HHS fires wave motion gun: creeps closer to meaningful use

(If you don’t get the reference, subtract 50 geek points).

So, if you haven’t heard the news, HHS (finally) submitted their proposed final rule for meaningful use to the OMB last week.  Of course, everyone is very excited (oooo…. shiny new rules) and very nervous (Oh noes!  New rulz!11!!) about  the changes.

Of course, those of us with a security bent are particularly keen on how they address the public commentary.  Most folks seem to think that they’ll relax the final rule across the board.  I agree with that, but my hope is they won’t relax the security aspects they’ve laid out.  There’s some good stuff in there.  For example, if you look at the Interim Final Rule from January, you see awesome little tidbits like this one (on 2034 – page 22 of the pdf link):

Consequently, a HIPAA covered entity could be in compliance with the HIPAA Security Rule if it determines that encryption is not reasonable and appropriate in its environment and it documents its rationale and implements an equivalent alternative measure if reasonable and appropriate. We hope that by requiring Certified EHR Technology to include this capability, that the use of encryption will become more prevalent.

See what they did there?  Not only did they clarify what a covered entity has to do under HIPAA when they believe encryption is not “reasonable and appropriate” (i.e. document the rationale and implement equivalent measures), but they also recognize that few in the provider space actually encrypt ePHI (hey, you made them addressable so point the finger back on you buddy).  So them requiring it of the EHR is pretty cool.

There are a number of reasons that I like what they have in the Interim Final Rule – and not just because of the encryption piece.  For example, I get nervous about makeshift (homegrown) EMRs, EHR software that purports not to be, as well as the finely-chopped slaw of aging software that you see in the field so often.  So…  I’m on board.  Not only do I think that the new rules will drive useful technology adoption (man I wish those folks were public), but I also think it’ll shake out some of the overlap that we’re seeing among traditional products and provide impetus for vendor innovation.

So hats off to HHS for moving this through.