Comment Period Extended for Proposed HIPAA Privacy Rule Changes

 The Office for Civil Rights (OCR) has announced a comment period extension for proposed changes to the HIPAA Privacy Rule. Managed by the Department of Health and Human Services (HHS), the OCR extended the public comment period another 45 days. The comment period allows for a public review of a Notice of Proposed Rulemaking (NPRM). This NPRM would modify the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule. The HHS also recently amended fines levied under the Health Information Technology for Economic and Clinical Health Act (HITECH).

Overview of the NPRM

On March 9th, 2021, the OCR announced the extension to the NPRM comment period. Earlier, on December 10th, 2020, the OCR first released the NPRM to the public on the HHS website. Later, the Federal Register published the NPRM on January 21st, 2021. The 45-day extension moves the current deadline for comments from March 22nd, 2021, to May 6th, 2021.

 Proposed Changes to the HIPAA Privacy Rule

The proposed changes to the HIPAA Privacy Rule include the following:

• strengthening individuals’ rights to access their own health information, including electronic information;
• improving information sharing for care coordination and case management for individuals;
• facilitating greater family and caregiver involvement in the care of individuals experiencing emergencies or health crises;
• enhancing flexibilities for disclosures in emergency or threatening circumstances, such as the opioid and COVID-19 public health emergencies; and
• reducing administrative burdens on HIPAA-covered health care providers and health plans. The reductions of burdens, however, would allow entities to continue to protect individuals’ health information privacy interests.

Employer Takeaways

In conclusion, all HIPAA-covered entities should review the proposed NPRM changes and provide any comments to the HHS. Accordingly, any comments received will be carefully considered and will help to shape the final rule. According to the HHS, the OCR expects to issue the final HIPAA Privacy Rule in late 2021 or early 2022.