Skip to Main Content

While many people were paying attention to drug pricing, a proposal to update the Health Insurance Portability and Accountability Act (HIPAA) flew largely under the radar. But if this proposal — or others like it — were to be implemented, they would reach farther than any proposal to lower drug prices to create better, more personalized health care at lower cost.

The Department of Health and Human Services published the Request for Information on Modifying HIPAA Rules to Improve Coordinated Care in December, seeking input on ways to modify HIPAA that would remove regulations standing in the way of coordinated or value-based care. The well-reported request for feedback focused on three key proposals:


  • encourage HIPAA-covered entities to disclose protected health information to other covered entities if done in the interest of care coordination
  • treat medical claims intermediaries as covered entities rather than business associates
  • encourage covered entities to share protected health information with family members of opioid- or substance-abuse patients to support their recovery

The devil, as always, is in the details, and I’d like to focus on one of them — disclosing protected health information — to illustrate how ideas like those in the request for information could help create a system that supports coordinated care.

As HIPAA stands today, the extent to which covered entities can or cannot disclose protected health information to social services or community-based support programs in order to coordinate patient care is unclear. This lack of clarity can stand in the way of health care organizations connecting patients with community-based resources that could help them more proactively manage their health. Such resources include mental health services, secure housing support, counseling for substance abuse or nutrition, injury and violence prevention services, and more.

HHS’ Office for Civil Rights, which oversees HIPAA, proposes changing the privacy rule to clarify when providers can disclose protected health information to social and community-based organizations with the aim of coordinating care.


Consider this example: An elderly man whose wife recently died and who lacks a nearby support network appears to his care provider to be suffering from loneliness. That puts him at 45 percent greater risk for early death and 64 percent greater risk for developing dementia. As the privacy rule now stands, while the man’s health care providers can of course give him information on community organizations he can leverage, they may be hesitant to flag their patient’s needs to those organizations because of the unclear HIPAA parameters around doing so. This can eliminate the potential for these organizations to be aware of and reach out to the patient.

But if social and community services were clearly outlined as covered entities that could receive protected health information from care providers under certain circumstances, the man’s providers may be more likely to directly share his information with the types of social services that could help him most. Although those organizations don’t fit the traditional definition of health care providers, their services are essential to patients’ holistic health.

When 81 percent of health care leaders expect innovative mergers to continue disrupting the industry, it’s clear that the traditional definition of a covered entity no longer applies. (Just ask Amazon.) Any proposal, then — whether it’s from HIPAA or someone else — to modernize regulations to the changing economics and boundaries of health care by acknowledging the importance of community-based programs is a leap in the right direction.

This is especially true when it comes to treating seniors, for whom familial support, housing, and access to transportation are the social determinants of health most crucial to improving care. It’s essential to support coordination between clinical providers and social or community agencies that can mitigate those determinants.

I know because I’ve spent 35 years as a physician and adviser to senior care providers working to support such coordination in the hopes of creating a better health system for seniors.

This has included helping run one of the country’s largest Programs of All-Inclusive Care for the Elderly (PACE) initiatives in New York City. Through adult day health centers, PACE provides preventive, primary, acute, behavioral, and long-term care services for people 55 and older, most of whom are dual eligible, meaning they qualify for both Medicare and Medicaid. In addition to traditional health care services, PACE benefits can also include meals, nutritional counseling, social work counseling, and transportation, all supported by a well-coordinated interdisciplinary care team.

Instead of locking away seniors in hospitals or nursing homes, PACE programs embrace them into a sense of community.

In New York City alone, a study comparing hospital and skilled nursing facility utilization between PACE and a Medicaid-sponsored, managed long-term care plan found that PACE participants had a lower rate of hospitalizations than those enrolled in the Medicaid plan. In California, PACE programs cost up to 34 percent less than traditional facilities-based care models serving the same dual-eligible elderly patient populations.

Yet according to a “Candid Conversation on Elder Care” by BDO, the company where I work, just 12 percent of providers plan to invest in PACE in the next two years as a way to prepare for the growth of the aging population.

Part of that has to do with the requirement of a physical site to provide adult day services. But another part has to do with Medicare’s limitations on the program, such as restrictions on what the interdisciplinary team is allowed to do for beneficiaries.

Simply put, regulations — those from HHS but also across the broader industry landscape — need to be updated to reflect the shift in mindset happening across the industry: moving away from siloed care toward a more collaborative, coordinated care experience that reaches beyond the four walls of a doctor’s office or hospital and into patients’ communities.

The proposed updates to HIPAA have garnered more than 1,300 comments and are likely to be modified before the final guidance is published. But the request for information and broader regulatory updates like it have the potential to bring us closer to the goal of a more coordinated health care experience.

David Friend, M.D., is a managing director and chief transformation officer in the BDO Center for Healthcare Excellence & Innovation.

  • Look: Medicare and Medicaid are completely out of control. The only way to solve the problem is to end both programs. Elderly patients are entitled to only the most basic care. No heart surgeries, or hip replacements. Those things are much too expensive.

    In the future, each elderly patient should be granted access to a cash account, similar to a Social Security account. Each account would provide for a certain amount of funding: say $20,000 per year for each person over the age of seventy.

    Once that money is exhausted, that’s it. The elderly will then have to depend on financing from their family; or begin to make end-of-life decisions.

Comments are closed.