access of PHI occurs though routine computer scans, data sifts and data sweeps, which are situations not education and industry relations on behalf of its 1,500 member companies – food retailers and wholesalers involving a living being accessing, using or disclosing data. It would be nonsensical for these disclosures to – in the United States and around the world. FMI’s members in the United States operate approximately be included in access reports. Patients would be provided with excessive and unhelpful information. 26,000 retail food stores and 14,000 pharmacies. Their combined annual sales volume of $680 billion HIPAA was intended to prevent illegal access of PHI by humans, and including accounting of all electronic represents three-quarters of all retail food store sales in the United States. FMI’s retail membership is access would go beyond HIPAA and HITECH Act. The proposed rule is inconsistent with the intent of composed of large multi-store chains, regional firms, and independent supermarkets. Our international Congress. membership includes 200 companies from more than 50 countries. FMI’s associate members include the supplier partners of its retail and wholesale members. III. Pharmacies Burdened by Expanded Accounting of Disclosures I. Introduction Broadening the Privacy Rule’s accounting of disclosure requirements would create expensive, time- consuming burdens for covered entities and their business associates while providing little or no benefit to The proposed rule modifying accounting for disclosures and adding the right of “access reports” for individuals. Not only would computer systems need to be changed because most pharmacies have not patients will impose very significant burdens on retail pharmacies. Ambiguity exists because the proposed employed EHR systems, but an expanded electronic system would need to be developed. Developing and rule does not clarify whether “access reports” are to include accesses only by humans or whether reporting implementing a new system would be extraordinarily expensive and time-consuming. of any electronic accesses is required even if no humans accessed, used or disclosed a patient’s personal Maintenance of access logs is required under current law, but the proposal adds the burden of maintaining 1an expensive computer system that turns raw data, including accountings of computer-only access of PHI, 76 Fed. Reg. 31426 (May 31, 2011). F FMMII CCoommmmeennttss RRIINN:: 00999911--AABB6622 JJuunnee 2266,, 22001111 PPaaggee 32 ooff 44 July 29, 2011 hinetaol tah s iunbfostramnattivioen a (cPcHesI.s) r Tehpeo rint tfeonr tp oaft iCeontnsg. r eFsusr twhaesr mtoo prero, etexcpta PnHdiIn fgro amcc uonulnatwinfgu lr aecqcueirses mbye nlitvsin tgo pinecolupdlee. aAl lb erloeacdtr ionnteicr pPrHeIt datisioclno souf reelse cwtroounldic b aec cseuspse trofl uinoculus daen da lcl oconmfupsiuntge rfoizre idn dacivciedsusa wlso buelcda pulsaec eth een aocrcmeossu sr eport wbuorudledn cso onnta tihne a icncdeussstersy b ayn cdo bmep vuirtteura slylys tiemmpso stshiabtl en etov ecro imnvpolylv wedit ha. human. The extra disclosures would Submitted Electronically have little to no value to patients who desire an access report. Moreover, an insignificant number of II. “Electronic Designated Record Set” Goes Beyond HITECH Act Trehqeu Heostnso hraavbele b Keaetnh lmeeand eS efobre laiuccs ounting of disclosures under the current rule and most patients want only Secretary of Health and Human Services prescription records, which the industry already provides. Modifying the HIPAA Privacy Rule’s accounting requirement to include disclosures of PHI made through an United States Department of Health and Human Services “electronic designated record set” needlessly broadens HITECH Act’s requirement that accounting rules 2B0e0ca Iunsdee ptheen dperonpceo sAavl eenliumei,n SaWte s the TPO exception, excessive work of tracking all disclosures will impose apply only to those entities that use, maintain and disclose from an electronic health record (EHR), not any Washington, DC 20201 enormous burdens on pharmacies. Under the current rule exempting TPO from accounting, pharmacies electronically stored PHI. HITECH Act requires accounting of disclosures only for EHRs, whereas the can easily send out refill reminder letters (a type of TPO disclosure.) In the United States, non-adherence RE: HIPAA Privacy Rule Accounting of Disclosures Under the Health Information Technology for Economic proposed rule expands the Privacy Rule accounting requirements to include all uses and disclosures of PHI to medication instructions and refills are a major problem; for example, only half of U.S. patients treated 1 and Clinical Health Act; Proposed Rule stored electronically. 2 for hypertension adhere to prescribed treatment. Patients similarly fail to adhere to medication regimens for other illnesses, many of which are communicable, and this creates a risk for public health. Refill RIN: 0991-AB62 If the goal of HHS’s proposal is to improve the workability and effectiveness of the existing accounting rule, reminders improve adherence and should not be deterred through the burdensome and inefficient expanding the scope of the rule to include all electronic uses and disclosures pertaining to treatment, pDreoapro Sseecdr ertualery. SUenbdeeliru tsh: e proposal, the expense of time and money to track and record such disclosures payment and health care operations (TPO) is not the way to achieve it. Congress’ intent was to exclude could lead to many members of the industry eliminating such programs. accounting of disclosures for purposes of TPO because cost-benefit analysis showed accounting of such The Food Marketing Institute (FMI) appreciates the opportunity to respond to the Department of Health disclosures would be far too burdensome on covered entities; section 164.528 of the Privacy Rule explicitly and Human Services (HHS) request for comments on the proposed rule modifying the Health Insurance The addition of disclosures made by business associates to patients’ right to an accounting of disclosures excludes disclosures for TPO purposes and section 13405(c) of HITECH Act refers to disclosures from EHRs fPuorrtthaebri liintyc raenads eAsc tchoeu nbtuarbdielinty o Anc Ft M(HI ImPAeAm) bPerirvsa. c Rye Rfiulll ea’ns da cscpoeucniatlitnyg p froorg draismclso saurere o rfeteqnu icroemndeunctt eudn dbeyr the only rather than referring to PHI from designated record sets (DRS). Health Information Technology for Economic and Clinical Health Act (HITECH Act). business associates of pharmacies, so on top of needing to account for disclosures made by pharmacists, pharmacy technicians and pharmacy clerks, any disclosure of PHI made by business associates is onerously Furthermore, accounting all electronic access to PHI would be an unreasonable request because much FMI is the national trade association that conducts programs in public affairs, food safety, research, required as well. Increasing the administrative burden and costs for retail pharmacies to provide an access of PHI occurs though routine computer scans, data sifts and data sweeps, which are situations not education and industry relations on behalf of its 1,500 member companies – food retailers and wholesalers accounting of use and disclosure of PHI, even by business associates, will negatively impact valuable involving a living being accessing, using or disclosing data. It would be nonsensical for these disclosures to – in the United States and around the world. FMI’s members in the United States operate approximately programs and may lead to their elimination. be included in access reports. Patients would be provided with excessive and unhelpful information. 26,000 retail food stores and 14,000 pharmacies. Their combined annual sales volume of $680 billion HIPAA was intended to prevent illegal access of PHI by humans, and including accounting of all electronic Irte ipsr aelsseon itms pthorretaen-qt utaor nteortse o tfh aaltl irnedtaivili dfouoalds satroer eal rseaaledsy i np rtohvei dUendi twedit hS tnaotetisc.e FaMboI’us tr ehtoawil mpheamrmbearcsiehsip m isa y access would go beyond HIPAA and HITECH Act. The proposed rule is inconsistent with the intent of schoamrep oPsHeId b oyf mlaergmeb merusl toi-fs tthoere in cdhuasintrsy, .r eBgeiocanuasl efi rinmdsiv, iadnuda lisn dheapvee nkdneonwt lseudpgeer omf aproksestisb. l eO duirs cinlotesurnrea taionnda ol nly Congress. am meminboerritsyh oipf itnhcelumd echs o2o0s0e cs otmo rpeaqnuieess tf raonm a cmcooruen ttihnagn o 5f0 d cisoculonsturireess. u FnMdeI’rs tahseso ccuirarteen mt reumleb, etrhse irnec ilsu dneo the spurepspsliinegr pnaeretdn etros eoxfp iatsn rde tthaeil arunlde wanhyo fleusrathlee rm. e mbers. III. Pharmacies Burdened by Expanded Accounting of Disclosures I. Introduction IV. Workable Aspects of Proposed Rule Broadening the Privacy Rule’s accounting of disclosure requirements would create expensive, time- consuming burdens for covered entities and their business associates while providing little or no benefit to TWhee bperoliepvoes etdh artu tleh em modaiifny ipnrgo vaicscioonusn toinf gth feo rp droispcolosseudr reusl ea npdla acded ainng e txhcee srsigivhet bouf r“daecnce osns rreeptaoirl tpsh” afromr acies individuals. Not only would computer systems need to be changed because most pharmacies have not patients will impose very significant burdens on retail pharmacies. Ambiguity exists because the proposed and should be rewritten. That said, there are also aspects of the proposed rule that ease the burden on employed EHR systems, but an expanded electronic system would need to be developed. Developing and rcuolvee dreode se nnotitt icelsa rainfyd wbhuesitnheesrs “ aascscoecsisa treesp.o Rrtesq” uairrein tgo a icnccoluudnet iancgc feosrs e3s y oenalrys brayt hhuemr tahnasn o 6r, walhloewthinegr rae gpeonrteirnagl implementing a new system would be extraordinarily expensive and time-consuming. of any electronic accesses is required even if no humans accessed, used or disclosed a patient’s personal range of dates when there are multiple disclosures to a single recipient for a single purpose and allowing Maintenance of access logs is required under current law, but the proposal adds the burden of maintaining 2 Adherence to Long-term Therapies – Evidence for Action, World Health Organization, 20 Avenue Appia, 1211 Geneva 1an expensive computer system that turns raw data, including accountings of computer-only access of PHI, 2 77,6 S Fweidtz. eRrelagn. d3 1(2402063 ()M. IaSyB N31 9, 22 041 115).4 599 2 (NLM classification: W 85). F FFMMMIII CCCooommmmmmeeennntttsss RRRIIINNN::: 000999999111---AAABBB666222 JJJuuunnneee 222666,,, 222000111111 PPPaaagggeee 243 ooofff 444 July 29, 2011 aihnpetpaolr taoh xs iiunmbfaosttriamonnat tioviofe n aa c(ccPceHessIs.s) d r Taehtpeeo wrinth tfeeonnr tpi toa ifts i Ceuonntnksgn. ro eFwsusrn tw hmaeasr mkteoos pr terho, eet expcprtoa PcneHdsiIns f grleo asmcsc ouonnuelnartwoinufgus .lr aeRcqecudeiursesc mibnyge nltihtvsien t gtoi m pineeco lupdlee. aAple lb rerioloedac dtfro ionrn taeincr pParHcecIt odautisnioctlnion soguf a reenlsed c watcroocuenldsics b areec cpseuosprste ttroofl ui1no cyuleusa dare nw dao lclu oclodnm fcuepsriunttagei nrfoilzyre cidnr edaacivtceied sluesa swlss o ebuxeplcdea pnulssaeec aethn eedn aotrcrocmueobssule sr efopro rt wbreuotraudilled pn chso aonrnmta taihnce iae icnsc.d eussstersy b ayn cdo bmep vuirtteura slylys tiemmpso stshiabtl en etov ecro imnvpolylv wedit ha. human. The extra disclosures would Submitted Electronically have little to no value to patients who desire an access report. Moreover, an insignificant number of VII.. C“Eolnecclturosinoinc Designated Record Set” Goes Beyond HITECH Act Trehqeu Heostnso hraavbele b Keaetnh lmeeand eS efobre laiuccs ounting of disclosures under the current rule and most patients want only Secretary of Health and Human Services prescription records, which the industry already provides. MExocedsifsyivineg b tuhred HenIPsA aAre P prilvaacceyd Rounl et’hse a icncdouusnttriyn ug nrdeeqru itrheem pernotp toos eindc rluudlee mdiosdcliofysiunrge Hs oIPfA PAH’sI mPraivdaec tyh Rrouuleg.h T ahne United States Department of Health and Human Services “perolepcotrsoanl wic idll erseiqguniartee adc rceecsosr rde pseotr”t sn teoe daclecsosulyn tb rfooar duesenss aHnITdE dCiHsc Alocstu’sr eres qmuairdeem beyn ct otmhaptu atcecros,u envtienng trhuoleusg h 2B0e0ca Iunsdee ptheen dperonpceo sAavl eenliumei,n SaWte s the TPO exception, excessive work of tracking all disclosures will impose athpeprley wonalsy ntoo thhuomsea ne natcictieesss .t h Aactc uesses, lmogasi natraei na larenadd dyi srcelqouseir efrdo bmy alanw e,l eacntdro tnhiecs hee loalgtsh irneccluodrde (aEcHcoRu),n ntointg a onfy Washington, DC 20201 enormous burdens on pharmacies. Under the current rule exempting TPO from accounting, pharmacies deliesccltorsounriecas lolyf shtuomreadn P aHcIc. e HssI ToEnClyH; Athcet rreefqoureir,e Cs oancgcoreusnst hinags oshf odwiscnl oitssu irnetse onnt lfyo rfo dri sEcHloRssu, rweh oefr heuams tahne access can easily send out refill reminder letters (a type of TPO disclosure.) In the United States, non-adherence RE: HIPAA Privacy Rule Accounting of Disclosures Under the Health Information Technology for Economic oprnolyp oansedd n routl efo erx wpahnedns a t hcoem Prpivuatecyr, Rwuilteh oauccto huunmtianng vreieqwuiinregm, heanst sa ctcoe isnsceludd PeH aI ltl hursoeusg ahn ad ddaistcal ososurtr eosr osof mPHeI to medication instructions and refills are a major problem; for example, only half of U.S. patients treated 1 and Clinical Health Act; Proposed Rule ssitmorieladr efulenccttrioonni.c aPlalyt.i ents likely would not understand nor value an access report that includes each and 2 for hypertension adhere to prescribed treatment. Patients similarly fail to adhere to medication regimens every access of PHI. for other illnesses, many of which are communicable, and this creates a risk for public health. Refill RIN: 0991-AB62 If the goal of HHS’s proposal is to improve the workability and effectiveness of the existing accounting rule, reminders improve adherence and should not be deterred through the burdensome and inefficient FeMxpIa gnrdeiantgly t haep psrceocpiaet oefs tHhHe Sr’usl eco tnos iindcelruadteio anl lo ef ltehcetrsoen cioc musmese natnsd. dPilsecalosesu croenst paectr tmaien iantg to treatment, pDreoapro Sseecdr ertualery. SUenbdeeliru tsh: e proposal, the expense of time and money to track and record such disclosures eplaieybmeernmt aann@d fhmeai.oltrhg c oarr e2 0o2p-e2r2a0ti-o0n6s1 4(T iPf Oyo) uis hnaovte t haen yw qauye tsot iaocnhsi.e ve it. Congress’ intent was to exclude could lead to many members of the industry eliminating such programs. accounting of disclosures for purposes of TPO because cost-benefit analysis showed accounting of such The Food Marketing Institute (FMI) appreciates the opportunity to respond to the Department of Health disclosures would be far too burdensome on covered entities; section 164.528 of the Privacy Rule explicitly and Human Services (HHS) request for comments on the proposed rule modifying the Health Insurance The addition of disclosures made by business associates to patients’ right to an accounting of disclosures excludes disclosures for TPO purposes and section 13405(c) of HITECH Act refers to disclosures from EHRs fSPuionrrtctheaerberi lliiynt,yc raenads eAsc tchoeu nbtuarbdielinty o Anc Ft M(HI ImPAeAm) bPerirvsa. c Rye Rfiulll ea’ns da cscpoeucniatlitnyg p froorg draismclso saurere o rfeteqnu icroemndeunctt eudn dbeyr the only rather than referring to PHI from designated record sets (DRS). Health Information Technology for Economic and Clinical Health Act (HITECH Act). business associates of pharmacies, so on top of needing to account for disclosures made by pharmacists, pharmacy technicians and pharmacy clerks, any disclosure of PHI made by business associates is onerously Furthermore, accounting all electronic access to PHI would be an unreasonable request because much FMI is the national trade association that conducts programs in public affairs, food safety, research, required as well. Increasing the administrative burden and costs for retail pharmacies to provide an access of PHI occurs though routine computer scans, data sifts and data sweeps, which are situations not education and industry relations on behalf of its 1,500 member companies – food retailers and wholesalers accounting of use and disclosure of PHI, even by business associates, will negatively impact valuable involving a living being accessing, using or disclosing data. It would be nonsensical for these disclosures to – in the United States and around the world. FMI’s members in the United States operate approximately programs and may lead to their elimination. be included in access reports. Patients would be provided with excessive and unhelpful information. 26,000 retail food stores and 14,000 pharmacies. Their combined annual sales volume of $680 billion HIPAA was intended to prevent illegal access of PHI by humans, and including accounting of all electronic Irte ipsr aelsseon itms pthorretaen-qt utaor nteortse o tfh aaltl irnedtaivili dfouoalds satroer eal rseaaledsy i np rtohvei dUendi twedit hS tnaotetisc.e FaMboI’us tr ehtoawil mpheamrmbearcsiehsip m isa y access would go beyond HIPAA and HITECH Act. The proposed rule is inconsistent with the intent of schoamrep oPsHeId b oyf mlaergmeb merusl toi-fs tthoere in cdhuasintrsy, .r eBgeiocanuasl efi rinmdsiv, iadnuda lisn dheapvee nkdneonwt lseudpgeer omf aproksestisb. l eO duirs cinlotesurnrea taionnda ol nly Erik R. Lieberman Congress. am meminboerritsyh oipf itnhcelumd echs o2o0s0e cs otmo rpeaqnuieess tf raonm a cmcooruen ttihnagn o 5f0 d cisoculonsturireess. u FnMdeI’rs tahseso ccuirarteen mt reumleb, etrhse irnec ilsu dneo the Regulatory Counsel spurepspsliinegr pnaeretdn etros eoxfp iatsn rde tthaeil arunlde wanhyo fleusrathlee rm. e mbers. III. Pharmacies Burdened by Expanded Accounting of Disclosures I. Introduction IV. Workable Aspects of Proposed Rule Broadening the Privacy Rule’s accounting of disclosure requirements would create expensive, time- consuming burdens for covered entities and their business associates while providing little or no benefit to TWhee bperoliepvoes etdh artu tleh em modaiifny ipnrgo vaicscioonusn toinf gth feo rp droispcolosseudr reusl ea npdla acded ainng e txhcee srsigivhet bouf r“daecnce osns rreeptaoirl tpsh” afromr acies individuals. Not only would computer systems need to be changed because most pharmacies have not patients will impose very significant burdens on retail pharmacies. Ambiguity exists because the proposed and should be rewritten. That said, there are also aspects of the proposed rule that ease the burden on employed EHR systems, but an expanded electronic system would need to be developed. Developing and rcuolvee dreode se nnotitt icelsa rainfyd wbhuesitnheesrs “ aascscoecsisa treesp.o Rrtesq” uairrein tgo a icnccoluudnet iancgc feosrs e3s y oenalrys brayt hhuemr tahnasn o 6r, walhloewthinegr rae gpeonrteirnagl implementing a new system would be extraordinarily expensive and time-consuming. of any electronic accesses is required even if no humans accessed, used or disclosed a patient’s personal range of dates when there are multiple disclosures to a single recipient for a single purpose and allowing Maintenance of access logs is required under current law, but the proposal adds the burden of maintaining 2 Adherence to Long-term Therapies – Evidence for Action, World Health Organization, 20 Avenue Appia, 1211 Geneva 1an expensive computer system that turns raw data, including accountings of computer-only access of PHI, 2 77,6 S Fweidtz. eRrelagn. d3 1(2402063 ()M. IaSyB N31 9, 22 041 115).4 599 2 (NLM classification: W 85).