Proposed HIPAA Changes Promote Better Access, Coordination of Care

UPDATED: March 9, 2021

For the first time in a decade, there are broad proposed amendments to the HIPAA regulations. Late last year, the Office for Civil Rights (OCR) of the U.S. Department of Health and Human Services (HHS) released a “Notice of Proposed Rulemaking” (NPRM) in which it formally announced consideration of various changes to the existing HIPAA regulations. The last time the HIPAA regulations were significantly revised was in 2013.

This week, HHS announced a 45-day extension of the public comment period. OCR first released the NPRM to the public on the HHS website on December 10, 2020, and it was published in the Federal Register on January 21. The 45-day extension moves the current deadline for the public to submit comments to May 6, 2021.

The easiest way to summarize the proposed amendments is that they would make HIPAA a bit more helpful for both individuals and providers.

Among other things, the revisions would increase access to health records, facilitate the sharing of health information and enable health information to be disclosed for a broader array of care coordination and public health purposes. The proposals further HHS’s goal of achieving value-based healthcare and fostering value-based arrangements. In many ways, these proposed revisions are very consistent with the OCR’s recent “Right of Access Initiative” which was the impetus for a dozen settlement agreements in 16 months. Furthermore, the proposed revisions expressly reflect OCR’s efforts to facilitate information disclosures in situations involving substance use disorders and pandemic response.

The NPRM also expressly takes into consideration the relationship between HIPAA and the 21^st Century Cures Act (“Cures Act”) Information Blocking and Interoperability Rules. Certain of the proposed new or modified definitions, such as “Personal Health Application” (which is a single point of access by a patient to health information from multiple sources) and “Electronic Health Record” (EHR), are directly related to the Cures Act regulations. To this end, the NPRM addresses the form, format, and manner in which providers may provide records to patients and the allowable fees for access or copies, all of which support a patient’s right to direct disclosure of a personal health record based on certain common technologies.

Among other things, the proposed amendments would:

• Reduce the timing for the right of access from 30 days to 15 days.
• Expand the patient’s right of access and ability to direct the disclosure of electronic health information.
• Facilitate the ability of healthcare providers to share information for care coordination purposes and in emergency situations, such as a drug overdose.
• Lower the threshold (from “professional judgment” to “good faith belief”) for certain disclosures where individual or public health are at risk--and to expand the presumption of good faith belief in such cases.
• Eliminate the requirement to obtain written confirmation of Notice of Privacy Practices.
• Ease the requirements for personal verification in order to obtain information.

Notably, however, the NPRM leaves HIPAA’s Security Rule untouched.

At this point, the OCR will be accepting comments on the NPRM for a period of 60 days following the formal publication of the NPRM in the Federal Register. The OCR has the option of extending the comment period. After that, the timing is much less clear. In the case of the most recent revisions to HIPAA, there was a three-year gap between the proposed rules and final rules. In fact, for some of the proposed rules from 2010, there has been no further action. Nevertheless, based on the nature of the proposed amendments and their correlation to OCR’s recent initiatives and public health initiatives with respect to COVID and the on-going opioid crisis, it is likely that the wait period will be shorter this time around. Furthermore, although it is anyone’s guess whether the change in administration will play a role in the next steps with the NPRM, it appears that the proposed amendments are apolitical.

Regardless of what and when the amendments are, it is very likely that covered entities and business associates will need to make a variety of revisions to their HIPAA policies and procedures in the near future.

For assistance with HIPAA generally and for proposing comments to the proposed NPRM, please contact the authors.