On March 9, 2021, the Office for Civil Rights (OCR) at the U.S. Department of Health and Human Services announced that it was extending public comment on the proposed changes to the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule from March 22, 2021 to May 6, 2021.
OCR first released the proposed modifications to the HIPAA Privacy Rule on December 10, 2020. Specifically, OCR announced it was proposing changes “to support individuals’” engagement in their care, remove barriers to coordinate care and reduce the regulatory burdens on the health care industry.”
One goal of the proposed modification is to strengthen individuals’ rights access to their own health information. For example, the modification would shorten the response time for patient health record requests from 30 days to 15 days. Individuals’ right of access is an area that has been a recent focus of OCR over the past two years with OCR launching the HIPAA Right of Access Initiative. Specifically, OCR has been cracking down and issuing fines when providers fail to provide individuals timely access to their medical records at a reasonable cost, or when the provider fails to respond to individuals’ requests to have their medical records sent to a third party. To date, OCR has settled 16 investigations into potential violations of the HIPAA Right of Access Initiative.
Other proposed modifications to the HIPAA Privacy Rule are aimed at improving information sharing for care coordination and case management for individuals, facilitating greater family and caregiver involvement in the care of individuals experiencing emergencies or health crises, enhancing flexibilities for disclosures in emergency or threatening circumstances, and reducing administrative burdens on HIPAA covered health care providers and health plans.
For example, one proposed modification is to eliminate the requirement for a covered health care provider with a direct treatment relationship to an individual to obtain a written acknowledgement of receipt of Notice of Privacy Practices (NPP). Instead, the proposal proposes replacing the written acknowledgement with an individual right to discuss the NPP with a person designated by the covered entity. The proposal also would modify the content requirements of the NPP itself. The content modifications are aimed to improve patients’ awareness of their Privacy Rule rights and what they can do if they suspect a violation of their rights.
OCR anticipates it will receive a significant amount of feedback on the proposed changes since the modifications affect “nearly anyone who interacts with the health care system.”
The material contained in this communication is informational, general in nature and does not constitute legal advice. The material contained in this communication should not be relied upon or used without consulting a lawyer to consider your specific circumstances. This communication was published on the date specified and may not include any changes in the topics, laws, rules or regulations covered. Receipt of this communication does not establish an attorney-client relationship. In some jurisdictions, this communication may be considered attorney advertising.
