Proposed Revisions to HIPAA Privacy Rule and Extension for Public Comment

On March 9, 2021, the Office for Civil Rights (OCR) at the U.S. Department of Health and Human Services announced that it was extending public comment on the proposed changes to the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule from March 22, 2021 to May 6, 2021.

OCR first released the proposed modifications to the HIPAA Privacy Rule on December 10, 2020. Specifically, OCR announced it was proposing changes “to support individuals’” engagement in their care, remove barriers to coordinate care and reduce the regulatory burdens on the health care industry.”

One goal of the proposed modification is to strengthen individuals’ rights access to their own health information. For example, the modification would shorten the response time for patient health record requests from 30 days to 15 days. Individuals’ right of access is an area that has been a recent focus of OCR over the past two years with OCR launching the HIPAA Right of Access Initiative. Specifically, OCR has been cracking down and issuing fines when providers fail to provide individuals timely access to their medical records at a reasonable cost, or when the provider fails to respond to individuals’ requests to have their medical records sent to a third party. To date, OCR has settled 16 investigations into potential violations of the HIPAA Right of Access Initiative.

Other proposed modifications to the HIPAA Privacy Rule are aimed at improving information sharing for care coordination and case management for individuals, facilitating greater family and caregiver involvement in the care of individuals experiencing emergencies or health crises, enhancing flexibilities for disclosures in emergency or threatening circumstances, and reducing administrative burdens on HIPAA covered health care providers and health plans.

For example, one proposed modification is to eliminate the requirement for a covered health care provider with a direct treatment relationship to an individual to obtain a written acknowledgement of receipt of Notice of Privacy Practices (NPP). Instead, the proposal proposes replacing the written acknowledgement with an individual right to discuss the NPP with a person designated by the covered entity. The proposal also would modify the content requirements of the NPP itself. The content modifications are aimed to improve patients’ awareness of their Privacy Rule rights and what they can do if they suspect a violation of their rights.

OCR anticipates it will receive a significant amount of feedback on the proposed changes since the modifications affect “nearly anyone who interacts with the health care system.”

Sara Inman

About the Author: Sara Inman

Sara Inman has established her practice with a wide range of litigation experience that includes product liability defense, commercial litigation and litigation involving catastrophic injuries. However, her focus is on insurance bad faith litigation and she is a member of the firm’s long-term care and property & casualty groups. She represents small businesses and Fortune 500 companies in state and federal courts and has experience in all aspects of trial preparation and arbitration. Sara has been retained to conduct investigations before matters reach the litigation stage and to counsel clients on issues relating to privacy and cybersecurity. Visit Sara’s bio on the Faegre Drinker website.

Leave a Reply

Your email address will not be published. Required fields are marked *